Thanks for the reply BB. Good to know that it should be possible. But I'm trying to work out the configurations to get this working as the commands seems to be different between the ASR and Catalyst platforms,
At the moment we have many Catalyst switch-to-switch connections that are configured for macsec using a static key-string. The configurations are fairly simple:
Cisco 3850
------------
interface TenGigabitEthernet1/0/5
cts manual
sap pmk 0000000000000000000000000000000000000000000000000000000123456789
Cisco 4510 Sup 8E
------------------
interface TenGigabitEthernet5/3
cts manual
sap pmk 0000000000000000000000000000000000000000000000000000000123456789
While the cts manual command is available on the ASR 1002-HXs, there is no subcommand to put in the pmk string. It looks like the macsec key is defined through a key chain instead and macsec is enabled with the macsec command. I've tried the following configuration but cts remains disabled on the ASR port.
ASR 1002-HX
--------------
key chain MACSEC-KEY-CHAIN macsec
key 01
key-string 0000000000000000000000000000000000000000000000000000000123456789
interface TenGigabitEthernet0/1/0
mka pre-shared-key key-chain MACSEC-KEY-CHAIN
macsec
Router#sh cts int tenGigabitEthernet 0/1/0
Interface TenGigabitEthernet0/1/0:
CTS is disabled.
L3 IPM: disabled.
CTS sgt-caching Ingress : Disabled
CTS sgt-caching Egress : Disabled
