TrustSec, MACsec, and data encryption. These are the core tools that keep data centres secure when data is in transit between servers, switches, and endpoints. For the 350-601 exam, you need to understand not only what each one does, but also how they work together to create a defence-in-depth strategy that protects against eavesdropping, tampering, and unauthorised access.
Jump to a section
A simple way to picture TrustSec, MACsec, and Data Encryption
Have you ever had to show your passport at a border crossing, or flash a membership card to enter a private club?
In that moment, you are proving who you are (identity) and what you are allowed to do (permissions). The guard does not just let anyone through – they check a credential (your passport) that proves you are the person on the card. Then they decide if you can enter based on your clearance or membership level. That is exactly how TrustSec works in a data centre network.
Now think about sending a sealed envelope through the post. Anyone handling it could read the letter inside if they opened it. But if you put that letter into a tamper-proof, locked briefcase that only the recipient has the key to open, you have added a layer of security. The briefcase is MACsec – it encrypts the data so that even if someone intercepts the envelope, they cannot read the contents.
Finally, imagine you are a spy passing a coded message to another spy. The message is in a language only you and the recipient understand. That is data encryption generally – scrambling the data so only authorised parties can unscramble it. Together, these three ideas – TrustSec (identity + permissions), MACsec (encrypting the link between two devices), and general data encryption (protecting the data itself) – form a layered defence for the data centre.
Let’s start with data encryption. Encryption is the process of scrambling readable data (called plaintext) into an unreadable format (called ciphertext) using a secret key. Only someone with the correct key can decrypt it back into plaintext. This is like locking a diary with a padlock – anyone can see the locked diary, but they cannot read the words inside unless they have the key. Encryption can happen at different points in the network: at the application layer (HTTPS encrypts web traffic), at the link layer (MACsec), or at the network layer (IPsec). For 350-601, the focus is on link-layer encryption (MACsec) and policy-based access control (TrustSec).
MACsec stands for Media Access Control security. It operates at Layer 2 of the OSI model – the same layer that handles MAC addresses on local networks. MACsec encrypts every single Ethernet frame between two directly connected devices, such as a server and a switch or two switches. It uses a protocol called MKA (MACsec Key Agreement) to negotiate and distribute encryption keys. Once enabled, all traffic between those two devices is encrypted in hardware, which means it adds almost no delay. Why do you need MACsec if you already have application-level encryption (like HTTPS)? Because application encryption only protects the payload – headers like source and destination MAC addresses remain visible. MACsec encrypts the entire frame, including the headers, so an attacker cannot even see which devices are talking to each other. Think of it as wrapping the whole letter plus the envelope in a sealed plastic bag.
TrustSec is different. It is not primarily about encryption – it is about identifying who or what is sending traffic and enforcing policies based on that identity. In traditional networks, security is based on IP addresses. But IP addresses can change, and they can be spoofed. TrustSec replaces IP addresses with a Security Group Tag (SGT). An SGT is a 16-bit number that is attached to every packet coming from a device. A switch or firewall can then apply policies based on the SGT, not the IP address. For example, all devices belonging to the 'HR' department get an SGT of 100, and all devices in 'Finance' get SGT 200. A policy can say: 'SGT 200 can talk to the payroll server, but SGT 100 cannot.' This is much more flexible and secure than IP-based ACLs.
How does TrustSec work in practice? First, authentication happens. A user or device connects to the network, and the switch authenticates them using 802.1X (port-based authentication) or MAB (MAC Authentication Bypass). An Identity Service Engine (ISE) server checks their credentials and assigns an SGT. From that point on, every packet from that device carries the SGT. The network devices (switches, routers, firewalls) use a protocol called SXP (SGT Exchange Protocol) to share SGT-to-IP mappings. Then, when a packet arrives at a switch, the switch looks up the SGT attached to the packet and applies the policy. This is called SGACL (Security Group ACL). So TrustSec gives you identity-based, dynamic access control without needing to rewrite ACLs every time someone changes roles.
Now, here is where MACsec and TrustSec overlap. TrustSec can use MACsec to secure the communication between network devices. When two switches have TrustSec enabled, they can also negotiate MACsec encryption between them. This is known as TrustSec with MACsec. It gives you both the identity-based policy control (TrustSec) and the link encryption (MACsec). On the 350-601 exam, you will see questions about how these two technologies complement each other, and when you would choose one over the other.
One common misconception is that encryption solves all security problems. It does not – it only protects data in transit. Encryption does not stop an attacker from plugging a laptop into a switchport and sending traffic. That is where TrustSec comes in – by authenticating every device and enforcing policies, it prevents unauthorised devices from accessing sensitive parts of the network. The two together provide a strong foundation for data centre security.
Finally, there is a concept called 'data encryption in the data centre' that goes beyond MACsec. This includes IPsec tunnels between data centres, and encrypting data at rest (on disk). For 350-601, the focus is on in-transit encryption using MACsec and the policy framework of TrustSec, but you should be aware that IPsec and SSL/TLS also play roles.
Device Connects to the Network
A server or user device plugs into a switch port that has 802.1X enabled. The switch sends an EAP (Extensible Authentication Protocol) request to the device, prompting it to present credentials. This step is critical because it initiates the identity verification process that TrustSec relies on. Without authentication, the device cannot be assigned an SGT.
Authentication with ISE
The switch forwards the device's credentials (e.g., certificate or username/password) to ISE. ISE checks the credentials against its database, which can be integrated with Microsoft Entra ID or LDAP. If the device is valid, ISE authenticates it. This step is the core of TrustSec’s identity-based security.
SGT Assignment
Once authenticated, ISE looks up the policy rules and assigns a Security Group Tag (SGT) to the device. For example, a database server might get SGT 10, while a web server gets SGT 20. ISE sends this SGT back to the switch. The switch then tags all packets coming from that device with the SGT in the Ethernet frame header.
MACsec Key Agreement (if enabled)
If the link between the switch and the device (or between two switches) has MACsec enabled, the devices perform MKA. They exchange keys using a pre-shared key or EAP-FAST. This step establishes a secure session that will encrypt all subsequent Ethernet frames on that link. It is optional but recommended for data centre links.
Policy Enforcement (SGACL)
When a packet arrives at a switch or firewall, the device extracts the SGT from the frame. It then looks up the SGACL rules that were downloaded from ISE. The rules specify which SGTs can talk to each other and on which ports. If a packet matches a permit rule, it is forwarded. If it matches a deny rule, it is dropped. This is how TrustSec enforces security without ACLs based on IP addresses.
Packet Forwarding and Encryption
If MACsec is enabled, the Ethernet frame is encrypted by the hardware on the egress interface before being sent over the wire. The receiving device decrypts it using the shared key. The payload and headers remain encrypted until they reach the next MACsec peer. This step ensures that even if someone taps the cable, they cannot see the SGT or the data inside the packet.
An IT professional managing a large data centre for a financial services company needs to ensure that traffic between servers handling credit card transactions is encrypted, and that only authorised employees can access those servers. Here is how they would use TrustSec and MACsec step by step.
First, they would deploy Cisco ISE (Identity Services Engine) as the central policy server. ISE is the brain behind TrustSec. They would configure ISE to authenticate every device that plugs into the network – servers, switches, even employee laptops – using 802.1X certificates. The helpdesk team would issue certificates to new servers during provisioning. Once authenticated, ISE assigns an SGT. For example, all servers in the 'payment-processing' group get SGT 10, while finance user laptops get SGT 20.
Next, the network team enables TrustSec on all the data centre switches. They configure each switch to be an 'SGT-capable' device. They also enable SXP to share SGT-to-IP mappings between switches and firewalls. This ensures that when a packet leaves a switch, the next switch knows which SGT it belongs to.
Then, they write SGACLs. A typical policy might be: 'SGT 10 can communicate with SGT 30 (the database servers) on TCP port 1433 (SQL) only. SGT 20 cannot communicate with SGT 10 at all.' These policies are enforced on the switch hardware, so they do not slow down traffic.
Now, they enable MACsec on the links between the switches in the data centre core. This is done by enabling MKA globally on the switch interfaces. The switches automatically negotiate encryption keys using a pre-shared key or EAP-FAST (Extensible Authentication Protocol with Flexible Authentication via Secure Tunneling). Once MACsec is up, all traffic between the switches is encrypted in hardware. The IT pro can verify this by using the command 'show macsec status' on the switch. They will see that the link is secured with 256-bit AES encryption.
Finally, they test the setup. They try to connect a rogue laptop to an unused port. The switch, using 802.1X, rejects the connection because the laptop has no valid certificate. The laptop never gets an SGT, so no traffic is forwarded from that port. This is the power of TrustSec – it stops the attack before it starts.
In a larger environment, the IT pro might also use:
SGT-based firewalling on a Cisco Firepower appliance
MACsec over a fibre channel link between storage and compute
Integrating with Microsoft Entra ID for user authentication via ISE
Monitoring logs in ISE to see which SGTs are generating alerts
The 350-601 exam tests your understanding of TrustSec, MACsec, and data encryption in the data centre with a mix of multiple-choice questions, drag-and-drop sequences, and scenario-based questions. Here is exactly what you need to know.
First, you must memorise the key protocols: MKA (MACsec Key Agreement), SGT (Security Group Tag), SGACL (Security Group Access Control List), SXP (SGT Exchange Protocol), and ISE (Identity Services Engine). The exam loves to ask: 'Which protocol is used to distribute encryption keys for MACsec?' The answer is MKA. Similarly, 'Which component assigns the SGT to an endpoint?' The answer is ISE.
Second, understand the difference between TrustSec and MACsec. A common trap is a question that says: 'You need to encrypt traffic between two switches in the data centre. Which technology should you use?' The answer is MACsec. If they say 'You need to enforce access control based on user role,' the answer is TrustSec. They sometimes combine them: 'Which technology provides both encryption and policy-based access control?' The answer is TrustSec with MACsec enabled.
Third, memorise the default behaviour of SGT propagation. The exam asks: 'If two switches are not directly connected and need to exchange SGT information, which protocol is used?' The answer is SXP. If they are directly connected, TrustSec can use a proprietary method called 'inline tagging', where the SGT is inserted directly into the Ethernet frame header.
Fourth, understand the encryption strengths. MACsec supports AES-128 and AES-256 encryption. The exam might ask: 'Which encryption cipher is used by default for MACsec?' The answer is AES-128, though AES-256 is also supported. You should also know that MACsec operates at Layer 2, not Layer 3.
Fifth, be aware of the different authentication methods for TrustSec. The exam lists: 802.1X (with certificates or PEAP), MAB (for devices that cannot run 802.1X), and Web Authentication (for guest users). You need to know that MAB is for devices like printers or IP phones that do not have a browser.
Additionally, the exam tests your ability to order steps correctly. Questions like 'In what order do these steps occur when a server connects to a TrustSec-enabled switch?' The sequence is: authentication -> SGT assignment -> policy lookup -> packet forwarding. Memorise this sequence.
Exam traps to watch for:
Questions that ask about 'MACsec vs. IPsec' – MACsec is Layer 2, IPsec is Layer 3. They cannot be compared directly.
Questions that suggest TrustSec without ISE – ISE is mandatory for TrustSec to work.
Questions about 'data encryption at rest' – the exam focuses on in-transit encryption for this objective, so ignore disk encryption here.
Questions that confuse SGT with VLAN – VLANs are for grouping based on broadcast domain, SGTs are for security policy. They are different concepts.
Finally, remember the exact Cisco terminology: TrustSec is a feature set on Cisco switches and routers. MACsec is an IEEE standard (802.1AE). The exam expects you to know that Cisco's implementation of MACsec is compliant with the standard.
TrustSec assigns a Security Group Tag (SGT) to every authenticated device, enabling identity-based access policies instead of IP-based ACLs.
MACsec (802.1AE) encrypts all traffic on a direct Ethernet link between two devices, providing Layer 2 confidentiality.
MKA is the protocol that negotiates and distributes encryption keys for MACsec.
ISE (Identity Services Engine) is the mandatory central policy server for TrustSec that authenticates devices and assigns SGTs.
SXP (SGT Exchange Protocol) is used to share SGT-to-IP mappings across network devices that are not directly connected.
TrustSec and MACsec work together: TrustSec provides policy, MACsec provides encryption on the link.
MACsec uses AES-128 or AES-256 encryption in hardware, adding negligible latency.
802.1X is the primary authentication method for TrustSec, but MAB (MAC Authentication Bypass) is used for devices without browsers.
These come up on the exam all the time. Here's how to tell them apart.
TrustSec
Provides identity-based access control using SGTs
Operates at Layer 2 and Layer 3 (policy enforcement)
Requires ISE for authentication and policy management
MACsec
Provides link-layer encryption using AES-128 or AES-256
Operates only at Layer 2 (Ethernet frame)
Does not require ISE; uses MKA for key exchange
SGT (Security Group Tag)
16-bit number assigned dynamically by ISE based on device identity
Used for security policy enforcement (SGACLs)
Travels inside the Ethernet frame header alongside VLAN tags
VLAN (Virtual LAN)
12-bit number typically configured manually on switch ports
Used for broadcast domain segmentation
Separate VLANs require a router to communicate
802.1X (Standard EAP)
Uses certificates or credentials (username/password) for authentication
Provides strong, mutual authentication
Supported on devices with 802.1X supplicant software
MAB (MAC Authentication Bypass)
Authenticates based on the device's MAC address only
Weak authentication since MAC addresses can be spoofed
Used for devices that cannot run 802.1X, like printers or IP phones
Mistake
TrustSec is a type of encryption like MACsec or IPsec.
Correct
TrustSec is not primarily an encryption technology. It is an identity-based policy framework. While it can use MACsec for encryption, its core function is to assign Security Group Tags (SGTs) to devices and enforce access control based on those tags.
Because the names 'TrustSec' and 'MACsec' both have 'sec' in them, beginners assume they do the same thing. In reality, one is policy (TrustSec) and the other is encryption (MACsec).
Mistake
MACsec replaces the need for application-level encryption like HTTPS.
Correct
MACsec encrypts the entire Ethernet frame between two directly connected devices, but it does not protect data once it leaves that link. Application encryption (e.g., HTTPS) protects data end-to-end across multiple hops. They are complementary, not replacements.
People think 'encryption is encryption' and believe that encrypting at one layer covers everything. They forget that data traverses many links and applications need to be protected independently.
Mistake
SGTs are manually configured on each switch like traditional VLANs.
Correct
SGTs are dynamically assigned by ISE based on the identity of the connecting device. You configure the policy in ISE, and the SGT is learned and propagated automatically via SXP. Manual configuration is only needed for static mappings in rare cases.
This comes from experience with VLANs, which are usually manually assigned to switch ports. TrustSec is dynamic and centrally managed, which is a paradigm shift.
Mistake
MACsec works on any network link, including through intermediate routers.
Correct
MACsec works only on direct, point-to-point Ethernet links. It encrypts the frame between two directly connected devices. If a packet must travel through a router, the encryption is decrypted and re-encrypted at each hop. It is not an end-to-end VPN.
Beginners think of encryption as end-to-end like HTTPS, so they assume MACsec works the same way. In reality, it is hop-by-hop link encryption.
Mistake
TrustSec is only useful for user-facing networks with 802.1X.
Correct
TrustSec is heavily used in data centre environments for server-to-server communication, storage access, and between network devices. It is not just for users – it can authenticate servers using certificates and enforce policies between machine identities.
Many introductory materials focus on user authentication (802.1X) for wireless or campus networks. Beginners assume TrustSec is only for that use case, ignoring data centre server segmentation.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
VLANs and ACLs are static and based on IP addresses. TrustSec is dynamic and identity-based, so it is easier to manage in large environments where users and devices move frequently. They can be used together, but TrustSec provides finer-grained control.
Not exactly. WPA2 is also a form of link-layer encryption for Wi-Fi, but it uses a different protocol (RSN). MACsec is for wired Ethernet (IEEE 802.3) and is defined in IEEE 802.1AE. Both encrypt at Layer 2, but they work on different media and use different key management.
You need a NIC that supports MACsec in hardware. Most modern data centre NICs (from Intel, Broadcom, Mellanox) support it. You must also enable it in the operating system driver. If your NIC does not support it, MACsec will not work.
TrustSec policies are already downloaded to the switches. If ISE fails, the switches continue to enforce the existing policies. However, new devices cannot authenticate until ISE comes back up. This is because the switch does not have cached credentials to perform local authentication for TrustSec in most configurations.
No, because it is implemented in hardware on modern switches and NICs. The encryption and decryption happen at wire speed, typically with less than a microsecond of added latency. It is designed for high-performance data centre links like 10GbE and 40GbE.
A VLAN groups devices into a broadcast domain at Layer 2, and traffic between VLANs requires a router. An SGT is a security label that travels with each packet and is used for policy enforcement, regardless of VLAN. You can have multiple SGTs within the same VLAN. They solve different problems.
You've finished TrustSec, MACsec, and Data Encryption. Continue through the 350-601 study guide to build a complete picture of the exam.
Done with this chapter?