Information About Cisco Trustsec - Cisco Catalyst 2960-XR Security Configuration Manual

Information About Cisco TrustSec

Information About Cisco TrustSec
The table below lists the TrustSec features to be eventually implemented on TrustSec-enabled Cisco switches.
Successive general availability releases of TrustSec will expand the number of switches supported and the
number of TrustSec features supported per switch.
Cisco TrustSec Feature
802.1AE Tagging (MACsec)
Endpoint Admission Control (EAC)
Network Device Admission Control (NDAC)
Security Group Access Control List (SGACL)
Security Association Protocol (SAP)
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
374
Description
Protocol for IEEE 802.1AE-based wire-rate
hop-to-hop Layer 2 encryption.
Between MACsec-capable devices, packets are
encrypted on egress from the transmitting device,
decrypted on ingress to the receiving device, and in
the clear within the devices.
This feature is only available between TrustSec
hardware-capable devices.
EAC is an authentication process for an endpoint user
or a device connecting to the TrustSec domain.
Usually EAC takes place at the access level switch.
Successful authentication and authorization in the
EAC process results in Security Group Tag
assignment for the user or device. Currently EAC can
be 802.1X, MAC Authentication Bypass (MAB), and
Web Authentication Proxy (WebAuth).
NDAC is an authentication process where each
network device in the TrustSec domain can verify the
credentials and trustworthiness of its peer device.
NDAC utilizes an authentication framework based
on IEEE 802.1X port-based authentication and uses
EAP-FAST as its EAP method. Successful
authentication and authorization in NDAC process
results in Security Association Protocol negotiation
for IEEE 802.1AE encryption.
A Security Group Access Control List (SGACL)
associates a Security Group Tag with a policy. The
policy is enforced upon SGT-tagged traffic egressing
the TrustSec domain.
After NDAC authentication, the Security Association
Protocol (SAP) automatically negotiates keys and the
cipher suite for subsequent MACSec link encryption
between TrustSec peers. SAP is defined in IEEE
802.11i.
Configuring Cisco TrustSec
OL-29434-01