TrustSec and MACsec

What it is

TrustSec controls who can talk to whom by using group tags, and MACsec encrypts traffic on a link between two devices.

TrustSec moves policy away from IP addresses. Instead of writing rules for subnets, you put users and devices in groups and write rules between groups.

MACsec solves a different problem. It protects frames from being read or changed as they cross a cable, for example between two switches.

How it works

TrustSec has three steps, and MACsec works hop by hop on its own.

TrustSec components

• Security Group Tag (SGT): a 16 bit number that stands for a group, such as employees or printers.
• Cisco ISE: assigns tags after authentication, and holds the policy matrix.
• SGACL: a security group access control list. It is the rule set between a source group and a destination group.

Step 1: classification

Classification is how traffic gets its tag. There are two methods.

Switch(config)# cts role-based sgt-map 10.1.20.0/24 sgt 20

Static mapping is used for servers and for devices that cannot authenticate. This command is IOS XE syntax, and other platforms differ.

Step 2: propagation

The tag must travel from the place where the traffic enters to the place where the policy is enforced. There are two ways.

• Inline tagging: the SGT is carried in a field of the Ethernet frame, using the Cisco Meta Data header. Every device on the path must support it.
• SGT Exchange Protocol (SXP): a TCP based protocol that sends address to tag mappings between devices. It is used when a device on the path cannot carry the tag.

SXP has two roles. A speaker sends the mappings, and a listener receives them.

Switch(config)# cts sxp enable
Switch(config)# cts sxp default password SXPSECRET
Switch(config)# cts sxp connection peer 10.1.1.2 password default mode local speaker

Step 3: enforcement

A device that enforces policy looks at the source tag and the destination tag, and applies the SGACL for that pair. The policy is arranged as a matrix with source groups on one axis and destination groups on the other.

Switch(config)# cts role-based enforcement
Switch# show cts role-based permissions
Switch# show cts role-based sgt-map all

show cts role-based sgt-map all lists the address to tag mappings that the device knows. show cts role-based permissions shows the policies that it will apply. Firewalls can enforce group based policy too.

The main benefit is that policy follows the user. A new employee gets the employee tag from ISE, and the same rules apply wherever they connect, with no change to address based ACLs.

MACsec

MACsec is defined in IEEE 802.1AE. It encrypts Ethernet frames at Layer 2 and checks their integrity.

It works on a single link, from one device to the next, and so it is hop by hop. The data is decrypted and then re-encrypted at each MACsec device.

MKA is defined in IEEE 802.1X. It lets two devices agree on the keys.

The devices share a long term key, the connectivity association key, which can come from a pre shared key or from 802.1X authentication. From it they create the session keys that protect the frames.

MACsec adds a security tag and an integrity check value to each frame. It encrypts the payload and leaves the source and destination MAC addresses readable, so the switches can still forward. The link must allow for the extra bytes.

Switch(config)# key chain MACSEC-KC macsec
Switch(config-keychain-macsec)# key 01
Switch(config-keychain-macsec-key)# cryptographic-algorithm aes-128-cmac
Switch(config-keychain-macsec-key)# key-string 0123456789ABCDEF0123456789ABCDEF
Switch(config)# mka policy MKA-POL
Switch(config-mka-policy)# macsec-cipher-suite gcm-aes-128
Switch(config)# interface TenGigabitEthernet1/1/1
Switch(config-if)# macsec network-link
Switch(config-if)# mka policy MKA-POL
Switch(config-if)# mka pre-shared-key key-chain MACSEC-KC

This example is for a Catalyst 9000 switch running IOS XE. The macsec network-link command is for a link between network devices, and the exact commands depend on the platform and release.

Switch# show macsec summary
Switch# show mka sessions

show mka sessions shows whether the peers have secured the link.

TrustSec compared with MACsec

The two can be used together.