Hi Reza,
I spoke too soon! Please see Q&A cut and paste from 3560x/3750x Q&A. It appears Trustsec/MACsec should work without service module on copper ports. Or am I reading this wrong?
http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps6406/qa_c67-578933_ps10744_Products_Q_and_A_Item.html
Q. What is MACsec?
A. MACsec is IEEE 802.1ae industry standard for L2 hop-by-hop encryption.
Q. Do I need a service module for encrypting user access ports connecting to PCs, IP phone, and so on?
A. No. Cisco Catalyst 3750x/3560x supports MACsec on downlink ports connecting to user access devices such as PCs and IP phones without requiring a service module.
Q. What MACsec use cases require a service module?
• Switch to switch encryption in campus: wiring closet access to distribution or core
• Encryption using fiber ports
• Encryption over 10G
Q. What can I expect in terms of MACsec performance? Is there any degradation in switch performance?
A. No. MACsec is supported at line rate (over 1G and 10G), and the encryption is done in hardware, making sure that there is no performance degradation.
Q. Can I connect a Cisco Catalyst 3750x/3560x service module to another Cisco Catalyst 3750x/3560x service module and encrypt Ethernet link between them?
A. Yes. MACsec can be enabled between Cisco Catalyst 3750x/3560x switches with service module. Service module ports have to be configured with Cisco Security Association Protocol (SAP) for management of MACsec keys.
Q. Are there any other Cisco network devices to which the service module can connect over a MACsec encrypted link?
A. Yes. Cisco switches including Cisco Catalyst 3750x/3560x, Cat 6k with Supervisor 2T and Cisco Nexus® 7k use the same key management protocol (SAP) and interoperate with each other. Service module ports have to be configured Cisco SAP for key management.
Q. Can I use MKA key management for encrypting switch-to-switch links?
A. No. MKA is only supported for end user access ports such as PC, phone, and other user access devices. Typically downlink ports connect to end user access ports and need to be configured with MKAny time a switch-to-switch link needs to be encrypted, both ends of the link have to be configured with Cisco SAP for key management.
Q. Could I connect two Cisco Catalyst 3750x/3560x copper ports and encrypt the link between them using MACsec?
A. This is not a common use case, due to distance limitations of copper. But this is a supported scenario and does not require the service module. Any time a switch-to-switch link needs to be encrypted, both ends of the link have to be configured with Cisco SAP for key management.
Q. If a 3560C compact switch is connected to a Cisco Catalyst 3750x/3560x on the downlink port, how do I set up MACsec between them?
A. Any time a switch-to-switch link needs to be encrypted, both ends of the link have to be configured with Cisco SAP for key management. Compact switch support for switch-to-switch encryption is planned for a future release. With this future release, link between Cisco Catalyst 3750x/3560x and 3k-C compact switch can be encrypted with Cisco SAP.
Q. Is there a requirement for a specific client for user access port encryption?
A. Yes. Cisco AnyConnect 3.0 client is required for MACsec encryption on a client.
Q. Could I use MACsec and NEAT (CISP) together on a port?
A. No. MACsec and NEAT are mutually exclusive. MACsec provides L2 hop-by-hop encryption, which makes NEAT redundant.
Q. Could I just use MACsec for switch-to-switch authentication (Cisco Network Device Admission Control [NDAC]) without encryption of traffic?
A. Yes.
Q. Does switch-to-switch encryption require Cisco NDAC?
A. Yes, encryption is performed after successful switch-to-switch authentication (NDAC).
Q. What infrastructure do you need for setting up switch-to-switch encryption with the service module?
A. In order to successfully set up switch to switch MACsec encryption, the following are needed:
a) Cisco Catalyst 3750x with the service module one end.
b) Cisco Catalyst 3750x with the service module OR Cisco Catalyst 6k Sup 2T OR Cisco Nexus 7k on the other end
c) ACS server ver 5.2 or higher for initial SAP key
Q. I don't have an ACS Server. Can I still enable encryption between the switches?
A. Yes. Using statically configured keys on both switches, encryption can be enabled without the ACS server.
