Configuring Cisco Trustsec Macsec - Cisco Catalyst 3560-X Software Configuration Manual

Configuring Cisco TrustSec MACsec

The switch also does not support security group ACLs.
You must set the Cisco TrustSec credentials to create the Cisco TrustSec network.
You can configure Cisco TrustSec link layer security in 802.1x mode or manual mode.
Configuring Cisco TrustSec MACsec
•
•
•
•
Note The sample configuration in the last section shows the AAA and the RADIUS configuration. Use this
example to configure RADIUS and AAA before configuring switch-to-switch security.
Configuring Cisco TrustSec Credentials on the Switch
To enable Cisco TrustSec features, you must create Cisco TrustSec credentials on the switch to use in
other TrustSec configurations. Beginning in privilege EXEC mode, follow these steps to configure Cisco
TrustSec credentials.
Command
Step 1 cts credentials id device-id password
cts-password
Step 2 show cts credentials
Step 3 copy running-config startup-config
To delete the Cisco TrustSec credentials, enter the clear cts credentials privileged EXEC command.
This example shows how to create Cisco TrustSec credentials.
Switch# cts credentials id trustsec password mypassword
CTS device ID and password have been inserted in the local keystore. Please make
sure that the same ID and password are configured in the server database.
Switch# show cts credentials
CTS password is defined in keystore, device-id = trustsecchange-password
password change with AAA server
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
1-10
Configuring Cisco TrustSec Credentials on the Switch, page 1-10
Configuring Cisco TrustSec Switch-to-Switch Link Security in 802.1x Mode, page 1-11
Configuring Cisco TrustSec Switch-to-Switch Link Security in Manual Mode, page 1-12
Cisco TrustSec Switch-to-Switch Link Security Configuration Example, page 1-14
Purpose
Specifies the Cisco TrustSec credentials for this switch to use when
authenticating with other Cisco TrustSec devices with EAP-FAST.
id device-id—Specifies a Cisco TrustSec device ID for the
•
switch. The device-id argument has a maximum length of 32
characters and is case sensitive.
password cts-password—Specifies the Cisco TrustSec
•
password for the device.
(Optional) Displays Cisco TrustSec credentials configured on the
switch.
(Optional) Saves your entries in the configuration file.
Chapter 1 Configuring MACsec Encryption
Initiate
OL-25303-03