3560X with Service Module - MACSec over an Etherchannel?

[Steve11]

Hi all,

Is anyone aware of any restriction's to using MACSec on the uplinks of a service module whilst the uplink ports are in an etherchannel?

Essentially we will have 2x 3560x's connected by 2x fibre's. The plan is to encrypt over these fibre's but to etherchannel them for resilience/convergence purposes. Is this likely to work? Has anyone done this before?

Many thanks

SteveH

[Steve11]

Just to close this out, This is possible but you must use the Service Module and not the Network Module for the uplinks.

[hgans]

Hi thanks for your posting, have nearly the same situation here...

Where did you get the positive answer, could you find a documentation for MACsec together with Etherchannel?

I have on one side a 3560X with SM module and on the other side 68k with 69xx line card...

[Steve11]

Just based on the data sheet and the configuration guide.

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/15-0_1_se/configuration/guide/3750xcg/swmacsec.html

I haven't yet got my hands on the kit, still waiting for it to arrive but based on the configuration guide switch-to-switch is supported.

You must be running higher than LAN Base though.

"Note MACsec is not supported on switches running the NPE or the LAN base image."

I will be configuring this in the next week or so and will post back here with a working configuration (hopefully!)

SteveH

[mben00021]

Hi Steve

Did you make it work?  I am having issue with MacSec switch to Switch manual configuration ( two 4500 with the right IOS ) with port Channel please can you help ?

can I get the running config and advices what I have to more take care 

[Steve11]

Indeed we did, and it works rather well. 

See: http://www.petenetlive.com/KB/Article/0001000.htm for an example configuration.

I haven't tested this on a 4500 (which model? 4500X i presume?), however the commands should be very similar. If you can give a bit more detail on where your problem is and the configuration your trying to apply i could take a look.

[mben00021]

Hi Steven

I am very happy to read you, my problem start on the configuration of 4500X out of the box:

-initial configuration

-MACsec configuration on Port-channel ( 4500X refuse some command )

-Also can we simulate MACsec using VIRL?

Thanks

[Steve11]

Also see;

https://supportforums.cisco.com/discussion/11540361/how-configure-encryption-macsec-switch-switch-without-acs-server

[Steve11]

I can now confirm this works with manual mode; see my colleagues' blog post with a simple configuration example;

http://www.petenetlive.com/KB/Article/0001000.htm

Thanks
SteveH

[Steve11]

.