MACsec Configuration
show macsec profile
[Command] show macsec profile
[Purpose] Display MACsec tunnel policy information for the current configuration.
[View] System view
[Use Cases]
sonic# show macsec profile
Macsec Profile: test
Priority: 30
Cipher Suite : GCM-AES-XPN-128
Primary CAK : 01234567890123456789012345678900
Primary CKN : 01234567890123456789012345678900
Policy : security
Replay Protect : false
Replay Window : 0
Rekey Period : 1s
Send Sci : trueshow macsec interface
[Command] show macsec interface
[Purpose] Display the binding relationship between MACsec policies and physical interfaces.
[View] System view
[Use Cases]
sonic# show macsec interface
interface profile
Ethernet1 test4
Ethernet15 test4
Ethernet10 test5
Rekey Period : 1s
Send Sci : trueshow macsec status
[Command]
show macsec status
[Purpose] Show MACsec connection status.
[View]
System View
[Use Cases]
sonic# show macsec status
+-------------+------------------+------------------+
| INTERFACE | SESSION STATUS | Current SAK AN |
+=============+==================+==================+
| Ethernet2 | established | 1 |
+-------------+------------------+------------------+show counters macsec
[Command]
show counters macsec [ethernet interface_id]
[Purpose]
Show MACsec connection statistics.
[View]
System View
[Use Cases]
sonic# show counters macsec
+------------------------------+----------------------+-----------------+
| SA KEY | COUNTER ID | COUNTER VALUE |
+==============================+======================+=================+
| Ethernet2:60eb5a01774a0001:1 | cur_out_pkt_seq_num | 1 |
| | bytes_encrypted | 0 |
| | bytes_protected | 0 |
| | out_pkts_encrypted | 0 |
| | out_pkts_protected | 0 |
+------------------------------+----------------------+-----------------+
| Ethernet2:60eb5a01774c0001:1 | cur_in_pkt_seq_num | 1 |
| | in_pkts_delayed | 0 |
| | in_pkts_invalid | 0 |
| | in_pkts_late | 0 |
| | in_pkts_not_using_sa | 0 |
| | in_pkts_not_valid | 0 |
| | in_pkts_ok | 0 |
| | in_pkts_unchecked | 0 |
| | in_pkts_unused_sa | 0 |
| | bytes_decrypted | 0 |
| | bytes_validated | 0 |
+------------------------------+----------------------+-----------------+macsec enable
[Command] macsec enable
[Purpose] Enable MACsec functionality.
[View] System view
[Use Cases]
sonic# macsec enable
sonic(config)#macsec profile
[Command] macsec profile profile_name no macsec profile profile_name
[Purpose] Create a MACsec tunnel forwarding policy.
[Parameter]
Parameter | Description |
|---|---|
profile_name | MACsec tunnel policy name |
[View] System configuration view
[Use Cases]
sonic(config)# macsec profile test
sonic(config-macsec-test)#macsec bind
[Command] macsec bind profile_name no macsec bind
[Purpose] Interface binding MACsec tunnel policy.
[Parameter]
Parameter | Description |
|---|---|
profile_name | MACsec tunnel policy name |
[Important Notes] Only the first 16 physical interfaces support MACsec tunnel binding.
[View] Interface Configuration View
[Use Cases]
sonic# configure
sonic(config)# interface ethernet 1
sonic(config-if-1)# macsec bind test
sonic(config-if-1)#mka cipher_suite {GCM-AES-128|GCM-AES-256|GCM-AES-XPN-128|GCM-AES-XPN-256}
[Command] mka cipher_suite {GCM-AES-128|GCM-AES-256|GCM-AES-XPN-128|GCM-AES-XPN-256}
[Purpose] Configure MACsec tunnel encryption algorithm.
[Parameter]
Parameter | Description |
|---|---|
GCM-AES-128 | Key length 128 bits, PN (Packet Number) length: 32 bits. |
GCM-AES-256 | Key length 256 bits, PN (Packet Number) length: 32 bits. |
GCM-AES-XPN-128 | Key length 128 bits, XPN (eXtended Packet Number) length: 64 bits. |
GCM-AES-XPN-256 | Key length 256 bits, XPN (eXtended Packet Number) length: 64 bits. |
[Notes] When the PN (Packet Number) of the MACsec tunnel encryption algorithm is 32 bits, this MACsec tunnel can support forwarding approximately 4.2 billion packets. Therefore, when the tunnel encryption algorithm is GCM-AES-128/GCM-AES-256, the rekey_period parameter must be configured to perform periodic key updates.
[View] MACsec Policy Configuration Viewystem view
[Use Cases]
sonic(config)# macsec profile test
sonic(config-macsec-test)# mka cipher_suite GCM-AES-128
sonic(config-macsec-test)#mka policy {integrity_only|security}
[Command] mka policy {integrity_only|security}
[Purpose] Configure MACsec tunnel data transmission mode.
[Parameter]
Parameter | Description |
|---|---|
integrity_only | Verification mode, data packets are not encrypted and only data integrity verification is performed. |
security | Encryption security mode, data packets are encrypted and data integrity verification is performed. |
[View] MACsec Policy Configuration Viewystem view
[Use Cases]
sonic(config)# macsec profile test
sonic(config-macsec-test)# mka policy integrity_only
sonic(config-macsec-test)#mka priority
[Command] mka priority 0-255
[Purpose] Configure the priority of the mka negotiation server.
[View] MACsec Policy Configuration Viewystem view
[Notes] The default priority for mka is 255. The smaller the priority parameter, the higher the priority. The mka server is the party responsible for controlling and distributing encryption keys (SAK) in the MKA protocol.
[Use Cases]
sonic(config)# macsec profile test
sonic(config-macsec-test)# mka priority 100
sonic(config-macsec-test)#mka psk ckn cak
[Command] mka psk ckn password-name cak password no mka psk
[Purpose] Configure the key name and key for the MACsec tunnel.
[Parameter]
Parameter | Description |
|---|---|
ckn password-name | Key name, used to identify an encryption domain, format: prefix-free hexadecimal number; length: 32 bits. |
cak password | Shared key, used in the MKA protocol to authenticate device identity, format: prefix-less hexadecimal number; length: 32 bits for GCM-AES-128/GCM-AES-XPN-128 encryption, 64 bits for GCM-AES-256/GCM-AES-XPN-256 encryption. |
[Notes] The CKN and CAK parameters at both ends of the MACsec tunnel must be configured consistently in order to successfully establish the MACsec tunnel.
[View] MACsec Policy Configuration Viewystem view
[Use Cases]
sonic(config)# macsec profile test
sonic(config-macsec-test)# mka psk ckn 01234567890123456789012345678900 cak 01234567890123456789012345678900
sonic(config-macsec-test)#mka rekey_period
[Command] mka rekey_period rekey_period
[Purpose] Configure the key replacement cycle for MACsec tunnels.
[Parameter]
Parameter | Description |
|---|---|
rekey_period | Key replacement cycle, unit: seconds. Setting this parameter to 0 indicates that no key replacement cycle will be performed. The default value is 0. |
[View] MACsec Policy Configuration Viewystem view
[Use Cases]
sonic(config)# macsec profile test
sonic(config-macsec-test)# mka rekey_period 10
sonic(config-macsec-test)#mka replay_protection {enable|window_size}
[Command] mka replay_protection {enable|window_size} no mka replay_protection enable
[Purpose] Enable/configure MACsec replay detection functionality
[Parameter]
Parameter | Description |
|---|---|
window_size | Allows out-of-order PN (Packet Number) ranges. Configurable range for non-XPN data encryption algorithms: 0-4294967295. Configurable range for XPN data encryption algorithms: 0-1073741824. |
[View] MACsec Policy Configuration Viewystem view
[Use Cases]
sonic(config)# macsec profile test
sonic(config-macsec-test)# mka replay_protection enable
sonic(config-macsec-test)# mka replay_protection window_size 1000
sonic(config-macsec-test)#mka send_sci enable
[Command] mka send_sci enable no mka send_sci enable
[Purpose] Enable the send_sci function of the MACsec policy.
[Notes] The device defaults to enabling send_sci. When send_sci is disabled, MACsec-forwarded datagrams no longer carry MAC and port information. Whether the send_sci function is enabled does not affect the establishment of MACsec tunnels between our devices.
[View] MACsec Policy Configuration Viewystem view
[Use Cases]
sonic(config)# macsec profile test
sonic(config-macsec-test)# mka send_sci enable
sonic(config-macsec-test)#