Cisco Catalyst 4500 Series Administration Guide

45-6
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 45 Configuring MACsec Encryption
Configuring MACsec and MACsec Key Agreement
Configuring MACsec and MACsec Key Agreement
• Default MACsec MACsec Key Agreement Configuration, page 45-6
• Configuring an MKA Policy, page 45-6
• Configuring MACsec on an Interface, page 45-7
Default MACsec MACsec Key Agreement Configuration
MACsec is disabled. No MACsec Key Agreement (MKA) policies are configured.
Configuring an MKA Policy
To create an MKA Protocol policy, perform this task. Note that MKA also requires that you enable
802.1X.
This example configures the MKA policy relay-policy:
Switch(config)# mka policy replay-policy
Switch(config-mka-policy)# replay-protection window-size 300
Switch(config-mka-policy)# end
Let's say that we configure an MKA policy as follows:
Switch# conf terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# mka policy pol1
Switch(config-mka-policy)# replay-protection window-size 1000
Switch(config-mka-policy)# confidentiality-offset 50
Switch(config-mka-policy)# end
We observe the following:
• The payload starting from the SA (source MAC address) + 50 bytes offset is encrypted.
Command Purpose
Step 1
configure terminal
Enters global configuration mode.
Step 2
mka policy policy-name
Identifies an MKA policy, and enter MKA policy configuration mode. The
maximum policy name length is 16 characters.
Step 3
replay-protection window-size
frames
Enables replay protection, and configure the window size in number of
frames. The range is from 0 to 4294967295. The default window size is 0.
Entering a window size of 0 is not the same as entering the no
replay-protection command. Configuring a window size of 0 uses replay
protection with a strict ordering of frames. Entering no replay-protection
turns off MACsec replay-protection.
Step 4
end
Returns to privileged EXEC mode.
Step 5
show mka policy
Verifies your entries.
Step 6
copy running-config startup-config
(Optional) Saves your entries in the configuration file.

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E