MACsec Frame Format

When MACsec is enabled, FastIron hardware transforms each Ethernet frame by adding a security tag (secTAG) to the frame.

The following figure shows how the Ethernet frame is converted into a MACsec frame.

MACsec Frame Format

The security tag passes MACsec-related information to MACsec peers.

The following figure defines the fields in a security tag.

MACsec Security Tag Format

Processing Incoming Frames

FastIron hardware processes each MACsec frame received or transmitted based on the information in the MACsec security tag.

The FastIron device first confirms the Ethertype on incoming frames as MACsec and then processes incoming MACsec frames as illustrated in the following figure.

MACsec Incoming Frames

Processing Outgoing Frames

The FastIron device parses each outgoing frame and, if MACsec is enabled, processes the outgoing MACsec frame to apply configured MACsec options.

The following figure shows how the device applies configured MACsec options before transmitting the frames.

MACsec Outgoing Frames