Configuring MACsec Encryption Prerequisites for MACsec Encryption, on page 1 Restrictions for MACsec Encryption, on page 2 Information About MACsec Encryption, on page 3 How to Configure MACsec Encryption, on page 12 Configuration Examples for MACsec Encryption, on page 36 Additional References for MACsec Encryption, on page 55 Feature History for MACsec Encryption, on page 56 Prerequisites for MACsec Encryption Prerequisites for MACsec Encryption This section list the prerequisites for MACsec encryption: • Enable the ssci-based-on-sci command while configuring MACsec encryption on the device to allow interoperability with non-Cisco and non-IOS XE devices.
• Ensure that 802.1x authentication and AAA are configured on your device. • You must configure the flowcontrol receive desired command on all MACsec-enabled ports to enable flowcontrol explicitly. Prerequisites for Certificate-Based MACsec This section list the prerequisites for Certificate-Based MACsec: • Ensure that you have a Certificate Authority (CA) server configured for your network. • Generate a CA certificate. • Ensure that you have configured Cisco Identity Services Engine (ISE) Release 2.0. • Ensure that both the participating devices, the CA server, and Cisco Identity Services Engine (ISE) are synchronized using Network Time Protocol (NTP).
If time is not synchronized on all your devices, certificates will not be validated. Configuring MACsec Encryption 1