Cisco Catalyst 3560-X Software Configuration Manual page 365

Configuring MACsec Encryption
This chapter describes how to configure Media Access Control Security (MACsec) encryption on the
Catalyst 3750-X and 3560-X switch. MACsec is the IEEE 802.1AE standard for authenticating and
encrypting packets between two MACsec-capable devices. The Catalyst 3750-X and 3560-X switches
support 802.1AE encryption with MACsec Key Agreement (MKA) on downlink ports for encryption
between the switch and host devices. The switch also supports MACsec link layer switch-to-switch
security by using Cisco TrustSec Network Device Admission Control (NDAC) and the Security
Association Protocol (SAP) key exchange. Link layer security can include both packet authentication
between switches and MACsec encryption between switches (encryption is optional).
MACsec is not supported on switches running the NPE or the LAN base image.
Note
All downlink ports on the switch can run Cisco TrustSec MACsec link layer switch-to-switch security.
Table 1
Interface
User-facing downlink ports
Switchports connected to other
switches
Cisco TrustSec and Cisco SAP are meant only for switch-to-switch links and are not supported on switch
ports connected to end hosts, such as PCs or IP phones. MKA is meant for switch-to-host facing links
and is not supported on switch-to-switch links. Host-facing links typically use flexible authentication
ordering for handling heterogeneous devices with or without IEEE 802.1x, and can optionally use MKA
encryption. Cisco NDAC and SAP are mutually exclusive with Network Edge Access Topology (NEAT),
which is used for compact switches to extend security outside the wiring closet.
• Understanding Media Access Control Security and MACsec Key Agreement, page 1-2
• Configuring MKA and MACsec, page 1-6
Understanding Cisco TrustSec MACsec, page 1-8
•
Configuring Cisco TrustSec MACsec, page 1-10
•
OL-25303-03
MACsec Support on Switch Ports
Connections
Switch-to-host
Switch-to-switch
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
1
C H A P T E R
MACsec support
MKA MACsec encryption
Cisco TrustSec NDAC MACsec
1-1