Cisco Catalyst 4500 Series Software Configuration Guide

48-17
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 48 Configuring MACsec Encryption
Understanding MKA MACsec with EAP-TLS
Applying the 802.1x and MKA MACsec Configuration on Interfaces
To apply 801.1x and MKA MACsec using EAP-TLS to interfaces, perform the following task:
Example: MKA MACsec Switch-to-Switch Configuration
Switch# configure terminal
Switch(config)# crypto key generate rsa label mkaioscarsa mod 2048
The name for the keys will be: mkaioscarsa
Step 8
priority-number class always
do-until-failure
Associates a priority with an action in the control policy.
Step 9
action-number terminate dot1x
Terminates the authentication of a subscriber session using the IEEE
802.1x method
Step 10
action-number
authentication-restart seconds
Sets a timer to restart the authentication process after an authentication or
authorization failure.
Step 11
exit
Exits control policy-map event configuration mode and returns to global
configuration mode.
Step 12
copy running-config startup-config
(Optional) Saves your entries in the configuration file.
Command Purpose
Command Purpose
Step 1
configure terminal
Enters global configuration mode.
Step 2
interface interface-id
Identifies the MACsec interface, and enter interface configuration mode.
The interface must be a physical interface.
Step 3
macsec network-link
Enables MKA MACsec using EAP-TLS, on the interface.
Step 4
authentication periodic
Enables reauthentication for this port.
Step 5
authentication timer reauthenticate
interval
Sets the reauthentication interval.
Step 6
access-session host-mode multi-host
Allows hosts to gain access to the interface.
Step 7
access-session closed
Prevents preauthentication access on the interface.
Step 8
access-session port-control auto
Sets the authorization state of a port.
Step 9
dot1x pae both
Configures the port as an 802.1X port access entity (PAE) supplicant and
authenticator.
Step 10
dot1x credentials profile
Assigns a 802.1x credentials profile to the interface.
Step 11
dot1x supplicant eap profile name
Assigns the EAP-TLS profile to the interface.
Step 12
service-policy type control
subscriber control-policy name
Applies a subscriber control policy to the interface.
Step 13
exit
Returns to privileged EXEC mode.
Step 14
show access-session interface
interface-id
(Optional) Displays the active MKA sessions for the interface, and
verifies your MKA MACsec configuration.
Step 15
show mka session interface
interface-id
Step 16
show macsec interface interface-id
Step 17
copy running-config startup-config
(Optional) Saves your entries in the configuration file.

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E