Configuring Cisco Trustsec Macsec - Cisco Catalyst 4500 series Administration Manual

Configuring Cisco TrustSec MACsec

Cisco TrustSec NDAC SAP is supported on trunk ports because it is intended only for network device
to network device links, that is, switch-to-switch links. It is not supported on:
•
•
•
The switch also does not support security group ACLs.
You must set the Cisco TrustSec credentials to create the Cisco TrustSec network.
You can configure Cisco TrustSec link layer security in 802.1X mode or manual mode.
Configuring Cisco TrustSec MACsec
MACsec is supported on the Catalyst 4500 series switch universal k9 image. It is not supported with the
Note
NPE license or with a LAN Base service image.
Following topics are discussed:
•
•
•
•
Note The sample configuration in the last section shows the AAA and the RADIUS configuration. Use this
example to configure RADIUS and AAA before configuring switch-to-switch security.
Configuring Cisco TrustSec Credentials on the Switch
To enable Cisco TrustSec features, you must create Cisco TrustSec credentials on the switch to use in
other TrustSec configurations.
To configure Cisco TrustSec credentials, perform this task:
Command
Step 1
cts credentials id device-id password
cts-password
Step 2
show cts credentials
Step 3
copy running-config startup-config
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
45-10
Host facing access ports (these ports support MKA MACsec)
Switch virtual interfaces (SVIs)
SPAN destination ports
Configuring Cisco TrustSec Credentials on the Switch, page 45-10
Configuring Cisco TrustSec Switch-to-Switch Link Security in 802.1X Mode, page 45-11
Configuring Cisco TrustSec Switch-to-Switch Link Security in Manual Mode, page 45-12
Cisco TrustSec Switch-to-Switch Link Security Configuration Example, page 45-14
Purpose
Specifies the Cisco TrustSec credentials for this switch to use when
authenticating with other Cisco TrustSec devices with EAP-FAST.
• id device-id—Specifies a Cisco TrustSec device ID for the
switch. The device-id argument has a maximum length of 32
characters and is case sensitive.
password cts-password—Specifies the Cisco TrustSec
•
password for the device.
(Optional) Displays Cisco TrustSec credentials configured on the
switch.
(Optional) Saves your entries in the configuration file.
Chapter 45 Configuring MACsec Encryption
OL_28731-01