System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

MACsec EAP-TLS authentication sessions

Updated: September 18, 2026

Want to summarize with AI?

Log in

Introduces MACsec EAP-TLS authentication session concepts, covering authentication limits, device roles, prerequisites, local authentication models with legacy TLS 1.3 KDF, encryption processes, and comprehensive configuration tasks for secure MACsec deployment.

A MACsec EAP-TLS authentication session is a certificate-based exchange that

  • uses Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) for peer authentication

  • enables mutual authentication between authentication server and client, and

  • derives the Master Session Key (MSK) that is used for MKA key material.

Additional reference information

  • EAP-TLS utilizes certificates for mutual authentication between routers.

  • After successful authentication, EAP-TLS generates the MSK, which is used to derive the Connectivity Association Key (CAK).

  • The Connectivity Association Key Name (CKN) is derived from the EAP session ID.

Requirement: Follow EAP-TLS authentication limits

To remain within Cisco IOS XR supported behavior for MACsec EAP-TLS authentication, always follow these requirements:

  • Use 802.1X only on physical Ethernet interfaces.

  • Use only EAP-TLS as the authentication method, as supported by Cisco IOS XR for this use case.

  • Use 802.1X port-based authentication only to derive keys for MACsec Key Agreement (MKA); do not use it for port control.

  • Use supported PAE roles only: authenticator and supplicant.

  • If Cisco IOS XR acts as the authenticator, use RADIUS as the EAP transport for remote EAP authentication.

  • Use only single-host mode; multi-host mode is not supported.

IEEE 802.1X device roles

Devices in the network have these specific IEEE 802.1X authentication roles.

Table 1. IEEE 802.1X roles

Role

Description

Supplicant

An entity at one end of a point-to-point LAN segment that seeks authentication by an authenticator attached to the other end of that link.

Authenticator

An entity that facilitates authentication of other entities attached to the same LAN.

Authentication server

An entity that provides an authentication service to an authenticator and determines whether the supplicant is authorized to access services.

Each role identifies how a device participates in authentication on a point-to-point LAN segment.

Use these role definitions to map routers, clients, and AAA infrastructure to the MACsec EAP-TLS authentication workflow.

Requirement: Meet MACsec MKA EAP-TLS prerequisites

You must ensure all critical prerequisites are met before configuring MACsec MKA with EAP-TLS authentication.

  • Configure a Certificate Authority (CA) server for the network.

  • Ensure that the configured CA certificate is valid.

  • Configure Cisco Identity Services Engine (ISE) Release 2.2 or later as the external AAA server.

  • Alternatively, configure Cisco Secure Access Control Server Release 5.6 or later as the external AAA server.

  • Configure the remote AAA server with the EAP-TLS method.

  • Synchronize both routers, the CA server, and the external AAA server with Network Time Protocol (NTP). If time is not synchronized, certificates may not be validated.

Use this requirement before you configure RADIUS, certificates, EAP profiles, 802.1X profiles, or MACsec EAP on an interface.

MACsec local EAP-TLS authentication models

A MACsec local EAP-TLS authentication model is a type of local EAP authentication configuration that

  • co-locates the EAP server with the authenticator on the router

  • enables authentication of dot1x (802.1X) clients using the EAP-TLS method, and

  • provides mutual authentication and generates an MSK after authentication succeeds.

Interoperability requirement

For local EAP authentication with earlier XR releases, see Requirement: Enable legacy TLS 1.3 KDF for local EAP.

Requirement: Enable legacy TLS 1.3 KDF for local EAP

Configure the enable-tls1.3-legacy-kdf command when you use EAP-based MACsec with local EAP authentication.

  • This command is required for interoperability with XR releases earlier than Release 25.4.1.

  • Use the command when the EAP server is co-located with the authenticator on the router.

How MACsec EAP-TLS encryption works

Configuring MACsec encryption with EAP-TLS authentication requires preparing AAA, certificate, EAP, 802.1X, and interface settings before verification. This process ensures the device can securely authenticate, enroll for certificates, and apply the necessary policies to a physical interface.

Summary

The key components in this process are:

  • RADIUS server: Provides remote EAP authentication transport for the authenticator role.

  • 802.1X authentication method: Selects the default AAA method for dot1x authentication.

  • RSA key pair and trustpoint: Provide the certificate enrollment foundation.

  • EAP and 802.1X profiles: Bind EAP-TLS authentication behavior to the device role.

  • MACsec EAP interface policy: Enables MACsec EAP behavior on the selected interface.

MACsec EAP-TLS encryption uses a multi-step configuration process that prepares authentication, certificate, EAP, and interface settings to establish secure Layer 2 encryption based on EAP-TLS.

Workflow

These stages describe how MACsec EAP-TLS encryption works.

  1. Configure the RADIUS server pre-shared key and Vendor-Specific Attribute (VSA) behavior.

  2. Configure the default 802.1X authentication method to use the RADIUS group.

  3. Generate the RSA key pair required for certificate enrollment.

  4. Configure the trustpoint, domain name, and certificate enrollment actions.

  5. Configure the EAP profile and 802.1X profile on the device.

  6. Attach the 802.1X profile and MACsec EAP policy to the interface.

  7. Verify 802.1X authorization and MACsec MKA session state on the interface.

Result

The process is complete when 802.1X shows an authorized port state and MACsec MKA session output shows a secured session.

Configure a RADIUS server for MACsec EAP-TLS authentication

Set up the RADIUS server so MACsec EAP-TLS authentication can use the remote RADIUS server as the EAP transport.

Obtain pre-shared key values for the remote RADIUS server before configuring. You may specify either IPv4 or IPv6 addresses for the RADIUS server host.

Before you begin

Meet the MACsec MKA EAP-TLS prerequisites.

Procedure

  1. Configure the RADIUS server pre-shared key and VSA behavior.

    Example:

    Router# configure terminal
Router(config)# radius-server host 209.165.200.225 key 7 094F471A1A0A57
Router(config)# radius-server vsa attribute ignore unknown
Router(config)# commit

    The example uses a remote RADIUS server host and pre-shared key value.

  2. Review the RADIUS server running configuration.

    Example:

    Router# show run radius-server
radius-server host 209.165.200.225 auth-port 1646
  key 7 094F471A1A0A57
  radius-server vsa attribute ignore unknown
!

    The running configuration shows the expected commands.

The RADIUS server is ready for MACsec EAP-TLS authentication when the running configuration shows the correct host address, key, and VSA attribute configuration.

Configure the 802.1X authentication method

Configure 802.1X authentication on Cisco IOS XR using the default AAA method with RADIUS as the protocol.

Cisco IOS XR supports only the default AAA method for 802.1X authentication. This ensures MACsec EAP-TLS authentication uses RADIUS for secure and standardized access control.

Before you begin

Configure the RADIUS server before you configure the 802.1X authentication method.

Procedure

  1. Configure 802.1X authentication to use the default RADIUS method.

    Example:

    Router# configure terminal
Router(config)# aaa authentication dot1x default group radius
Router(config)# commit

    Only the default AAA method is supported for 802.1X authentication.

  2. Review the 802.1X AAA running configuration.

    Example:

    Router# show run aaa
configure
  aaa authentication dot1x default group radius

    The running configuration shows the expected commands.

The authentication method is configured when the running configuration shows the default dot1x method with the RADIUS group.

Configure an RSA key pair for MACsec EAP-TLS

Generate the RSA key pair required before the node obtains its certificate for MACsec EAP-TLS.

RSA key pairs are used to sign and encrypt key management messages for MACsec EAP-TLS authentication. You must enter the key modulus size when prompted during key generation.

Before you begin

Ensure you meet the Certificate Authority (CA) and Network Time Protocol (NTP) requirements before certificate enrollment.

Procedure

  1. Generate the RSA key pair and enter the modulus size when prompted.

    Example:

    Router# crypto key generate rsa 8002
Wed Aug  7 10:25:22.461 UTC
The name for the keys will be: 8002
Choose the size of the key modulus in the range of 512 to 4096 for your General Purpose Keypair.
Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus [2048]: 600
Generating RSA keys ...
Done w/ crypto generate keypair
[OK]

    The command prompts for a key modulus size in the range of 512 to 4096.

  2. Display the generated RSA public key.

    Example:

    Router# show crypto key mypubkey rsa

Key label: 8002
Type     : RSA General purpose
Size     : 600
Created  : 12:56:29 UTC Wed Aug 07 2019
Data     :
 3067300D 06092A86 4886F70D 01010105 00035600 3053024C 0096DB0F EE3B3233
 6E5FDA53 0FC504D1 9A056E29 BB703118 C6A8A254 1DC6504B 29CD4DA0 984735C8
 46CD39A1 C379B059 92870F76 693D4A66 D9953F69 450238D4 C57803AF 41160D4F
 C9451945 02030100 01

    The show command output identifies the key label, key type, size, creation time, and public key data.

  3. Review RSA keys that are visible in the running configuration.

    Example:

    Router(config)#crypto key generate rsa test
Router(config)#commit
Thu May 12 08:37:59.894 UTC
Router(config)#end
Router#show running-config
Thu May 12 08:38:04.244 UTC
Building configuration...
!! IOS XR Configuration 7.3.4
!! Last configuration change at Thu May 12 08:37:59 2022 by cisco
!
username cisco
 group root-lr
 group cisco-support
 secret 10 $6$8zR0nTbkA7A1n...$0Kn.YxNNmh1cXo9cEvEwLGAFf.rEOTycjsizI/TLBz9WoQX.rmxVwkNgTKAnROUGPtBVlQ/Ndew8gEREXJ7mI0
!
call-home
 service active
 contact smart-licensing
 profile CiscoTAC-1
  active
  destination transport-method http
 !
!
interface MgmtEth0/RSP0/CPU0/0
 shutdown
!
crypto key generate rsa test general-keys 2048 | -----BEGIN PUBLIC KEY-----
MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAgiXFnld/AADcil6eV38A
AIIlxZ5XfwAAcJb6e1d/AAAA7du+AAAAAI6Qs47BQLhIVQAAAAAAAAAAWQDQVn8A
ANyKXp5XfwAAKAAAAAAAAACaNcWeV38AANyKXp5XfwAAmjXFnld/AADcil6eV38A
AJo1xZ5XfwAAAO3bvgAAAABVAAAAAAAAABBEANBWfwAA3Ipenld/AAAgAAAAAAAA
AI8lxZ5XfwAA3Ipenld/AACPJcWeV38AAHhZANBWfwAAAO3bvgAAAADUTNDpQMWp
UUUAAAAAAAAAkBcA0FZ/AADcil6eV38AABgAAAAAAAAAiSXFnld/AADcil6eV38A
AAIBAA==
-----END PUBLIC KEY-----
 |
end

    Only keys generated in config mode are visible in the running configuration.

    The example shows RSA keys in OpenSSL format.

The RSA key pair is available when the show command output displays the generated key label and public key data.

MACsec EAP-TLS trustpoints

A MACsec EAP-TLS trustpoint is a certificate authority (CA) and certificate management object that

  • includes the identity of the CA

  • includes CA-specific configuration parameters, and

  • maintains an association with one enrolled identity certificate.

Additional reference information

After you define a trustpoint, you can reference it by name in commands that require a CA for MACsec EAP-TLS enrollment.

Configure a trustpoint for MACsec EAP-TLS

Set up a trustpoint for certificate enrollment, enabling the router to reference certificate authority (CA) identity and specific enrollment parameters.

Trustpoints manage CA identity, CA-specific parameters, and enrolled identity certificates. For more details, see the MACsec EAP-TLS trustpoints section.

Before you begin

Generate the RSA key pair before binding the trustpoint to that key pair.

Procedure

  1. Configure the trustpoint, enrollment URL, subject name, RSA key pair, and CRL behavior.

    Example:

    Router# configure terminal
Router(config)# crypto ca trustpoint test2
Router(config-trustp)# enrollment url http://caurl.com
Router(config-trustp)# subject-name CN=8000Series,OU=BU,O=Govt,L=Newyork,ST=NY,C=US
Router(config-trustp)# rsakeypair 8002
Router(config-trustp)# crl optional
Router(config-trustp)# commit

    You can also specify the enrollment URL as an IP address, such as http://10.2.2.2.

  2. Review the trustpoint running configuration.

    Example:

    crypto ca trustpoint test2
 crl optional
 subject-name CN=8000Series,OU=BU,O=Govt,L=Newyork,ST=NY,C=US
 enrollment url http://caurl.com
 rsakeypair 8002
   !

    The show run crypto ca trustpoint test2 sample output displays the configured trustpoint parameters.

The trustpoint is configured when the running configuration shows the trustpoint name, enrollment URL, subject name, RSA key pair, and CRL behavior.

Configure a domain name for certificate enrollment

Set the router’s domain name as a prerequisite for certificate enrollment.

The domain name is essential for certificate enrollment preparation. It ensures that the certificate can be correctly generated and associated with the router for secure MACsec EAP-TLS authentication.

Before you begin

Configure the trustpoint before certificate enrollment.

Procedure

  1. Configure the domain name.

    Example:

    Router(config)# domain name ca.8000-series.cisco.com
Router(config)# commit

    The domain name is required for certificate enrollment.

  2. Review the domain name running configuration.

    Example:

    Router# show run domain name
Thu Mar 29 16:10:42.533 IST
domain name ca.8000-series.cisco.com

    The running configuration shows the expected commands.

The domain name is successfully configured when the running configuration displays the expected domain name.

Obtain certificates from the certificate authority

Obtain the CA certificate and enroll the device certificate to enable MACsec EAP-TLS authentication with validated certificates.

Certificate enrollment involves two actions:

  1. Obtain the CA certificate for the trustpoint.

  2. Enroll the device certificate with the certificate authority.

Before you begin

  • Configure the CA server.

  • Obtain a valid CA certificate.

  • Generate an RSA key pair.

  • Configure the trustpoint and domain name.

  • Set up a remote AAA server.

  • Synchronize NTP.

Procedure

  1. Obtain the CA certificate for the trustpoint.

    Example:

    Router# crypto ca authenticate test2

    Use the crypto ca authenticate tp_name command.

  2. Enroll the device certificate with the CA.

    Example:

    Router# crypto ca enroll test2

    Use the crypto ca enroll tp_name command.

  3. Review the enrolled CA and router certificates.

    Example:

    RP/0/RSP0/CPU0:router# show crypto ca certificates
Trustpoint : test2
==================================================
CA certificate
Serial Number        : E0:18:F3:E4:53:17:3E:28
Subject              : subject-name CN=8002,OU=BU,O=Govt,L=Newyork,ST=NY,C=US
Issued By            : subject-name CN=8002,OU=BU,O=Govt,L=Newyork,ST=NY,C=US
Validity Start       : 08:17:32 UTC Fri Jun 24 2016
Validity End         : 08:17:32 UTC Mon Jun 22 2026
SHA1 Fingerprint     : 894ABBFAA3B08E5B7D9E470ECFBBC04576B569F2
Router certificate
Key usage            : General Purpose
Status               : Available
Serial Number        : 03:18
Subject              : serialNumber=cf302761,unstructuredAddress=209.165.200.225,unstructuredName=8002,
C=US,ST=NY,L=Newyork,O=Govt,OU=BU,CN=8002
Issued By            : CN=8000Series,OU=BU,O=Govt,L=Newyork,ST=NY,C=US
Validity Start       : 13:04:52 UTC Fri Feb 23 2018
Validity End         : 13:04:52 UTC Sat Feb 23 2019
SHA1 Fingerprint     :33B50A59C76CCD87D3D0F0271CD5C81F4A1EE9E1
Associated Trustpoint: test2

    The sample output shows CA certificate and router certificate details, including validity dates, SHA1 fingerprints, and the associated trustpoint.

Certificate enrollment is complete when the show crypto ca certificates command displays the CA certificate, device certificate, SHA1 fingerprints, validity dates, and associated trustpoint.

Configure an EAP profile for MACsec EAP-TLS

Configure the EAP profile for MACsec EAP-TLS authentication.

You can configure multiple EAP profiles to support MACsec EAP-TLS certificate-based authentication for devices.

Before you begin

  • Authenticate the certificate authority (CA).

  • Request and install certificates for the device.

Procedure

  1. Configure the EAP profile identity and TLS trustpoint method.

    Example:

    Router# configure terminal
Router(config)# eap profile 8002
Router(config-eap)# identity CE1
Router(config-eap)# method tls pki-trustpoint test2
Router(config-eap)# commit

    You can configure multiple EAP profiles.

  2. Review the EAP profile running configuration.

    Example:

    Router# show run eap profile 8002
eap profile 8002
method tls pki-trustpoint test2
!
identity CE1
!

    The running configuration shows the expected commands.

The EAP profile is successfully configured when the running configuration displays the profile identity and TLS PKI trustpoint method.

Configure an 802.1X profile

Set up an 802.1X profile to enable and control MACsec EAP-TLS authentication on the device.

The 802.1X profile defines PAE behavior, reauthentication timing, and binds the appropriate EAP profile for secure authentication.

Before you begin

Ensure that the EAP profile is already configured before referencing it in the 802.1X profile.

Procedure

  1. Configure the 802.1X profile, PAE role, reauthentication timer, and supplicant EAP profile.

    Example:

    Router# configure
Router(config)# dot1x profile 8k_prof
Router(config-dot1x-8k_prof)# pae both
Router(config-dot1x-8k_prof)# authenticator timer reauth-time 3600
Router(config-dot1x-8k_prof)# supplicant eap profile 8002
Router(config-dot1x-8k_prof)# exit
Router(config)# commit
Router(config)# end

    The example configures the device to use both PAE roles.

  2. Review the 802.1X profile running configuration.

    Example:

    Router# show run dot1x profile 8k_prof

dot1x profile 8k_prof
pae both
authenticator
  timer reauth-time 3600
!
supplicant
  eap profile 8002
!

    The running configuration shows the expected commands.

The 802.1X profile is configured and operational, with the running configuration showing the relevant PAE role, authenticator timer, and supplicant EAP profile settings.

Configure MACsec EAP and an 802.1X profile on an interface

Set up MACsec EAP and attach an 802.1X profile to a selected interface.

This task attaches the 802.1X profile to the chosen interface and enables the MACsec EAP policy, providing secure authentication and key derivation.

Before you begin

Ensure that the 802.1X profile is configured before attaching it to an interface.

Procedure

  1. Attach the 802.1X profile and MACsec EAP policy to the interface.

    Example:

    Router# configure
Router(config)# interface fourHundredGigE 0/0/0/0
Router(config-if)# dot1x profile 8k_prof
Router(config-if)# macsec eap policy macsec-1
Router(config-if)# commit

    You can attach one 802.1X profile to an interface.

  2. Review the interface running configuration.

    Example:

    Router# show run interface HundredGigE 0/0/0/0
interface HundredGigE 0/0/0/0
dot1x profile 8k_prof
macsec eap policy macsec-1
!

    The running configuration shows the expected commands.

The interface is configured when the running configuration displays the 802.1X profile and MACsec EAP policy under the interface.

Verify MACsec EAP and 802.1X configuration on an interface

Ensure that MACsec EAP and 802.1X are properly configured and operational on the selected interface.

Use these steps after configuring the interface profile and MACsec EAP policy.

Before you begin

Complete the MACsec EAP and 802.1X interface configuration before running the verification commands.

Procedure

  1. Use the show dot1x interface command to display detailed 802.1X interface status.

    Example:

    Router# show dot1x interface HundredGigE 0/0/0/24 detail

Dot1x info for HundredGigE 0/0/0/24
---------------------------------------------------------------
Interface short name : Hu0/0/0/24
Interface handle     : 0x800020
Interface MAC        : 0201.9ab0.85af
Ethertype            : 888E
PAE                  : Both
Dot1x Port Status    : AUTHORIZED
Dot1x Profile        : 8k_prof
Supplicant:
Config Dependency    : Resolved
EAP profile          : 8k
Client List:
Authenticator        : 0257.3fae.5cda
EAP Method           : EAP-TLS
Supp SM State        : Authenticated
Supp Bend SM State   : Idle
Last authen time     : 2018 Mar 01 13:31:03.380
Authenticator:
Config Dependency    : Resolved
ReAuth               : Enabled, 0 day(s), 01:00:00
Client List:
Supplicant           : 0257.3fae.5cda
Auth SM State        : Authenticated
Auth Bend SM State   : Idle
Last authen time     : 2018 Mar 01 13:33:17.852
Time to next reauth  : 0 day(s), 00:59:57
MKA Interface:
Dot1x Tie Break Role : Auth
EAP Based Macsec     : Enabled
MKA Start time       : 2018 Mar 01 13:33:17.852
MKA Stop time        : NA
MKA Response time    : 2018 Mar 01 13:33:18.357

    The sample output shows the interface state, PAE value, authorized port status, EAP-TLS method, supplicant state, authenticator state, and EAP-based MACsec state.

  2. Use the show macsec mka session interface command to display the MACsec MKA session summary for the interface.

    Example:

    Router# show macsec mka session interface HundredGigE 0/0/0/24

=======================================================================
Interface Local-TxSCI # Peers Status Key-Server
=======================================================================
Hu0/0/0/24  0201.9ab0.85af/0001 1 Secured YES

    The sample output shows the local TxSCI, peer count, secured status, and key-server state.

  3. Use the show macsec mka session interface command to display detailed MACsec MKA session status for the interface.

    Example:

    Router# show macsec mka session interface HundredGigE 0/0/0/24 detail

MKA Detailed Status for MKA Session
===================================
Status                                   : SECURED - Secured MKA Session with MACsec

Local Tx-SCI                             : 0201.9ab0.85af/0001
Local Tx-SSCI                            : 2
Interface MAC Address                    : 0201.9ab0.85af
MKA Port Identifier                      : 1
Interface Name                           : Hu0/0/0/24
CAK Name (CKN)                           : A94399EE68B2A455F85527A4309485DA
CA Authentication Mode                   : EAP
Keychain                                 : NA (EAP mode)
Member Identifier (MI)                   : 3222A4A7678A6BDA553FDB54
Message Number (MN)                      : 114
Authenticator                            : YES
Key Server                               : YES
MKA Cipher Suite                         : AES-128-CMAC
Configured MACsec Cipher Suite           : GCM-AES-XPN-256
Latest SAK Status                        : Rx & Tx
Latest SAK AN                            : 1
Latest SAK KI (KN)                       : 3222A4A7678A6BDA553FDB5400000001 (1)
Old SAK Status                           : No Rx, No Tx
Old SAK AN                               : 0
Old SAK KI (KN)                          : RETIRED (0)
SAK Transmit Wait Time                   : 0s (Not waiting for any peers to respond)
SAK Retire Time                          : 0s (No Old SAK to retire)
Time to SAK Rekey                        : NA
MKA Policy Name                          : *DEFAULT POLICY*
Key Server Priority                      : 16
Delay Protection                         : FALSE
Replay Window Size                       : 64
Include ICV Indicator                    : FALSE
Confidentiality Offset                   : 0
Algorithm Agility                        : 80C201
SAK Cipher Suite                         : 0080C20001000004 (GCM-AES-XPN-256)
MACsec Capability                        : 3 (MACsec Integrity, Confidentiality, & Offset)
MACsec Desired                           : YES

# of MACsec Capable Live Peers           : 1
# of MACsec Capable Live Peers Responded : 1

Live Peer List:
MI                        MN     Rx-SCI (Peer)      SSCI    KS-Priority
---------------------------------------------------------------------------
86B47DE76B42D9D7AB6805F7  113   0257.3fae.5cda/0001   1        16

Potential Peer List:
MI      MN         Rx-SCI (Peer)             SSCI         KS-Priority
---------------------------------------------------------------------------

Peers Status:
Last Tx MKPDU   : 2018 Mar 01 13:36:56.450
Peer Count      : 1
RxSCI           : 02573FAE5CDA0001
MI              : 86B47DE76B42D9D7AB6805F7
Peer CAK        : Match
Latest Rx MKPDU : 2018 Mar 01 13:36:56.450

    The sample output shows secured MKA session status, CAK Name (CKN), EAP CA authentication mode, key server state, and MKA cipher suite.

    It also shows configured MACsec cipher suite, SAK state, peer list, and Peer CAK match state.

The configuration is verified when the show dot1x output shows an authorized port and the MACsec MKA session outputs show a secured session and valid peer status.