Enter the macsec context

configure macsec

macsec

16.0.R1

All

Enter the connectivity-association list instance

configure macsec connectivity-association string

connectivity-association

16.0.R1

All

Connectivity association name

configure macsec connectivity-association string

1 to 32

This element is part of a list key.

16.0.R1

All

Administrative state of the connectivity association

configure macsec connectivity-association string admin-state keyword

admin-state

disable

enable, disable

16.0.R1

All

Data path encryption algorithm

configure macsec connectivity-association string cipher-suite keyword

cipher-suite

gcm-aes-128

gcm-aes-128, gcm-aes-256, gcm-aes-xpn-128, gcm-aes-xpn-256

16.0.R1

All

Clear tag mode for clear text before the SecTAG

configure macsec connectivity-association string clear-tag-mode keyword

clear-tag-mode

none

none, single-tag, dual-tag

16.0.R1

All

Enable delay protection

configure macsec connectivity-association string delay-protection boolean

delay-protection

false

20.10.R1

All

Text description

configure macsec connectivity-association string description string

description

1 to 80

16.0.R1

All

Confidentiality (encryption) offset

configure macsec connectivity-association string encryption-offset number

encryption-offset

0 | 30 | 50

0

16.0.R1

All

Encrypt and authenticate all PDUs

configure macsec connectivity-association string macsec-encrypt boolean

macsec-encrypt

When configured to true, all PDUs are encrypted and authenticated.

When configured to false, all PDUs are transmitted in clear text, however, they are still authenticated and have the trailing ICV.

true

16.0.R1

All

Discard packet when not within the replay window size

configure macsec connectivity-association string replay-protection boolean

replay-protection

When configured to true, replay protection is enabled and packets are discarded when they are not within the replay window size. 

With relay protection, the sequence of the ID number of received packets is checked. If a packet arrives out of sequence and the difference between the packet IDs exceeds the replay protection window size, the packet is counted by the receiving port and discarded. For example if the replay protection window size is configured to five and a packet with an ID of 1006 arrives on the receiving link immediately following the packet assigned an ID of 1000, the packet with ID 1006 is counted and discarded because it is outside the parameter of the window size.

Replay protection is particularly useful for addressing man-in-the-middle attacks. A packet that is replayed by a man-in-the-middle attacker on the Ethernet link that arrives on the receiving link out of sequence will be detected and dropped instead of forwarded through the network.

Replay protection should not be enabled in cases where packets are expected to arrive out of order.

When configured to false, replay protection is not enabled.

false

16.0.R1

All

Replay protection window size

configure macsec connectivity-association string replay-window-size number

replay-window-size

0 to 4294967294

0

16.0.R1

All

Enter the static-cak context

configure macsec connectivity-association string static-cak

static-cak

Commands in this context configure the Connectivity Association Key (CAK) to manage the MACsec Key Agreement (MKA).

16.0.R1

All

Active pre-shared-key (PSK)

configure macsec connectivity-association string static-cak active-psk number

active-psk

This command specifies the active transmitting PSK. If two PSKs are configured, the arriving MACsec MKA can be decrypted via CAKs using either PSK; however, only the active PSK is used for TX encryption of MKA PDUs.

1 to 2

1

16.0.R1

All

MKA hello interval

configure macsec connectivity-association string static-cak mka-hello-interval keyword

mka-hello-interval

This command configures the interval at which MKA hello packets are sent or received for the connectivity association.

2

1, 2, 3, 4, 5, 6, 500ms

19.5.R1

All

Key server priority used by the MKA protocol

configure macsec connectivity-association string static-cak mka-key-server-priority number

mka-key-server-priority

This command specifies the key server priority used by the MACsec Key Agreement (MKA) protocol to select the key server when MACsec is enabled using static connectivity association key (CAK) security mode.

0 to 255

16

16.0.R1

All

Enter the pre-shared-key list instance

configure macsec connectivity-association string static-cak pre-shared-key number

pre-shared-key

Commands in this context configure pre-shared key attributes to enable MACsec using static connectivity association key (CAK) security mode.

A pre-shared key includes a connectivity association key name (CKN) and a connectivity association key (CAK). The pre-shared key, the CKN and the CAK, must match on both ends of a link.

A pre-shared key is configured on both devices at each end of a point-to-point link to enable MACsec via static CAK security mode. The MACsec Key Agreement (MKA) protocol is enabled after the successful MKA liveliness negotiation.

The encryption type is used to encrypt the SAK and authenticate the MKA packet. The symmetric encryption key SAK (Security Association Key) must be encrypted (wrapped) via the MKA protocols. The AES key is derived from the pre-shared-key.

2

16.0.R1

All

Pre-shared-key (PSK) ID

configure macsec connectivity-association string static-cak pre-shared-key number

1 to 2

This element is part of a list key.

16.0.R1

All

Connectivity association key (CAK) for the PSK

configure macsec connectivity-association string static-cak pre-shared-key number cak string

cak

This command specifies the connectivity association key (CAK) for the pre-shared key. Two values are derived from the CAK:

1 to 71

16.0.R1

All

Connectivity association key name (CKN) for the PSK

configure macsec connectivity-association string static-cak pre-shared-key number cak-name string

cak-name

This command specifies the connectivity association key name (CKN) for the pre-shared key. The CKN is appended to the MKA for identification of the appropriate CAK by the peer.

1 to 64

16.0.R1

All

Encryption for authentication of the MKA packet

configure macsec connectivity-association string static-cak pre-shared-key number encryption-type keyword

encryption-type

aes-128-cmac, aes-256-cmac

This element is mandatory.

16.0.R1

All

Enter the mac-policy list instance

configure macsec mac-policy number

mac-policy

16.0.R5

All

MAC address policy ID

configure macsec mac-policy number

0 to 4294967295

This element is part of a list key.

16.0.R5

All

Add a list entry for destination-mac-address

configure macsec mac-policy number destination-mac-address string

destination-mac-address

5

16.0.R5

All

Destination MAC address added to the MAC policy

configure macsec mac-policy number destination-mac-address string

This element is part of a list key.

16.0.R5

All