How Do You Configure the TrustSec PAC Key on a Catalyst Switch?

Why the Answer Is Correct

The sequence begins with aaa new-model, which globally enables the AAA subsystem and is a prerequisite for any named RADIUS server object on IOS/IOS-XE. The engineer then creates the server object with radius server cisco-ise, entering the RADIUS server configuration submode where the ISE Policy Service Node is defined. Inside that submode, address ipv4 10.201.214.24 auth-port 1812 acct-port 1813 binds the server object to the ISE node using the IETF-standard RADIUS authentication and accounting ports, which Cisco ISE listens on by default. Finally, pac key Cisco123 configures the Protected Access Credential shared key inside the same server block; this is the key the switch uses to authenticate itself to ISE during PAC provisioning for TrustSec/SXP (environment-data and device-authorization exchanges). Because the PAC key lives under the named RADIUS server, it cannot be configured before the server object and its address statement are in place, which fixes the drag order unambiguously.

Why Other Candidate Answers Are Wrong

cts import-pac is the highest-value distractor: it is Cisco ASA syntax, not Catalyst IOS/IOS-XE, so a switch rejects it outright. Commands that reference ports 1645/1646 are wrong because those are the legacy RADIUS ports that predate RFC 2865/2866; current ISE deployments and the Catalyst TrustSec configuration guide use 1812/1813. Ordering variants that place pac key Cisco123 first, or that put address ipv4... after the PAC key, fail because the key is scoped to the RADIUS server object and the address defines that object's endpoint. Any distractor taken from unrelated AAA configuration — dot1x, MAB, or CoA-style statements — does nothing toward PAC provisioning and is therefore unused.

Community Comment Notes

Cachaman flagged the exact trap in the option set, stating that "Cts import-pac is not a valid command and 1645 and 1646 are the old RADIUS ports" and listing the corrected order ending in "pac key Cisco123". Rododendron2 reinforced the platform distinction with the remark that "Cts import-pac is for Cisco ASA, not IOS", which matches Cisco's Catalyst TrustSec documentation. AhmedY and Cname both arrived at the same four-line sequence and pointed to Cisco's IOS TrustSec configuration guide as the authority, with Cname adding the explanation that the address statement "Defines the ISE node's IP address and standard IETF RADIUS ports (1812/1813)" while the PAC key is set inside that RADIUS server stanza. The consistent community consensus therefore lines up with the vendor documentation rather than with the ASA-style distractors.