TrustSec Security

[Aaron O'Hare]

I am attempting to configure manual (without ACS) TrustSec between a 3560cx and 3850 over a fiber trunk port however none of the normal cts commands appears to be recognized on either platform, nor do mka commands appear to be recognized. Its been a while since I've worked with TrustSec and mostly on chassis systems so I must be missing something but not sure what. Any suggestions or any config guides you can point me to?

[vincent.bijleveld · Accepted solution]

Hi Aaron,

Trying to accomplish the same here, our 3850's came with version 03.02 but it is from 03.03 and up where it is possible to enter cts commands. Further more you need a service module in your switches (for with to switch encryption) and have IPBASE image installed. I have a network module delivered so not sure if that will do me good. It also seems that you need SFP+ transceivers for this.

I'm now struggling with assigning a encryption mode-list on a sap pmk key. Only option is no-encap which could mean that the interface is not capable of doing encryption.

TrustSec Config Guide:

http://www.cisco.com/c/en/us/td/docs/switches/lan/trustsec/configuration/guide/trustsec.pdf

Nice presentation on TrustSec:

http://ftp.cisco.cz/Seminare/2013-ConnectClub/2013-10-24-CC-TrustSec-JiriTesar.pdf

Hope this helps you further.

[vincent.bijleveld]

Found out that from version 03.07 you are able to get all options in the mode-list. So if you want point-to-point encryption on your links, upgrade to version 03.07.