Cisco TrustSec

Contents
iv
Cisco TrustSec Configuration Guide
OL-22192-01
Configuring the Cisco TrustSec Solution 2-1
Configuration Overview 2-1
Cisco TrustSec Configuration How-to Documents 2-1
Supported Hardware and Software 2-2
Prerequisites for Cisco TrustSec 2-2
Cisco TrustSec Guidelines and Limitations 2-3
Default Settings 2-3
Additional Documentation 2-3
Release-Specific Documents 2-3
Platform-Specific Documents 2-4
Cisco IOS TrustSec Documentation Set 2-5
Configuring Identities, Connections, and SGTs 3-1
Cisco TrustSec Identity Configuration Feature Histories 3-1
Configuring Credentials and AAA for a Cisco TrustSec Seed Device 3-2
Configuration Examples for Seed Device 3-3
Configuring Credentials and AAA for a Cisco TrustSec Non-Seed Device 3-3
Configuration Examples for Non-Seed Device 3-4
Enabling Cisco TrustSec Authentication and MACsec in 802.1X Mode on an Uplink Port 3-5
Configuration Examples for 802.1X on Uplink Port 3-6
Configuring Cisco TrustSec and MACsec in Manual Mode on an Uplink Port 3-6
Configuration Examples for Manual Mode and MACsec on an Uplink Port 3-8
Regenerating SAP Key on an Interface 3-9
Verifying the Cisco TrustSec Interface Configuration 3-9
Manually Configuring a Device SGT 3-11
Configuration Examples for Manually Configuring a Device SGT 3-11
Manually Configuring IP-Address-to-SGT Mapping 3-12
Subnet to SGT Mapping 3-12
Default Settings 3-12
Configuring Subnet to SGT Mapping 3-12
Verifying Subnet to SGT Mapping Configuration 3-15
Configuration Examples for Subnet to SGT Mapping 3-15
VLAN to SGT Mapping 3-16
Default Settings 3-17
Configuring VLAN to SGT Mapping 3-17
Verifying VLAN to SGT Mapping 3-19
Configuration Example for VLAN to SGT Mapping for a Single Host Over an Access Link 3-19