Cisco Catalyst 4500 Series Administration Guide

45-13
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 45 Configuring MACsec Encryption
Configuring Cisco TrustSec MACsec
• These protection levels are supported when you configure SAP pairwise master key (sap pmk):
– SAP is not configured—no protection.
– sap mode-list gcm-encrypt gmac no-encap—protection desirable but not mandatory.
– sap mode-list gcm-encrypt gmac—confidentiality preferred and integrity required. The
protection is selected by the supplicant according to supplicant preference.
– sap mode-list gmac—integrity only.
– sap mode-list gcm-encrypt—confidentiality required.
– sap mode-list gmac gcm-encrypt—integrity required and preferred, confidentiality optional.
To manually configure Cisco TrustSec on an interface to another Cisco TrustSec device, perform this
task:
Command Purpose
Step 1
configure terminal
Enters global configuration mode.
Step 2
interface interface-id
Enters interface configuration mode.
Step 3
cts manual
Enters Cisco TrustSec manual configuration mode.
Step 4
sap pmk key [mode-list mode1 [mode2
[mode3 [mode4]]]]
(Optional) Configures the SAP pairwise master key (PMK) and
operation mode. SAP is disabled by default in Cisco TrustSec
manual mode.
• key—A hexadecimal value with an even number of characters
and a maximum length of 32 characters.
The SAP operation mode options:
• gcm-encrypt—Authentication and encryption
Note Select this mode for MACsec authentication and
encryption if your software license supports MACsec
encryption.
• gmac—Authentication, no encryption
• no-encap—No encapsulation
• null—Encapsulation, no authentication or encryption
Note If the interface is not capable of data link encryption,
no-encap is the default and the only available SAP
operating mode. SGT is not supported.
Step 5
no propagate sgt
Prevents the interface from transmitting the SGT to the peer and
is required in manual mode.
Use the no form of this command when the peer is incapable of
processing a SGT.
Step 6
exit
Exits Cisco TrustSec 802.1X interface configuration mode.
Step 7
end
Returns to privileged EXEC mode.
Step 8
show cts interface [interface-id | brief |
summary
]
(Optional) Verifies the configuration by displaying
TrustSec-related interface characteristics.
Step 9
copy running-config startup-config
(Optional) Saves your entries in the configuration file.

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E