Cisco Catalyst 4500 Series Administration Guide

CHAPTER
45-1
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
45
Configuring MACsec Encryption
This chapter describes how to configure Media Access Control Security (MACsec) encryption on the
Catalyst 4500 series switch.
MACsec is the IEEE 802.1AE standard for authenticating and encrypting packets between two
MACsec-capable devices. The Catalyst 4500 series switch supports 802.1AE encryption with MACsec
Key Agreement (MKA) on downlink ports for encryption between the switch and host devices. The
switch also supports MACsec link layer switch-to-switch security by using Cisco TrustSec Network
Device Admission Control (NDAC) and the Security Association Protocol (SAP) key exchange. Link
layer security can include both packet authentication between switches and MACsec encryption between
switches (encryption is optional).
Note MACsec is supported on the Catalyst 4500 series switch universal k9 image. It is not supported with the
NPE license or with a LAN Base service image.
All downlink ports on a switch can run Cisco TrustSec MACsec link layer switch-to-switch security.
Cisco TrustSec and Cisco SAP are meant only for switch-to-switch links and are not supported on switch
ports connected to end hosts, such as PCs or IP phones. MKA is meant for switch-to-host facing links
and is not supported on switch-to-switch links. Host-facing links typically use flexible authentication
ordering for handling heterogeneous devices with or without IEEE 802.1X, and can optionally use MKA
encryption. Cisco NDAC and SAP are mutually exclusive with Network Edge Access Topology (NEAT),
which is used for compact switches to extend security outside the wiring closet.
• Understanding Media Access Control Security and MACsec Key Agreement, page 45-2
• Configuring MACsec and MACsec Key Agreement, page 45-6
• Understanding Cisco TrustSec MACsec, page 45-8
• Configuring Cisco TrustSec MACsec, page 45-10
For more information on TrustSec, refer to the following URL:
http://www.cisco.com/en/US/docs/switches/lan/trustsec/configuration/guide/trustsec.html
Table 1 MACsec Support on Switch Ports
Interface Connections MACsec support
User-facing downlink ports Switch-to-host MKA MACsec encryption
Switchports connected to other
switches
Switch-to-switch Cisco TrustSec NDAC MACsec

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E