Cisco Catalyst 4500 Series, Руководство по настройке программного обеспечения

Страница: 1264 / 2086

48-10
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 48 Configuring MACsec Encryption
Configuring MACsec and MACsec Key Agreement
Configuring MKA Pre-Shared Key
To configure MACsec Key Agreement (MKA) pre-shared key, perform this task:
This example shows how to configure MKA pre-shared key:
Switch# configure terminal
Switch(config)# key chain keychain1 macsec
Switch(config-keychain-macsec)# key 0001
Switch(config-keychain-macsec-key)# cryptographic-algorithm aes-128-cmac
Switch(config-keychain-macsec-key)# key-string 0 pwd
Switch(config-keychain-macsec-key)# lifetime local 16:00:00 Nov 9 2014 duration 6000
Switch(config-keychain-macsec-key)# end
Switch# copy running-config startup-config
Example: Connectivity Association Key Rekey
The connectivity Association Key (CAK) is a long-lived master key that is used to generate all other keys
needed for MKA/MACsec.
The CAK rekey happens in the following cases:
•
When moving from Key 01 to Key 02 within the Key Chain K1.
•
When moving from one Key Chain K1 to another Key Chain K2.
Note
We recommend that you configure keys such that there is an overlap between the lifetime of the keys so
that CAK rekey is successful and there is a seamless transition between the keys/CA (without any traffic
loss or session restart.)
Command Purpose
Step 1
configure terminal
Enters global configuration mode.
Step 2
key chain key-chain-name [ macsec ] Configures a key chain and enters keychain MACsec configuration mode.
Note The key ID and the key string should not be all
zeros.
Step 3
key hex-string
Configures a key and enters keychain-MACsec key configuration mode.
• The key ID must be an even-digit-sized hex-string.
Step 4
cryptographic-algorithm
[ aes-128-cmac | aes-256-cmac ]
Sets the cryptographic encryption algorithm.
Step 5
key-string {[ 0 | 6 ] pre-shared-key
| 7 | pre-shared-key }
Sets the pre-shared key for a key string.
• The key-string should be a 32 or 64-digit hex-string, that is in sync
with the cryptographic algorithm that is configured.
Step 6
lifetime { local hh:mm:ss |
hh:mm:ss } day month year { duration
seconds | hh:mm:ss day month |
infinite }
Sets a lifetime for the MACsec key.
Step 7
end
Returns to privileged EXEC mode.
Step 8
copy running-config startup-config
(Optional) Saves your entries in the configuration file.