The supplicant sends a special EAPOL message to the authenticator that contains the RADIUS server IP address and UDP port and the complete RADIUS request. The authenticator extracts the RADIUS request from the received EAPOL message and sends it over UDP/IP to the authentication server. When the RADIUS response returns from the authentication server, the authenticator forwards the message back to the supplicant, encapsulated in an EAPOL frame. Link Security When both sides of a link support 802.1AE Media Access Control Security (MACsec), a security association protocol (SAP) negotiation is performed.
An EAPOL-Key exchange occurs between the supplicant and the authenticator to negotiate a cipher suite, exchange security parameters, and manage keys. Successful completion of all three tasks results in the establishment of a security association (SA). Depending on your software version, crypto licensing, and link hardware support, SAP negotiation can use one of the following modes of operation:
• Galois/Counter Mode (GCM)—Specifies authentication and encryption • GCM authentication (GMAC)—Specifies authentication and no encryption • No Encapsulation—Specifies no encapsulation (clear text) • Null—Specifies encapsulation, no authentication and no encryption All modes except No Encapsulation require Cisco TrustSec-capable hardware. Configuring SAP-PMK for Link Security Procedure Cisco TrustSec Overview Link Security Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode. • Enter your password if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 interface type number Example:
Device(config)# interface TenGigabitEthernet 1/1/4 Configures an interface and enters interface configuration mode. Step 4 switchport mode trunk Example: Device(config-if)# switchport mode trunk Specifies a trunking VLAN Layer 2 interface. Cisco TrustSec Overview 16