cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Community Helping Community

504
Views
0
Helpful
3
Replies
Beginner

Switch to Router MACSEC

I have a Cisco 4510 with Supervisor 8E connected to a Cisco ASR1002-HX via a 10Gb link. Both ports support MACSEC and the ASR has a 10Gb MACSEC license. Is it possible to configure MACSEC on this switch to router link? If so then can anyone share the configuration?

3 REPLIES 3
Highlighted
VIP Advisor

Re: Switch to Router MACSEC

As per Cisco documentation as long as the module support have MACSEC, it can be achieved.

 

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/macsec/configuration/xe-16/macsec-xe-16-book.html

 

BB

BB
*** Rate All Helpful Responses ***
Beginner

Re: Switch to Router MACSEC

Thanks for the reply BB. Good to know that it should be possible. But I'm trying to work out the configurations to get this working as the commands seems to be different between the ASR and Catalyst platforms,

 

At the moment we have many Catalyst switch-to-switch connections that are configured for macsec using a static key-string. The configurations are fairly simple:

 

Cisco 3850

------------

interface TenGigabitEthernet1/0/5
 cts manual
  sap pmk 0000000000000000000000000000000000000000000000000000000123456789

 

Cisco 4510 Sup 8E

------------------

interface TenGigabitEthernet5/3
 cts manual
  sap pmk 0000000000000000000000000000000000000000000000000000000123456789

 

 

While the cts manual command is available on the ASR 1002-HXs, there is no subcommand to put in the pmk string. It looks like the macsec key is defined through a key chain instead and macsec is enabled with the macsec command. I've tried the following configuration but cts remains disabled on the ASR port.

 

ASR 1002-HX

--------------

key chain MACSEC-KEY-CHAIN macsec
  key 01
  key-string 0000000000000000000000000000000000000000000000000000000123456789


interface TenGigabitEthernet0/1/0
  mka pre-shared-key key-chain MACSEC-KEY-CHAIN
  macsec

 

Router#sh cts int tenGigabitEthernet 0/1/0

Interface TenGigabitEthernet0/1/0:

    CTS is disabled.

 

    L3 IPM:   disabled.

 

    CTS sgt-caching Ingress : Disabled

 

    CTS sgt-caching Egress  : Disabled

 

 

 

VIP Advisor

Re: Switch to Router MACSEC

CreatePlease to create content
Content for Community-Ad
FusionCharts will render here