Cisco Catalyst 4500 Series, Руководство по настройке программного обеспечения, Страница: 1271 / 2086

48-17
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 48 Configuring MACsec Encryption
Understanding MKA MACsec with EAP-TLS
Applying the 802.1x and MKA MACsec Configuration on Interfaces
To apply 801.1x and MKA MACsec using EAP-TLS to interfaces, perform the following task:
Example: MKA MACsec Switch-to-Switch Configuration
Switch#
configure terminal
Switch(config)# crypto key generate rsa label mkaioscarsa mod 2048
The name for the keys will be: mkaioscarsa
Step 8
priority-number class always
do-until-failure
Associates a priority with an action in the control policy.
Step 9
action-number
terminate dot1x
Terminates the authentication of a subscriber session using the IEEE
802.1x method
Step 10
action-number
authentication-restart seconds
Sets a timer to restart the authentication process after an authentication or
authorization failure.
Step 11
exit
Exits control policy-map event configuration mode and returns to global
configuration mode.
Step 12
copy running-config startup-config
(Optional) Saves your entries in the configuration file.
Command Purpose
Command Purpose
Step 1
configure terminal
Enters global configuration mode.
Step 2
interface interface-id
Identifies the MACsec interface, and enter interface configuration mode.
The interface must be a physical interface.
Step 3
macsec network-link
Enables MKA MACsec using EAP-TLS, on the interface.
Step 4
authentication periodic
Enables reauthentication for this port.
Step 5
authentication timer reauthenticate
interval
Sets the reauthentication interval.
Step 6
access-session host-mode multi-host
Allows hosts to gain access to the interface.
Step 7
access-session closed
Prevents preauthentication access on the interface.
Step 8
access-session port-control auto
Sets the authorization state of a port.
Step 9
dot1x pae both
Configures the port as an 802.1X port access entity (PAE) supplicant and
authenticator.
Step 10
dot1x credentials profile
Assigns a 802.1x credentials profile to the interface.
Step 11
dot1x supplicant eap profile name
Assigns the EAP-TLS profile to the interface.
Step 12
service-policy type control
subscriber control-policy name
Applies a subscriber control policy to the interface.
Step 13
exit Returns to privileged EXEC mode.
Step 14
show access-session interface
interface-id
(Optional) Displays the active MKA sessions for the interface, and
verifies your MKA MACsec configuration.
Step 15
show mka session interface
interface-id
Step 16
show macsec interface interface-id
Step 17
copy running-config startup-config
(Optional) Saves your entries in the configuration file.