Cisco TrustSec Overview Configuring SAP-PMK for Link Security Command or Action Purpose Step 5 cts manual Example: Device(config-if)# cts manual Enters Cisco TrustSec manual configuration mode. Step 6 no propagate sgt Example: Device(config-if-cts-manual)# no propagate sgt Use the no form of this command when the peer is incapable of processing a SGT. The no propagate sgt command prevents the interface from transmitting the SGT to the peer. Step 7 sap pmk key [mode-list mode1 [mode2 [mode3 [mode4]]]] Example:
Device(config-if-cts-manual)# sap pmk 0000000000000000000000000000000000000000000000000000001234567890 mode-list gcm-encrypt gmac Configures the SAP pairwise master key (PMK) and operation mode. SAP is disabled by default in Cisco TrustSec manual mode. • key: A hexadecimal value with an even number of characters and a maximum length of 32 characters. The SAP operation mode options are described below: • gcm-encrypt: Authentication and encryption Note Select this mode for MACsec authentication and encryption if your software license supports MACsec encryption. • gmac: Authentication, no encryption • no-encap: No encapsulation • null:
Encapsulation, no authentication or encryption Note If the interface is not capable of data link encryption, the no-encap command is the default and the only available SAP operating mode. SGT is not supported. Step 8 end Example: Device(config-if-cts-manual)# end Exits Cisco TrustSec manual configuration mode and returns to privileged EXEC mode.. Cisco TrustSec Overview 17