Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1255 / 2086

C H A P T E R
48-1
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
48
Configuring MACsec Encryption
This chapter describes how to configure Media Access Control Security (MACsec) encryption on the
Catalyst 4500 series switch.
MACsec is the IEEE 802.1AE standard for authenticating and encrypting packets between two
MACsec-capable devices. The Catalyst 4500 series switch supports 802.1AE encryption with MACsec
Key Agreement (MKA) on downlink ports for encryption between the switch and host devices. The
switch also supports MACsec link layer switch-to-switch security by using Cisco TrustSec Network
Device Admission Control (NDAC) and the Security Association Protocol (SAP) key exchange. Link
layer security can include both packet authentication between switches and MACsec encryption between
switches (encryption is optional).
Note
MACsec is supported on the Catalyst 4500 series switch universal k9 image. It is not supported with the
NPE license or with a LAN Base service image.
All downlink ports on a switch can run Cisco TrustSec MACsec link layer switch-to-switch security.
Cisco TrustSec and Cisco SAP are meant only for switch-to-switch links and are not supported on switch
ports connected to end hosts, such as PCs or IP phones. MKA is supported on both switch-to-host facing
links, and switch-to-switch links as well. Host-facing links typically use flexible authentication ordering
for handling heterogeneous devices with or without IEEE 802.1X, and can optionally use MKA
encryption. Cisco NDAC and SAP are mutually exclusive with Network Edge Access Topology (NEAT),
which is used for compact switches to extend security outside the wiring closet.
This chapter includes the following major sections:
•
Understanding Media Access Control Security and MACsec Key Agreement, page 48-2
•
Configuring MACsec and MACsec Key Agreement, page 48-7
•
Understanding MKA MACsec with EAP-TLS, page 48-11
•
Understanding Cisco TrustSec MACsec, page 48-19
•
Configuring Cisco TrustSec MACsec, page 48-21
Table 1 MACsec Support on Switch Ports
Interface Connections MACsec support
User-facing downlink ports Switch-to-host MKA MACsec encryption
Switchports connected to other
switches Switch-to-switch Cisco TrustSec NDAC MACsec
MKA MACsec encryption