Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Configure MACsec

SUMMARY 

We can configure MACsec to secure point-to-point Ethernet links connecting your device with MACsec-capable MICs. Each point-to-point Ethernet link that you want to secure using MACsec must be configured independently. We can enable MACsec on device-to-device links using static connectivity association key (CAK) security mode.

PIC2 of the EX4100-P and EX4100-T devices, and PIC0 and PIC2 of the EX4100-MP device support MACsec.

Customizing Time

To customize time, disable NTP and set the date.

  1. Disable NTP.
  2. Setting date and time. Date and time format is YYYYMMDDHHMM.ss
    Note:

    We are not claiming NTP as part of FPT_STM_EXT.1 SFR. However, in our configuration guide we have leveraged activate/deactivate NTP services to validate MACsec tolerance and MACsec key-chain.

Configuring MACsec on a Device Running Junos OS

To configure MACsec on a device running Junos OS:

  1. Configure the MACsec security mode as for the connectivity association.
    Note:

    Based on your requirement you can configure the offset-number at the set security macsec connectivity-association connectivity-association-name offset hierarchy level to 0, 30, or 50.
  2. Create the pre-shared key by configuring the connectivity association key name (CKN) and connectivity association key (CAK).
    Note:

    Based on your requirement you can configure the number-of-packets value at the set security macsec connectivity-association connectivity-association-name replay-protect replay-window-size hierarchy level from 0 through 65535.
  3. Set the MKA to security mode.
    Note:

    CA1 is an example of connectivity-association-name configured.
  4. Assign the configured connectivity association with a specified MACsec interface.

Configuring Static MACsec with Layer 3 Traffic

To configure Static MACsec using ICMP traffic between device R0 and device R1:

In R0:

  1. Create the preshared key by configuring the connectivity association key name (CKN) and connectivity association key (CAK)
  2. Set the trace option values.
  3. Assign the trace to an interface.
  4. Configure the MACsec security mode as static-cak for the connectivity association.
  5. Set the MKA key server priority.
  6. Set the MKA transmit interval.
  7. Enable the MKA secure.
  8. Assign the connectivity association to an interface.

In R1:

  1. Create the preshared key by configuring the connectivity association key name (CKN) and connectivity association key (CAK)

  2. Set the trace option values.

  3. Assign the trace to an interface.

  4. Configure the MACsec security mode as static-cak for the connectivity association.

  5. Set the MKA transmit interval.

  6. Enable the MKA secure.

  7. Assign the connectivity association to an interface.

Configuring MACsec with keychain using Layer 3 Traffic

Synchronize both macsec endpoint devices to NTP as both device’s time should be the same for key start time triggers. To configure MACsec with keychain using ICMP traffic between device R0 and device R1:

In R0:

  1. Assign a tolerance value to the authentication key chain.
  2. Create the secret password to use. It is a string of hexadecimal digits up to 64 characters long. The password can include spaces if the character string is enclosed in quotation marks. The keychain's secret-data is used as a CAK.

    You can configure upto 64 keys. For example, you can refer the following 4 keys:

    Use the prompt command to enter a secret key value. For example, the secret key value is 2345678922334455667788992223334123456789223344556677889922233341.

    You can configure upto 64 secret keys. For example, you can refer the following 4 secret keys:

  3. Associate the preshared keychain name with the connectivity association.
    Note:

    The cipher value can also be set as cipher-suite gcm-aes-128.
  4. Set the trace option values.
  5. Assign the trace to an interface.
  6. Configure the MACsec security mode as static-cak for the connectivity association.
  7. Set the MKA key server priority.
  8. Set the MKA transmit interval.
  9. Enable the MKA secure.
  10. Assign the connectivity association to an interface.

To configure MACsec with keychain for Layer 3 Traffic:

In R1:

  1. Assign a tolerance value to the authentication key chain.

  2. Create the secret password to use. It is a string of hexadecimal digits up to 64 characters long. The password can include spaces if the character string is enclosed in quotation marks. The keychain's secret-data is used as a CAK.

    You can configure upto 64 keys. For example, you can refer the following 4 keys:

    Use the prompt command to enter a secret key value. For example, the secret key value is 2345678922334455667788992223334123456789223344556677889922233341.

    You can configure upto 64 secret keys. For example, you can refer the following 4 secret keys:

  3. Associate the preshared keychain name with the connectivity association.

  4. Note:
    • You can use the non-XPN ciphers AES-GCM-128 and AES-GCM-256 for 10G/xe interfaces macsec configuration only.
    • You can use the XPN ciphers AES-GCM-XPN-128 and AES-GCM-XPN-256 for 40G and 100G rates macsec configuration. You can also use the XPN ciphers AES-GCM-XPN-128 and AES-GCM-XPN-256 for 10G/xe interfaces macsec configuration, if it supports.

  5. Set the trace option values.

  6. Assign the trace to an interface.

  7. Configure the MACsec security mode as static-cak for the connectivity association.

  8. Set the MKA key server priority.

  9. Set the MKA transmit interval.

  10. Enable the MKA secure.

  11. Assign the connectivity association to an interface.

Configuring Static MACsec for Layer 2 Traffic

To configure static MACsec for Layer 2 traffic between device R0 and device R1:

In R0:

  1. Set the MKA key server priority.
  2. Create the secret password to use. It is a string of hexadecimal digits up to 64 characters long. The password can include spaces if the character string is enclosed in quotation marks. The keychain's secret-data is used as a CAK.

    For example, the secret key value is 2345678922334455667788992223334123456789223344556677889922233341.

  3. Associate the preshared keychain name with the connectivity association.
  4. Set the trace option values.
  5. Assign the trace to an interface.
  6. Configure the MACsec security mode as static-cak for the connectivity association.
  7. Set the MKA key server priority.
  8. Set the MKA transmit interval.
  9. Enable the MKA secure.
  10. Assign the connectivity association to an interface.
  11. Configure VLAN tagging.

In R1:

  1. Create the secret password to use. It is a string of hexadecimal digits up to 64 characters long. The password can include spaces if the character string is enclosed in quotation marks. The keychain's secret-data is used as a CAK.

    For example, the secret key value is 2345678922334455667788992223334123456789223344556677889922233341.

  2. Associate the preshared keychain name with the connectivity association.

  3. Set the trace option values.

  4. Assign the trace to an interface.

  5. Configure the MACsec security mode as static-cak for the connectivity association.

  6. Set the MKA key server priority.

  7. Set the MKA transmit interval.

  8. Enable the MKA secure.

  9. Assign the connectivity association to an interface.

  10. Configure VLAN tagging.

Configuring MACsec with keychain for Layer 2 Traffic

Synchronize both macsec endpoint devices to NTP as both device’s time should be the same for key start time triggers. To configure MACsec with keychain for ICMP traffic between device R0 and device R1:

In R0:

  1. Assign a tolerance value to the authentication key chain.
  2. Create the secret password to use. It is a string of hexadecimal digits up to 64 characters long. The password can include spaces if the character string is enclosed in quotation marks. The keychain's secret-data is used as a CAK.

    You can configure upto 64 keys. For example, you can refer the following 4 keys:

    Use the prompt command to enter a secret key value. For example, the secret key value is 2345678922334455667788992223334123456789223344556677889922233341.

    You can configure upto 64 secret keys. For example, you can refer the following 4 secret keys:

  3. Associate the preshared keychain name with the connectivity association.
  4. Set the trace option values.
  5. Assign the trace to an interface.
  6. Configure the MACsec security mode as static-cak for the connectivity association.
  7. Set the MKA key server priority.
  8. Set the MKA transmit interval.
  9. Enable the MKA secure.
  10. Assign the connectivity association to an interface.
  11. Configure VLAN tagging.

In R1:

  1. Assign a tolerance value to the authentication key chain.

  2. Create the secret password to use. It is a string of hexadecimal digits up to 64 characters long. The password can include spaces if the character string is enclosed in quotation marks. The keychain's secret-data is used as a CAK.

    You can configure upto 64 keys. For example, you can refer the following 4 keys:

    Use the prompt command to enter a secret key value. For example, the secret key value is 2345678922334455667788992223334123456789223344556677889922233341.

    You can configure upto 64 secret keys. For example, you can refer the following 4 secret keys:

  3. Associate the preshared keychain name with the connectivity association.

  4. Set the trace option values.

  5. Assign the trace to an interface.

  6. Configure the MACsec security mode as static-cak for the connectivity association.

  7. Set the MKA key server priority.

  8. Set the MKA transmit interval.

  9. Enable the MKA secure.

  10. Assign the connectivity association to an interface.

  11. Configure VLAN tagging.

Disable and Restart MACsec Sessions

To disable and restart the MACsec sessions use the following configurations:

  • To disable the MACsec session:

  • To restart the MACsec session:

    or