Cisco Catalyst 3560-X Series, Руководство по настройке программного обеспечения

Страница: 370 / 1538

1-6
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-25303-03
Chapter 1 Configuring MACsec Encryption
Configuring MKA and MACsec
MKPDU Failures
MKPDU Tx......................... 0
MKPDU Rx Validation.............. 0
MKPDU Rx Bad Peer MN............. 0
MKPDU Rx Non-recent Peerlist MN.. 0
For description of the output fields, see the command reference for this release.
Configuring MKA and MACsec
•
Default MACsec MKA Configuration, page 1-6
• Configuring an MKA Policy, page 1-6
•
Configuring MACsec on an Interface, page 1-7
Default MACsec MKA Configuration
MACsec is disabled. No MKA policies are configured.
Configuring an MKA Policy
Beginning in privileged EXEC mode, follow these steps to create an MKA Protocol policy. Note that
MKA also requires that you enable 802.1x.
This example configures the MKA policy relay-policy :
Switch(config)# mka policy replay-policy
Switch(config-mka-policy)# replay-protection window-size 300
Switch(config-mka-policy)# end
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 mka policy policy name Identify an MKA policy, and enter MKA policy configuration mode. The
maximum policy name length is 16 characters.
Step 3 replay-protection window-size frames Enable replay protection, and configure the window size in number of
frames. The range is from 0 to 4294967295. The default window size is 0.
Entering a window size of 0 is not the same as entering the no
replay-protection command. Configuring a window size of 0 uses replay
protection with a strict ordering of frames. Entering no replay-protection
turns off MACsec replay-protection.
Step 4 end Return to privileged EXEC mode.
Step 5
show mka policy Verify your entries.
Step 6
copy running-config startup-config (Optional) Save your entries in the configuration file.