350-401 Question 302
Select 3An enterprise network administrator is tasked with ensuring data integrity and confidentiality between switches in the campus network. The network is configured with TrustSec for scalable security policies and uses MACsec for link-layer encryption. During implementation, the administrator encounters a situation where TrustSec works as expected, but MACsec fails to establish. Which of the following could be the reason for MACsec failure?
- A
The switches do not support IEEE 802.1AE (MACsec) on the physical interfaces.
- B
The TrustSec Security Group Tag (SGT) is not properly assigned to the devices.
- C
The key agreement protocol (MKA) is not enabled on the interfaces.
- D
The physical link between the switches is not configured as a trunk.
- E
The switches are configured in different MACsec key agreement (MKA) policy modes.
Show answer and explanation
Correct answers: A, C, E
Explanation
MACsec relies on specific hardware and software configurations to function. For MACsec to successfully establish, the physical interfaces must support IEEE 802.1AE, the MACsec Key Agreement (MKA) protocol must be enabled to negotiate encryption keys, and the MKA policy modes on both switches must match. TrustSec and trunk configurations, while related to broader network functionality, are not directly responsible for MACsec encryption failures.
- A. Correct.
If the switches' physical interfaces do not support IEEE 802.1AE (MACsec), MACsec encryption cannot be established. This is a hardware feature that must be supported on the interfaces.
- B. Incorrect.
TrustSec Security Group Tags (SGTs) are used for policy enforcement and segmentation, but they do not affect the establishment of MACsec encryption. This is not a reason for MACsec failure.
- C. Correct.
The MACsec Key Agreement (MKA) protocol is essential for negotiating and managing encryption keys for MACsec. If MKA is not enabled, MACsec will fail to establish.
- D. Incorrect.
While trunk links are commonly used between switches, MACsec can also operate on access links. The link not being a trunk is not a cause for MACsec failure.
- E. Correct.
If the switches are configured with different MKA policy modes (e.g., static vs. dynamic), they cannot successfully negotiate encryption keys, causing MACsec to fail.