Cisco Catalyst 3560-X Series, Software Configuration Manual

Page: 374 / 1538

1-10
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-25303-03
Chapter 1 Configuring MACsec Encryption
Configuring Cisco TrustSec MACsec
The switch also does not support security group ACLs.
You must set the Cisco TrustSec credentials to create the Cisco TrustSec network.
You can configure Cisco TrustSec link layer security in 802.1x mode or manual mode.
Configuring Cisco TrustSec MACsec
•
Configuring Cisco TrustSec Credentials on the Switch, page 1-10
• Configuring Cisco TrustSec Switch-to-Switch Link Security in 802.1x Mode, page 1-11
•
Configuring Cisco TrustSec Switch-to-Switch Link Security in Manual Mode, page 1-12
• Cisco TrustSec Switch-to-Switch Link Security Configuration Example, page 1-14
Note
The sample configuration in the last section shows the AAA and the RADIUS configuration. Use this
example to configure RADIUS and AAA before configuring switch-to-switch security.
Configuring Cisco TrustSec Credentials on the Switch
To enable Cisco TrustSec features, you must create Cisco TrustSec credentials on the switch to use in
other TrustSec configurations. Beginning in privilege EXEC mode, follow these steps to configure Cisco
TrustSec credentials.
To delete the Cisco TrustSec credentials, enter the clear cts credentials privileged EXEC command.
This example shows how to create Cisco TrustSec credentials.
Switch# cts credentials id trustsec password mypassword
CTS device ID and password have been inserted in the local keystore. Please make
sure that the same ID and password are configured in the server database.
Switch# show cts credentials
CTS password is defined in keystore, device-id = trustsecchange-password Initiate
password change with AAA server
Command Purpose
Step 1 cts credentials id device-id password
cts-password
Specifies the Cisco TrustSec credentials for this switch to use when
authenticating with other Cisco TrustSec devices with EAP-FAST.
• id device-id — Specifies a Cisco TrustSec device ID for the
switch. The device-id argument has a maximum length of 32
characters and is case sensitive.
•
password cts-password — Specifies the Cisco TrustSec
password for the device.
Step 2 show cts credentials (Optional) Displays Cisco TrustSec credentials configured on the
switch.
Step 3
copy running-config startup-config (Optional) Saves your entries in the configuration file.