MACsec show commands

ca-name

Specifies the CA name

Admin State

Up — The CA is administratively up

Down — The CA is administratively down

If port <x/y/z> ethernet>macsec is shutdown, the admin state is down. Otherwise, the admin state is up.

Description

Displays a user description for this CA

Replay Protection

Enabled — Replay Protection is enabled

Disabled — Replay Protection is disabled

If replay protection is enabled for this CA, the out of window packet is discarded.

Replay Window Size

Displays the size, in packets, of the replay window

Macsec Encrypt

Enabled

MACsec is enabled

Disabled

MACsec is disabled

Clear Tag Mode

Displays the clear tag mode: single-tag, dual-tag

Cipher Suite

Displays the cipher suite used for encrypting the SAK:

gcm-aes-128 or gcm-aes-256

Encryption Offset

Displays the encryption offset configured on this node: 0, 30, 50

Assigned ports

Displays all ports that contain this CA

MKA Key Server Priority

Displays the MKA key server priority: 0 to 255 (default 16)

Active Pre-Shared Key Index

Displays the active preshared key index: 1 to 2 (default 1)

Active Pre-Shared Key CKN

Displays the active PSK CAK name

MKA Session for port

Displays the MKA session for the current port

Port

Displays the MKA session current port

Security Zone

Displays security zone this port belongs to

Live Peer List

Displays peers (participants) that have provided their MI and MN via KMA. The peer entry is in the Live Peer List.

Member Identifier

Displays the MI of the peer entry

Mesg Num

Displays the latest Member Number of the peer entry

Rx-SCI

Displays the Peer Rx-SCI

KS-priority

Displays the Peer Key server priority

Potential Peer List

Peers (participants) that have Potential Peers List includes all the other peers that have transmitted an MKPDU that has been directly received by the participant or that were included in the Live Peers List of a MKPDU transmitted by a peer that has proved liveness, an MKA PDU. The peer entry is in the Potential Peers List.

MKA Oper State

Displays the operational state of the MKA participant on this port. The operational MKA state will be up if MKA hellos are received on this port and have a valid session.

Oper Cipher Suite

Displays the operational encryption algorithm used for datapath PDUs when all parties in the CA have the (SAK). This value is specified by the key server: gcm-aes-128 or gcm-aes-256

Oper Encrypt Offset

Displays the operational encryption offset used for the datapath PDUs when all parties in the CA have the SAK. This value is specified by the key server: 0, 30, 50.

CAK Name

Displays the name of the CAK in use by this MKA which is used to find the correct CAK

MKA Member ID

Displays the Member Identifier (MI) for the MKA instance

Transmit Interval

Displays the time interval (in ms) at which the MKA broadcasts its liveliness to its peers and is non-configurable

Outbound SCI

Displays the Secure Channel Identifier (SCI) information for transmitting MACsec frames and consists of the outgoing port MAC Address and a port identifier

Message Number

Displays the current count of MKA messages that is attached to MKA PDUs

Key Number

Displays the number of the currently assigned CAK. When a new CAK is generated, this number is incremented. A SAK is identified by 128-bit Key Identifier (KI) and 32-bit Key-Number (KN).

Key Server

Displays whether this server is the highest priority server in the peer group: no, yes

Key Server Priority

Displays the priority of the active key server: 0-255 (default 16)

Latest SAK AN

Displays the Association Number (AN) of the latest SAK. This number is concatenated with an SCI to identify a Secure Association (SA). In SR OS, only two SAKs are supported.

Latest SAK KI

Displays the Key Identifier (KI) of the latest SAK. This number is derived from the MI of the key server and the key number.

Previous SAK AN

Displays the AN of the previous SAK. This number is concatenated with an SCI to identify an SA.

Previous SAK KI

Displays the KI of the previous SAK. This number is derived from the MI of the key server and the key number.

Peer Removed Due to Timeout

Displays the number of peers removed from the live/potential peer list caused by not receiving an MKPDU within the MKA Live Time (6.0 seconds) and is not configurable

CKN Not Found

Displays the number of MKPDUs received with a CKN that does not match the CA configured for the port

New Live Peer

Displays the number of validated peers that have been added to the live peer list

SAK Generated by Server

Displays the number of SAKs generated by this MKA instance

SAK Installed for TX

Displays the number of SAKs installed for transmitting

SAK Installed for RX

Displays the number of SAKs installed for receiving

PDU Too small

Indicates that the number of MKPDUs received that are less than 32 octets

PDU Too big

Indicates the number of MKPDUs received where the EAPOL header indicates a size larger than the received packet.

PDU Not Quad Size

Indicates the number of MKPDUs received with a size that is not a multiple of 4 octets long

PDU Message Number Invalid

Indicates the number of MKPDUs received out of order as indicated by the Message Number

PDU Param Set Size Invalid

Indicates the number of MKPDUs received which contain a parameter set body length that exceeds the remaining length of the MKPDU

PDU Liveness Check Fail

Indicates the number of MKPDUs received which contain an MN that is not acceptably recent

Param Set Not Quad Size

Indicates the number of MKPDUs received which contain a parameter set that is not a multiple of 4 octets long

Unsupported Agility

Indicates the number of MKPDUs received which contain an unsupported Algorithm Agility value

Invalid CAK Name Length

Indicates the number of MKPDUs received which contain a CAK name that exceeds the maximum CAK name length

ICV Check Failed

Indicates the number of MKPDUs received which contain an ICV value that does not authenticate

Peer Using Same MID

Indicates the number of MKPDUs received which contain a peer list with an MI entry which conflicts with the local MI

SAK From Non-Live Peer

Indicates the number of SAKs received from peer that is not a member of the Live Peers List

SAK From Non-Key Server

Indicates the number of SAKs received from an MKA participant that has not been designated as the Key Server. Only the key server should distribute SAK.

SAK Decrypt Fail

Indicates the number of AES Key Wrap SAK decryption failures that have occurred

SAK Encrypt Fail

Indicates the number of AES Key Wrap SAK encryption failures that have occurred

Key Number Invalid

Indicates the number of SAKs received with an invalid Key Number

SAK Installation Failed

Indicates the number of Secy SAK installation failures that have occurred

CAK Info Missing

Indicates the number of times internal CAK data is not available for the generation of the SAK

Max Peers Set as Zero

Indicates the number of Secy SAK installations that have failed because the max peer entry being set to 0