Cisco Catalyst 4500 Series Administration Guide

45-10
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 45 Configuring MACsec Encryption
Configuring Cisco TrustSec MACsec
Cisco TrustSec NDAC SAP is supported on trunk ports because it is intended only for network device
to network device links, that is, switch-to-switch links. It is not supported on:
• Host facing access ports (these ports support MKA MACsec)
• Switch virtual interfaces (SVIs)
• SPAN destination ports
The switch also does not support security group ACLs.
You must set the Cisco TrustSec credentials to create the Cisco TrustSec network.
You can configure Cisco TrustSec link layer security in 802.1X mode or manual mode.
Configuring Cisco TrustSec MACsec
Note MACsec is supported on the Catalyst 4500 series switch universal k9 image. It is not supported with the
NPE license or with a LAN Base service image.
Following topics are discussed:
• Configuring Cisco TrustSec Credentials on the Switch, page 45-10
• Configuring Cisco TrustSec Switch-to-Switch Link Security in 802.1X Mode, page 45-11
• Configuring Cisco TrustSec Switch-to-Switch Link Security in Manual Mode, page 45-12
• Cisco TrustSec Switch-to-Switch Link Security Configuration Example, page 45-14
Note The sample configuration in the last section shows the AAA and the RADIUS configuration. Use this
example to configure RADIUS and AAA before configuring switch-to-switch security.
Configuring Cisco TrustSec Credentials on the Switch
To enable Cisco TrustSec features, you must create Cisco TrustSec credentials on the switch to use in
other TrustSec configurations.
To configure Cisco TrustSec credentials, perform this task:
Command Purpose
Step 1
cts credentials id device-id password
cts-password
Specifies the Cisco TrustSec credentials for this switch to use when
authenticating with other Cisco TrustSec devices with EAP-FAST.
• id device-id—Specifies a Cisco TrustSec device ID for the
switch. The device-id argument has a maximum length of 32
characters and is case sensitive.
• password cts-password—Specifies the Cisco TrustSec
password for the device.
Step 2
show cts credentials
(Optional) Displays Cisco TrustSec credentials configured on the
switch.
Step 3
copy running-config startup-config
(Optional) Saves your entries in the configuration file.

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E