MACsec and 2960-XR

[Edward Brennan]

I have been reviewing "Consolidated Platform Configuration Guide, Cisco IOS XE 15.2(3)E and Later (Catalyst 2960-XR Switch)" TrustSec guide and can't tell if it saying that 802.1EA tagging (macsec) is now supported on 2960-XR switches (but not 2960-x) or if it will some day be supported on the 2960-XR, but (never on the 2960-X)?  Is there a definitive answer on this?

[Mark Malone]

Going by these docs it looks to be supported on both platforms currently with the ios below which is less recent than the version you are looking at

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_010100.html

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960xr/software/15-0_2_EX1/security/configuration_guide/b_sec_152ex1_2960-xr/b_sec_152ex1_2960-xr_chapter_010011.html#concept_A3B8CC5B7C26443ABB10AC2DB64C044E

[Karsten Iwen]

The table you reference only includes general TrustSec-Features, not what the 2960-X is capable. MacSec is not mentioned in the Data-Sheets or the Q&A. Many docs state that hardware support for MacSec starts with the 3k switches. And I remember some information (think it was from a Cisco Live resource) that the 2k is not harware-capable for MacSec. But I really would be happy to see that disproved.

[Ming_Prince]

it is hardware capable, but software is not ready yet. 3650 and 3850 will support MACSEC. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/37e/consolidated_guide/b_37e_consolidated_3650_cg/b_37e_consolidated_3650_cg_chapter_01110101.html