Cisco Catalyst 4500 Series - Configuring Macsec on an Interface

43-7
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
OL-25340-01
Chapter 43 Configuring MACsec Encryption
Configuring MACsec and MKA
Configuring MACsec on an Interface
To configure MACsec on an interface with one MACsec session for voice and one for data, perform this
task:
This is an example of configuring and verifying MACsec on an interface:
Switch(config)# interface GigabitEthernet1/0/25
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport mode access
Switch(config-if)# macsec
Switch(config-if)# authentication event linksec fail action authorize vlan 2
Switch(config-if)# authentication host-mode multi-domain
Switch(config-if)# authentication linksec policy must-secure
Switch(config-if)# authentication port-control auto
Command Purpose
Step 1
configure terminal
Enters global configuration mode.
Step 2
interface interface-id
Identifies the MACsec interface, and enter interface configuration mode.
The interface must be a physical interface.
Step 3
switchport access vlan vlan-id
Configures the access VLAN for the port.
Step 4
switchport mode access
Configures the interface as an access port.
Step 5
macsec
Enables 802.1ae MACsec on the interface.
Step 6
authentication event linksec fail
action authorize vlan vlan-id
(Optional) Specifies that the switch processes authentication link-security
failures resulting from unrecognized user credentials by authorizing a
restricted VLAN on the port after a failed authentication attempt.
Step 7
authentication host-mode
multi-domain
Configures authentication manager mode on the port to allow both a host
and a voice device to be authenticated on the 802.1X-authorized port. If
not configured, the default host mode is single.
Step 8
authentication linksec policy
must-secure
Sets the LinkSec security policy to secure the session with MACsec if the
peer is available. If not set, the default is should secure.
Step 9
authentication port-control auto
Enables 802.1X authentication on the port. The port changes to the
authorized or unauthorized state based on the authentication exchange
between the switch and the client
Step 10
mka policy policy-name
Applies an existing MKA protocol policy to the interface, and enable
MKA on the interface. If no MKA policy was configured (by entering the
mka policy global configuration command), you must apply the MKA
default policy to the interface by entering the mka default-policy
interface configuration command.
Step 11
dot1x pae authenticator
Configures the port as an 802.1X port access entity (PAE) authenticator.
Step 12
spanning-tree portfast
Enables spanning tree Port Fast on the interface in all its associated
VLANs. When Port Fast feature is enabled, the interface changes directly
from a blocking state to a forwarding state without making the
intermediate spanning-tree state changes.
Step 13
end
Returns to privileged EXEC mode.
Step 14
show authentication session
interface interface-id
Verifies the authorized session security status.
Step 15
copy running-config startup-config
(Optional) Saves your entries in the configuration file.