Cisco 9300 TrustSec configuration help

hi everyone,

i have (4) 9300 switches run dual stack and there is a trunk running between them and i need to enable TrustSec on the Trunk line,

​

this is a way to explain the topology :

S1+S2 <====Trunk====> S3+S4

​

i did this conf:

1. enable
   
2. configure terminal
   
3. interface type number
   
4. switchport mode trunk
   
5. cts manual
   
6. no propagate sgt
   
7. sap pmk key [mode-list mode1 [mode2 [mode3 [mode4]]]]
   
8. end
   

but i cant get the TrustSec to work it stuck on INIT, i even but the interfaces in same vlans across the trunk but i cant even ping when cts manual is enabled

​

any help?