Enabling MACsec and Configuring Group Parameters

Enable MACsec globally on the device, and configure the MACsec Key Agreement (MKA) group before configuring MACsec security features for the group.

A valid license must be installed on the device before MACsec can be configured.

  1. At the global configuration level, enter the dot1x-mka-enable command to enable MACsec on the device. 
    device# configure terminal
device(config)# dot1x-mka-enable 
device(config-dot1x-mka)#

    MACsec is enabled, and the device is placed at the dot1x-mka configuration level.
    Note: When MKA is disabled, all the ports are brought to a down state. You must manually enable the ports again to bring the ports back up.
  2. Enter the mka-cfg-group command followed by a group name to create a group. 
    device# configure terminal
device(config)# dot1x-mka  
device(config-dot1x-mka)# mka-cfg-group test1 
device(config-dot1x-mka-group-test1)#

    The group is created, and the device is placed at the group configuration level.

Next: At the group configuration level, set the key-server priority, and define MACsec security features to be applied to interfaces once they are assigned to the group.

In this section:

  1. Configuring MACsec Key-Server Priority
    MACsec uses a key-server to generate and distribute encryption parameters and secure key information to members of a MACsec connectivity association.
  2. Configuring MACsec Integrity and Encryption
    To ensure point-to-point integrity, MACsec computes an Integrity Check Value (ICV) on the entire Ethernet frame using the designated cipher suite. The designated cipher suite is also used for encryption.
  3. Configuring MACsec Frame Validation
    You can specify whether incoming frames are checked for MACsec (secTAG) headers and how invalid frames are handled.
  4. Configuring Replay Protection
    MACsec replay protection detects repeated or delayed packets and acts as a safeguard against man-in-the-middle attacks.
Parent topic: Media Access Control Security