Cisco Catalyst 4500 Series Configuration Guide

43-12
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
OL-25340-01
Chapter 43 Configuring MACsec Encryption
Configuring Cisco TrustSec MACsec
This example shows how to enable Cisco TrustSec authentication in 802.1X mode on an interface using
GCM as the preferred SAP mode:
Switch# configure terminal
Switch(config)# interface tengigabitethernet 1/1/2
Switch(config-if)# cts dot1x
Switch(config-if-cts-dot1x)# sap mode-list gcm-encrypt null no-encap
Switch(config-if-cts-dot1x)# exit
Switch(config-if)# end
Configuring Cisco TrustSec Switch-to-Switch Link Security in Manual Mode
If your switch does not have access to an authentication server or if 802.1X authentication is not needed,
you can manually configure Cisco TrustSec on an interface. You must manually configure the interface
on each end of the connection.
When manually configuring Cisco TrustSec on an interface, consider these usage guidelines and
restrictions:
• If no SAP parameters are defined, Cisco TrustSec encapsulation or encryption is not performed.
• If you select GCM as the SAP operating mode, you must have a MACsec Encryption software
license from Cisco. If you select GCM without the required license, the interface is forced to a
link-down state.
• These protection levels are supported when you configure SAP pairwise master key (sap pmk):
– SAP is not configured—no protection.
– sap mode-list gcm-encrypt gmac no-encap—protection desirable but not mandatory.
– sap mode-list gcm-encrypt gmac—confidentiality preferred and integrity required. The
protection is selected by the supplicant according to supplicant preference.
– sap mode-list gmac—integrity only.
– sap mode-list gcm-encrypt—confidentiality required.
– sap mode-list gmac gcm-encrypt—integrity required and preferred, confidentiality optional.
To manually configure Cisco TrustSec on an interface to another Cisco TrustSec device, perform this
task:
Step 5
exit
Exits Cisco TrustSec 802.1X interface configuration mode.
Step 6
end
Returns to privileged EXEC mode.
Step 7
show cts interface [interface-id | brief
| summary
]
(Optional) Verifies the configuration by displaying TrustSec-related
interface characteristics.
Step 8
copy running-config startup-config
(Optional) Saves your entries in the configuration file.
Command Purpose
Command Purpose
Step 1
configure terminal
Enters global configuration mode.
Step 2
interface interface-id
Enters interface configuration mode.
Step 3
cts manual
Enters Cisco TrustSec manual configuration mode.

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E