Cisco Catalyst 4500 Series Software Configuration Manual page 1263

Chapter 48 Configuring MACsec Encryption
Command
Step 10
mka policy policy-name
Step 11
dot1x pae authenticator
Step 12
spanning-tree portfast
Step 13
end
Step 14
show authentication session
interface interface-id
Step 15
copy running-config startup-config
This is an example of configuring and verifying MACsec on an interface:
Switch(config)# interface GigabitEthernet1/0/25
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport mode access
Switch(config-if)# macsec
Switch(config-if)# authentication event linksec fail action authorize vlan 2
Switch(config-if)# authentication host-mode multi-domain
Switch(config-if)# authentication linksec policy must-secure
Switch(config-if)# authentication port-control auto
Switch(config-if)# mka policy replay-policy
Switch(config-if)# dot1x pae authenticator
Switch(config-if)# spanning-tree portfast
Switch(config-if)# end
Switch# show authentication sessions interface gigabitethernet1/0/25
Interface: GigabitEthernet1/0/25
MAC Address: 001b.2140.ec3c
IP Address: 1.1.1.103
User-Name: ms1
Status: Authz Success
Domain: DATA
Security Policy: Must Secure ß--- New
Security Status: Secured ß--- New
Oper host mode: multi-domain
Oper control dir: both
Authorized By: Authentication Server
Vlan Policy: 10
Session timeout: 3600s (server), Remaining: 3567s
Timeout action: Reauthenticate
Idle timeout: N/A
Common Session ID: 0A05783B0000001700448BA8
Acct Session ID: 0x00000019
Handle: 0x06000017
Runnable methods list:
Method State
dot1x Authc Success
Purpose
Applies an existing MKA protocol policy to the interface, and enable
MKA on the interface. If no MKA policy was configured (by entering the
mka policy global configuration command), you must apply the MKA
default policy to the interface by entering the mka default-policy
interface configuration command.
Configures the port as an 802.1X port access entity (PAE) authenticator.
Enables spanning tree Port Fast on the interface in all its associated
VLANs. When Port Fast feature is enabled, the interface changes directly
from a blocking state to a forwarding state without making the
intermediate spanning-tree state changes.
Returns to privileged EXEC mode.
Verifies the authorized session security status.
(Optional) Saves your entries in the configuration file.
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Configuring MACsec and MACsec Key Agreement
48-9