Skip to content
Study CCNP

5.4.d TrustSec and MACsec

3 min read ENCOR 350-401 v1.2 Updated

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

What this objective tests

This is a describe objective. The exam wants you to separate two technologies that often appear together. TrustSec is group-based segmentation. MACsec is Layer 2 link encryption. If the question is about who may talk to whom based on identity, think TrustSec. If the question is about protecting frames on a link, think MACsec.

TrustSec terms

TermMeaning
Security Group Tag (SGT)A numeric tag assigned to a user, device, or traffic class
Security Group ACL (SGACL)Policy between a source group and a destination group
Cisco TrustSec (CTS)The feature family that carries and enforces tags
Enforcement pointThe switch, router, or firewall that applies the SGACL

TrustSec has three phases:

  1. Classification: the endpoint gets an SGT, usually from Cisco Identity Services Engine (ISE) after 802.1X or MAB.
  2. Propagation: the tag moves through the network, inline or through SGT Exchange Protocol (SXP).
  3. Enforcement: an enforcement point compares source SGT and destination SGT against the SGACL.

Note: The tag alone does not block traffic. Only an enforcement point with the tag context and a policy can block it.

Example: TrustSec policy on SW1

Scenario: employees get SGT 10. Contractors get SGT 20. Finance servers get SGT 30. Contractors may not reach finance servers.

cts role-based enforcement

cts role-based sgt-map 10.20.30.0/24 sgt 30

ip access-list role-based DENY-ALL
 deny ip

cts role-based permissions from 20 to 30 DENY-ALL

Expected verification output:

SW1# show cts role-based permissions
IPv4 Role-based permissions from group 20:Contractors to group 30:Finance-Servers:
        DENY-ALL
RBACL Monitor All for Dynamic Policies : FALSE
RBACL Source IP Address/Group          : 20
RBACL Destination IP Address/Group     : 30

This output proves the policy exists between the two groups. Counters on the enforcement point prove it is being used.

MACsec

MACsec protects Ethernet links. It gives confidentiality, integrity, and origin authenticity at Layer 2. Use it on links you do not fully trust: building-to-building cabling, provider Ethernet handoffs, or high-security uplinks.

MACsec is hop-by-hop. Each protected link encrypts and decrypts its own frames. It does not replace end-to-end protection such as TLS or IPsec. The MACsec Key Agreement (MKA) protocol manages keys between the two peers.

Scenario: SW1 and SW2 connect on GigabitEthernet1/0/48 through shared building cabling. Both sides use the same pre-shared key in a key chain.

key chain MACSEC-KEYS macsec
 key 01
  cryptographic-algorithm aes-128-cmac
  key-string 0 <shared-macsec-key>

mka policy MACSEC-POLICY
 key-server priority 0

interface GigabitEthernet1/0/48
 description Uplink to SW2 over shared cabling
 mka policy MACSEC-POLICY
 mka pre-shared-key key-chain MACSEC-KEYS
 macsec network-link

Configure the same key chain on SW2. Verify with show mka sessions and show macsec interface. Look for a secured session state on both ends.

Exam traps

  • TrustSec segments by identity. It does not encrypt.
  • MACsec encrypts a link. It does not assign identity or policy.
  • An SGT without an enforcement point changes nothing.
  • MACsec protects one hop. It is not end-to-end encryption.

Pass check

You are ready for this objective when you can do these things:

  • Explain the difference between TrustSec and MACsec in one sentence each.
  • Name the three TrustSec phases: classification, propagation, enforcement.
  • Read show cts role-based permissions and name the groups and the policy.
  • Explain what MKA does and why MACsec is hop-by-hop.

Related objectives