Drag and Drop Question A security engineer configures a Cisco Catalyst switch to use Cisco TrustSec. The engineer must define the PAC key to authenticate the switch to Cisco ISE. Drag and drop the…

Question

Exhibit

Answer Area

Explanation

To enable a Cisco Catalyst switch to authenticate with Cisco ISE using TrustSec, it's essential to first enable AAA, define the RADIUS server, specify its address, and then configure the PAC key for initial secure communication.

Approach. The correct sequence of commands to configure the PAC key for a Cisco Catalyst switch to authenticate with Cisco ISE for TrustSec is as follows:

1. appliance(config)# aaa new-model: This command is the fundamental first step for any RADIUS or authentication-related configuration on a Cisco device. It enables the Authentication, Authorization, and Accounting (AAA) services framework, which TrustSec and RADIUS rely on.

2. appliance(config)# radius server cisco-ise: This command creates a named RADIUS server configuration entry, 'cisco-ise' in this case. It transitions the user into the (config-radius-server) sub-mode where specific details for this RADIUS server can be defined. This step is necessary to group the ISE server's properties.

3. appliance(config-radius-server)#address ipv4 10.201.214.24 auth-port 1645 acct-port 1646: Within the radius-server cisco-ise configuration context, this command specifies the IP address (10.201.214.24) and the authentication (1645) and accounting (1646) UDP ports that the switch will use to communicate with the Cisco ISE server. This tells the switch where to send RADIUS requests. While 1812/1813 are standard, 1645/1646 are also valid and commonly used with Cisco implementations.

4. appliance(config-radius-server)#pac key Cisco123: This command defines the Protected Access Credential (PAC) key, which is essentially a shared secret. This key is crucial for the initial secure exchange (EAP-FAST tunnel establishment) between the switch and Cisco ISE. It allows the switch to securely enroll and receive its unique PAC from ISE, enabling subsequent TrustSec authentications.

Common mistakes.

• common_mistake. Common mistakes include an incorrect command sequence or using irrelevant commands. For instance, appliance(config)# cts import-pac disk1:/pac_file.pac password Cisco123 is incorrect because it's used to import an already generated PAC from a file, not to define the initial shared PAC key for the enrollment process. Attempting to define the pac key or address before creating the radius server entry or enabling aaa new-model would result in syntax errors or an incomplete configuration. Also, using the address ipv4 ... auth-port 1812 acct-port 1813 option instead of 1645/1646 is not inherently wrong if the ISE server is configured for those ports, but the provided solution image specifically shows the 1645/1646 ports, implying that's the expected configuration for this scenario. The general logic of defining the server before its specific properties and the PAC key is paramount.

Concept tested. Cisco TrustSec PAC (Protected Access Credential) provisioning, AAA (Authentication, Authorization, and Accounting) services, and RADIUS server configuration on Cisco Catalyst switches for secure network access and segmentation.

No community discussion yet for this question.