5.1 Device Access Control
Device access is the first security layer — if an attacker can reach the CLI, everything else is moot. The exam covers line protection, local users, and centralized AAA via TACACS+ and RADIUS.
Lines and Local Users
Cisco IOS exposes four line types:
| Line | Purpose | Access |
|---|---|---|
console 0 |
Physical console port (RJ-45 / USB) | Physical-only |
aux 0 |
Legacy modem dial-in | Physical — often disabled |
vty 0 4 (or 0 15) |
Telnet / SSH remote shell | Network (TCP 23 / 22) |
tty |
Async TTYs (terminal servers) | Physical — rare |
Minimum secure baseline — every device should have:
R1(config)# hostname R1 R1(config)# ip domain-name corp.local R1(config)# crypto key generate rsa modulus 2048 R1(config)# ip ssh version 2 R1(config)# ip ssh time-out 60 R1(config)# ip ssh authentication-retries 3 R1(config)# username admin privilege 15 algorithm-type scrypt secret StrongP@ss123 R1(config)# line console 0 R1(config-line)# login local R1(config-line)# exec-timeout 10 0 ! 10 min idle logout R1(config-line)# logging synchronous R1(config)# line vty 0 15 R1(config-line)# transport input ssh ! No Telnet! R1(config-line)# login local R1(config-line)# exec-timeout 5 0 R1(config-line)# access-class SSH-MGMT in ! Restrict source IPs R1(config)# service password-encryption ! Type 7 (weak — legacy only) R1(config)# enable algorithm-type scrypt secret EnableP@ss ! Type 9 scrypt (strong) R1(config)# no ip http server ! Disable HTTP (insecure) R1(config)# ip http secure-server ! Enable HTTPS only
Password Storage Types
Type 0 (cleartext), Type 5 (MD5 — deprecated), Type 7 (Vigenère — trivially reversible), Type 8 (PBKDF2-SHA256), Type 9 (scrypt — strongest, preferred). Use
Type 0 (cleartext), Type 5 (MD5 — deprecated), Type 7 (Vigenère — trivially reversible), Type 8 (PBKDF2-SHA256), Type 9 (scrypt — strongest, preferred). Use
algorithm-type scrypt or sha256 for new deployments; never rely on service password-encryption alone.AAA — Authentication, Authorization, Accounting
AAA centralizes identity enforcement. An AAA server (Cisco ISE, FreeRADIUS, TACACS.net) holds credentials, policy, and audit records. The three A’s:
- Authentication: proves identity (username/password, certificate, token)
- Authorization: determines allowed commands/resources (privilege levels, command sets)
- Accounting: logs what the authenticated user did (session start/stop, commands executed, bytes sent)
| Feature | TACACS+ | RADIUS |
|---|---|---|
| Transport | TCP 49 | UDP 1812 (auth), 1813 (acct) |
| Encryption | Entire payload encrypted | Only password field encrypted |
| AAA Separation | Separate (fine-grained command authorization) | Auth + Authz combined |
| Vendor | Cisco proprietary (RFC 1492 draft) | IETF standard (RFC 2865) |
| Primary Use | Device administration (router/switch CLI) | Network access (802.1X, VPN, Wi-Fi) |
| Multi-Protocol | Cisco-centric | Broadly supported (all NOS vendors) |
Exam Tip — TACACS+ vs RADIUS
Use TACACS+ for device admin (CLI command authorization per-user, encrypted sessions). Use RADIUS for user access (802.1X port auth, VPN, Wi-Fi). Cisco ISE supports both simultaneously. TACACS+ TCP 49 is a classic exam distractor — don’t confuse with RADIUS UDP 1812.
Use TACACS+ for device admin (CLI command authorization per-user, encrypted sessions). Use RADIUS for user access (802.1X port auth, VPN, Wi-Fi). Cisco ISE supports both simultaneously. TACACS+ TCP 49 is a classic exam distractor — don’t confuse with RADIUS UDP 1812.
AAA configuration skeleton (TACACS+ admin login, RADIUS for 802.1X):
R1(config)# aaa new-model ! Define server groups R1(config)# tacacs server ISE-PRI R1(config-server-tacacs)# address ipv4 10.1.1.50 R1(config-server-tacacs)# key 7 CiscoTAC123! R1(config)# aaa group server tacacs+ TAC-GRP R1(config-sg-tacacs+)# server name ISE-PRI R1(config)# radius server ISE-RAD R1(config-radius-server)# address ipv4 10.1.1.50 auth-port 1812 acct-port 1813 R1(config-radius-server)# key 7 CiscoRAD456! ! Method lists — "default" applies everywhere; named lists applied per-line R1(config)# aaa authentication login default group TAC-GRP local R1(config)# aaa authentication dot1x default group ISE-RAD R1(config)# aaa authorization exec default group TAC-GRP local if-authenticated R1(config)# aaa authorization commands 15 default group TAC-GRP local R1(config)# aaa accounting exec default start-stop group TAC-GRP R1(config)# aaa accounting commands 15 default start-stop group TAC-GRP R1# test aaa group TAC-GRP admin CiscoP@ss new-code ! Verify reachability
Critical: Always include a fallback method
The
The
local keyword at the end of the method list is a fail-open: if the AAA server is unreachable, the router authenticates against the local user database. Without it, a server outage locks you out completely. Also keep a console-session logged in while testing new AAA configs.5.2 Infrastructure Security — ACLs & CoPP
Access Control Lists (ACLs)
ACLs are the oldest and simplest packet filter. They are ordered permit/deny statements evaluated top-down with an implicit deny all at the end. First match wins — order statements from most-specific to most-general.
| ACL Type | Range | Matches On | Example |
|---|---|---|---|
| Standard numbered | 1–99, 1300–1999 | Source IP only | access-list 10 permit 10.1.1.0 0.0.0.255 |
| Extended numbered | 100–199, 2000–2699 | Src/dst IP, protocol, L4 ports, TCP flags | access-list 101 permit tcp any host 10.1.1.5 eq 443 |
| Named standard | any name | Source IP only | ip access-list standard BLOCK-GUESTS |
| Named extended | any name | Full L3/L4 | ip access-list extended WEB-TRAFFIC |
| Reflexive | named extended | Creates temporary entries for return traffic | Session-aware |
| Time-based | any | Hours/days active | Business-hours enforcement |
Wildcard masks are the inverse of subnet masks: 0 = must match, 1 = don’t care. 0.0.0.255 = last octet varies (a /24), 0.0.0.0 = exact host, host X is shorthand for X 0.0.0.0. Named ACLs support resequence and per-line insertion — strongly preferred over numbered.
Placement rules:
- Standard: close to the destination (source IP is all you have — placing near source could block legitimate flows to other destinations)
- Extended: close to the source (drop traffic before it consumes bandwidth)
- Apply with
ip access-group NAME {in|out}on an interface - Apply with
access-class NAME {in|out}on VTY lines
Exam Tip — Implicit Deny
Every ACL ends with an implicit
Every ACL ends with an implicit
deny ip any any (not visible in the config). Always explicitly permit ip any any at the end if the ACL is only meant to log or selectively drop, and add log keyword to see matched packets in syslog. show access-lists includes hit counters per line.Control Plane Policing (CoPP)
A router has three traffic “planes”:
- Data plane — transit packets forwarded by CEF hardware (never hit CPU)
- Control plane — packets destined to the router itself (OSPF hellos, SSH, BGP, SNMP, ARP, ICMP to RP address)
- Management plane — admin sessions (SSH, HTTPS, NETCONF)
Without protection, a DoS flood of ICMP, ARP, or TCP-SYN to the router’s IP can saturate the CPU and crash routing. CoPP uses an MQC (Modular QoS CLI) policy applied to the control-plane interface to rate-limit different classes of punted traffic.
Typical CoPP class model (from Cisco’s recommended template):
| Class | Matches | Typical Rate |
|---|---|---|
| CRITICAL | Routing (BGP/OSPF/EIGRP), HSRP, BFD | No drop / high cap |
| IMPORTANT | SSH, SNMP, NTP, syslog, TACACS+/RADIUS | Moderate cap |
| NORMAL | ICMP echo, traceroute | Low rate |
| UNDESIRABLE | Fragments, known DoS signatures | Drop |
| class-default | Everything else | Limit or drop |
Exam Tip — CoPP Direction
CoPP is applied inbound to the control-plane interface —
CoPP is applied inbound to the control-plane interface —
control-plane → service-policy input. It protects only packets punted to the CPU, never data-plane transit traffic. Use show policy-map control-plane input to see matched/dropped counters.5.3 Secure REST API Access
Modern network management uses REST APIs on Catalyst Center, Meraki Dashboard, Cisco SD-WAN (vManage), ISE, and IOS-XE RESTCONF. Securing these APIs matters as much as securing SSH.
| Principle | Implementation |
|---|---|
| Transport encryption | Always HTTPS (TLS 1.2+). Never plain HTTP for APIs. Use valid CA-signed certs — reject self-signed in production |
| Authentication | Token-based (OAuth 2.0 Bearer, JWT) preferred over Basic Auth. Short token lifetimes (minutes/hours), refresh tokens separately |
| Authorization | RBAC — API keys/roles scoped to least privilege (read-only vs read-write vs admin) |
| Rate limiting | Server-side throttles prevent brute force and resource exhaustion (e.g., Meraki 5 req/sec, Catalyst Center has per-endpoint caps) |
| Input validation | Server rejects malformed payloads; client never sends user-provided strings unescaped |
| Credential handling | Never hardcode in source. Use environment vars, HashiCorp Vault, AWS Secrets Manager. Never log credentials |
| Audit logging | All API calls logged with user, endpoint, timestamp, source IP — send to SIEM |
Example — Catalyst Center X-Auth-Token flow:
# Step 1: Authenticate with Basic Auth to get a 1-hour token $ curl -sk -X POST \ -H "Content-Type: application/json" \ -u "apiuser:ApiP@ss123" \ https://catc.corp.local/dna/system/api/v1/auth/token {"Token":"eyJ0eXAiOiJKV1QiLCJhbGci..."} # Step 2: Use that token for subsequent calls — NEVER send credentials again $ curl -sk \ -H "X-Auth-Token: eyJ0eXAiOiJKV1Qi..." \ -H "Accept: application/json" \ https://catc.corp.local/dna/intent/api/v1/network-device
Exam Tip — HTTPS vs HTTP
Enabling IOS-XE RESTCONF requires
Enabling IOS-XE RESTCONF requires
ip http secure-server (HTTPS/TLS). The plain ip http server is disabled by default and should never be enabled. API tokens must be transmitted only over TLS — in HTTP query strings they leak into web-server logs and browser history.5.4 Network Security Design Components
Firewalls, NGFW, IPS
| Product | Inspection Level | Example |
|---|---|---|
| Packet filter | L3/L4 header only (like ACL) | Router ACL, stateless firewall |
| Stateful firewall | Tracks TCP/UDP session state; allows return traffic automatically | Cisco IOS ZBF, ASA |
| Next-Gen Firewall (NGFW) | L7 application identification, user identity, URL filtering, file type control | Cisco Secure Firewall (Firepower Threat Defense) |
| IPS (inline) | Detects AND blocks attacks using signatures, anomaly, reputation | Snort on FTD, Cisco Secure IPS |
| IDS (passive) | Detects only — receives SPAN copy, sends alerts | Legacy — largely replaced by IPS |
IOS Zone-Based Firewall (ZBF)
ZBF replaces the older CBAC (Context-Based Access Control) ip inspect model. Interfaces are assigned to zones; traffic between zones is controlled by zone-pair policies that reference class-maps and policy-maps.
R1(config)# zone security INSIDE R1(config)# zone security OUTSIDE R1(config)# zone security DMZ R1(config)# interface GigabitEthernet0/0 R1(config-if)# zone-member security INSIDE R1(config)# interface GigabitEthernet0/1 R1(config-if)# zone-member security OUTSIDE ! Classify what can go inside→outside R1(config)# class-map type inspect match-any WEB-AND-DNS R1(config-cmap)# match protocol http R1(config-cmap)# match protocol https R1(config-cmap)# match protocol dns R1(config)# policy-map type inspect INSIDE-TO-OUTSIDE R1(config-pmap)# class type inspect WEB-AND-DNS R1(config-pmap-c)# inspect ! Stateful — allow return traffic R1(config-pmap)# class class-default R1(config-pmap-c)# drop log R1(config)# zone-pair security IN-OUT source INSIDE destination OUTSIDE R1(config-sec-zone-pair)# service-policy type inspect INSIDE-TO-OUTSIDE
ZBF Default Behavior
Traffic between two zones with no zone-pair is DROPPED by default. Traffic within the same zone (two interfaces in INSIDE) is permitted. The self zone is the router itself — use it to control traffic terminating on/originating from the router (replaces CoPP use cases at the interface level).
Traffic between two zones with no zone-pair is DROPPED by default. Traffic within the same zone (two interfaces in INSIDE) is permitted. The self zone is the router itself — use it to control traffic terminating on/originating from the router (replaces CoPP use cases at the interface level).
Cisco TrustSec (SGT) and MACsec
Cisco TrustSec decouples access policy from IP address by classifying traffic with a Security Group Tag (SGT) — a 16-bit label assigned at the network edge (usually by ISE after 802.1X auth). SGTs ride with the frame to the enforcement point, where SGACLs (matrix-based access lists) control who can talk to whom by group, not subnet.
| TrustSec Phase | What Happens | Where |
|---|---|---|
| Classification | User/device auth via 802.1X, MAB, or WebAuth; ISE assigns SGT based on identity + context | Access switch, WLC, VPN concentrator |
| Propagation | SGT carried with traffic via inline tagging (Cisco Meta-data in L2 frame) or SXP (SGT Exchange Protocol — TCP 64999 to share IP→SGT bindings) | Fabric / transport |
| Enforcement | SGACLs applied at egress — matrix lookup “from-SGT × to-SGT → permit/deny/specific ports” | DC switch, firewall, ASR |
MACsec (IEEE 802.1AE) provides hop-by-hop Layer 2 encryption on Ethernet links. Every frame between two MACsec peers is encrypted with AES-GCM 128 or 256. Used for switch-to-switch trunk encryption, campus uplinks, and data-center fabric interconnect. Key agreement uses MKA (MACsec Key Agreement, 802.1X) or SAP (Cisco TrustSec proprietary).
Exam Tip — SGT vs VLAN
A VLAN says “what subnet/broadcast domain” — tied to topology and hard to change. An SGT says “what role” — tied to identity and mobile across the network. TrustSec scales because one matrix replaces per-subnet ACLs; adding a new building doesn’t require new rules if users keep the same role.
A VLAN says “what subnet/broadcast domain” — tied to topology and hard to change. An SGT says “what role” — tied to identity and mobile across the network. TrustSec scales because one matrix replaces per-subnet ACLs; adding a new building doesn’t require new rules if users keep the same role.
Endpoint Security, Cisco Umbrella, SecureX
Defense in depth requires more than network controls. Key cloud-delivered layers:
- Cisco Secure Endpoint (formerly AMP for Endpoints) — host-based EDR: continuous file trajectory, retrospective detection, integration with threat grid sandboxing
- Cisco Umbrella — DNS-layer + Secure Web Gateway + CASB. Blocks connections to malicious domains at resolution time, before an IP is even contacted. Fast way to stop phishing, C2, crypto-mining
- Cisco Secure Email — inbound SPAM/phishing filtering, outbound DLP, BEC protection
- Cisco Duo — MFA (multi-factor authentication) for VPN, admin SSH, web apps. Push, OTP, FIDO2 WebAuthn
- Cisco SecureX / XDR — correlation platform: pulls telemetry from ISE, Umbrella, Secure Endpoint, Secure Firewall, Stealthwatch into one investigation view
- MFA everywhere — Duo on VPN and SSH via RADIUS Challenge-Response or SAML SSO on admin portals
Exam Tip — DNS as Security Control
Umbrella blocks the DNS query itself. If a host is compromised and tries to resolve
Umbrella blocks the DNS query itself. If a host is compromised and tries to resolve
evil-c2.example.com, Umbrella returns NXDOMAIN or a block page — the TCP connection never opens. This also means Umbrella logs show the very earliest signal of infection: the DNS lookup, hours before traffic analysis or AV kicks in.Hands-On Labs
Lab 1 — Secure SSH Device Access (Local)
Baseline: hostname, domain, RSA keys, disable weak services.
R1(config)# hostname CORE-R1 R1(config)# ip domain-name corp.local R1(config)# crypto key generate rsa modulus 2048 R1(config)# ip ssh version 2 R1(config)# ip ssh time-out 60 R1(config)# ip ssh authentication-retries 3 R1(config)# no ip http server R1(config)# ip http secure-server
Create a privilege-15 user with scrypt hash, and lock down VTY to SSH-only from the management subnet.
R1(config)# username admin privilege 15 algorithm-type scrypt secret StrongP@ss123 R1(config)# enable algorithm-type scrypt secret EnableP@ss R1(config)# ip access-list standard SSH-MGMT R1(config-std-nacl)# permit 10.99.0.0 0.0.0.255 R1(config-std-nacl)# deny any log R1(config)# line vty 0 15 R1(config-line)# transport input ssh R1(config-line)# login local R1(config-line)# exec-timeout 5 0 R1(config-line)# access-class SSH-MGMT in R1(config-line)# logging synchronous
Verify.
R1# show ip ssh R1# show ssh ! Active sessions R1# show users
Lab 2 — AAA with TACACS+ (Admin) and RADIUS (802.1X)
Enable AAA and register both servers.
SW1(config)# aaa new-model SW1(config)# tacacs server ISE-TAC SW1(config-server-tacacs)# address ipv4 10.1.1.50 SW1(config-server-tacacs)# key CiscoTAC123! SW1(config-server-tacacs)# single-connection SW1(config)# aaa group server tacacs+ TAC-GRP SW1(config-sg-tacacs+)# server name ISE-TAC SW1(config)# radius server ISE-RAD SW1(config-radius-server)# address ipv4 10.1.1.50 auth-port 1812 acct-port 1813 SW1(config-radius-server)# key CiscoRAD456!
Apply AAA method lists — TACACS+ for admin login (with local fallback), RADIUS for 802.1X.
SW1(config)# aaa authentication login default group TAC-GRP local SW1(config)# aaa authorization exec default group TAC-GRP local if-authenticated SW1(config)# aaa authorization commands 15 default group TAC-GRP local SW1(config)# aaa accounting exec default start-stop group TAC-GRP SW1(config)# aaa accounting commands 15 default start-stop group TAC-GRP ! Keep this local user as emergency break-glass account SW1(config)# username breakglass privilege 15 algorithm-type scrypt secret BgP@ss789! SW1(config)# aaa authentication dot1x default group radius SW1(config)# dot1x system-auth-control
Configure an access port for 802.1X with RADIUS-assigned VLAN.
SW1(config)# interface GigabitEthernet0/10 SW1(config-if)# switchport mode access SW1(config-if)# authentication port-control auto SW1(config-if)# authentication host-mode multi-auth SW1(config-if)# dot1x pae authenticator SW1(config-if)# mab ! MAC auth bypass for non-dot1x devices SW1# test aaa group TAC-GRP admin CiscoP@ss new-code SW1# show authentication sessions interface Gi0/10 details
Lab 3 — Control Plane Policing (CoPP)
Define ACLs to classify control-plane traffic.
R1(config)# ip access-list extended COPP-CRITICAL R1(config-ext-nacl)# permit ospf any any R1(config-ext-nacl)# permit tcp any any eq bgp R1(config-ext-nacl)# permit tcp any eq bgp any R1(config)# ip access-list extended COPP-MGMT R1(config-ext-nacl)# permit tcp 10.99.0.0 0.0.0.255 any eq 22 R1(config-ext-nacl)# permit udp any any eq snmp R1(config-ext-nacl)# permit udp any any eq ntp R1(config)# ip access-list extended COPP-ICMP R1(config-ext-nacl)# permit icmp any any echo R1(config-ext-nacl)# permit icmp any any echo-reply R1(config-ext-nacl)# permit icmp any any ttl-exceeded R1(config-ext-nacl)# permit icmp any any unreachable
Bind ACLs to class-maps, build policy-map with rate limits, apply to control-plane.
R1(config)# class-map match-any CRITICAL R1(config-cmap)# match access-group name COPP-CRITICAL R1(config)# class-map match-any MGMT R1(config-cmap)# match access-group name COPP-MGMT R1(config)# class-map match-any ICMP R1(config-cmap)# match access-group name COPP-ICMP R1(config)# policy-map COPP-POLICY R1(config-pmap)# class CRITICAL R1(config-pmap-c)# police 4000000 conform-action transmit exceed-action transmit R1(config-pmap)# class MGMT R1(config-pmap-c)# police 2000000 conform-action transmit exceed-action drop R1(config-pmap)# class ICMP R1(config-pmap-c)# police 500000 conform-action transmit exceed-action drop R1(config-pmap)# class class-default R1(config-pmap-c)# police 1000000 conform-action transmit exceed-action drop R1(config)# control-plane R1(config-cp)# service-policy input COPP-POLICY R1# show policy-map control-plane input ! Hit + drop counters per class
Lab 4 — IOS Zone-Based Firewall
Define zones and bind interfaces.
R1(config)# zone security INSIDE R1(config)# zone security OUTSIDE R1(config)# zone security DMZ R1(config)# interface GigabitEthernet0/0 R1(config-if)# description LAN R1(config-if)# zone-member security INSIDE R1(config)# interface GigabitEthernet0/1 R1(config-if)# description Internet R1(config-if)# zone-member security OUTSIDE R1(config)# interface GigabitEthernet0/2 R1(config-if)# description DMZ R1(config-if)# zone-member security DMZ
Build inspection policy and zone-pair for INSIDE → OUTSIDE.
R1(config)# class-map type inspect match-any USER-TRAFFIC R1(config-cmap)# match protocol http R1(config-cmap)# match protocol https R1(config-cmap)# match protocol dns R1(config-cmap)# match protocol icmp R1(config)# policy-map type inspect INSIDE-TO-OUTSIDE R1(config-pmap)# class type inspect USER-TRAFFIC R1(config-pmap-c)# inspect R1(config-pmap)# class class-default R1(config-pmap-c)# drop log R1(config)# zone-pair security IN-TO-OUT source INSIDE destination OUTSIDE R1(config-sec-zone-pair)# service-policy type inspect INSIDE-TO-OUTSIDE R1# show zone-pair security R1# show policy-map type inspect zone-pair IN-TO-OUT
Lab 5 — Cisco TrustSec SGT and MACsec
Enable CTS, set AAA server for policy download, and establish PAC (Protected Access Credential) trust with ISE.
SW1(config)# aaa new-model SW1(config)# aaa authentication dot1x default group radius SW1(config)# aaa authorization network default group radius SW1(config)# aaa accounting dot1x default start-stop group radius SW1(config)# cts authorization list default SW1(config)# radius-server host 10.1.1.50 pac key CiscoRAD456! SW1(config)# cts credentials id SW1 password CtsP@ss789 SW1# show cts pacs ! Verify PAC provisioned SW1# show cts environment-data ! SGT→name mappings
Enable SGT inline tagging on the uplink and configure SXP for legacy downstream.
SW1(config)# interface GigabitEthernet1/0/48 SW1(config-if)# cts manual SW1(config-if-cts-manual)# policy static sgt 2 trusted SW1(config-if-cts-manual)# propagate sgt ! SXP peer — propagate IP-SGT bindings to upstream device that does not support inline SW1(config)# cts sxp enable SW1(config)# cts sxp default password CtsSxpP@ss SW1(config)# cts sxp connection peer 10.1.2.1 password default mode local speaker SW1# show cts sxp connections SW1# show cts role-based sgt-map all
Apply an SGACL at enforcement point (e.g., deny Guest-SGT 30 from reaching Finance-SGT 100 except on TCP 443).
SW2(config)# cts role-based enforcement SW2(config)# cts role-based enforcement vlan-list 10 SW2(config)# ip access-list role-based GUEST-TO-FINANCE SW2(config-rb-acl)# permit tcp dst eq 443 SW2(config-rb-acl)# deny ip SW2(config)# cts role-based permissions from 30 to 100 GUEST-TO-FINANCE SW2# show cts role-based permissions SW2# show cts role-based counters
Enable MACsec (802.1AE) on the inter-switch trunk using MKA.
SW1(config)# key chain MACSEC-KC macsec SW1(config-keychain-macsec)# key 01 SW1(config-keychain-macsec-key)# cryptographic-algorithm aes-256-cmac SW1(config-keychain-macsec-key)# key-string ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789 SW1(config-keychain-macsec-key)# lifetime local 00:00:00 Jan 1 2026 infinite SW1(config)# mka policy STRONG-MKA SW1(config-mka-policy)# key-server priority 100 SW1(config-mka-policy)# macsec-cipher-suite gcm-aes-256 SW1(config)# interface TenGigabitEthernet1/1/1 SW1(config-if)# macsec network-link SW1(config-if)# mka policy STRONG-MKA SW1(config-if)# mka pre-shared-key key-chain MACSEC-KC SW1# show macsec interface TenGigabitEthernet1/1/1 SW1# show mka sessions detail
Check Your Understanding
Twenty questions on this section. Each answer is explained as you go.
