Configure MACsec in FIPS Mode
Learn to configure MACsec in FIPS mode.
Configure MACsec on Your Device in FIPS Mode
You can configure MACsec to secure point-to-point Ethernet links by connecting your device with MACsec-capable Modular Interface Cards (MICs). You must separately configure each point-to-point Ethernet link that you want to secure with MACsec. You can enable MACsec on device-to-device links using static connectivity association key (CAK) security mode.
You can configure different interface rates such as 10Gbps, 40Gbps, and 100Gbps in port mode and specific interface rates such as 10Gbps, 40Gbps, and 100Gbps in PIC mode. In PIC mode you can configure only one type of interface speed.
To configure MACsec on your device with Junos OS:
Configure Static MACsec for Layer 3 Traffic
To configure static MACsec for Layer 3 traffic between two devices R0 and R1:
In R0:
In R1:
Create the preshared key by configuring the CKN and the CAK.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 pre-shared-key ckn 2345678922334455667788992223334445556667778889992222333344445555 security-administrator@host:fips# prompt security macsec connectivity-association CA1 pre-shared-key cak New cak (secret): Retype new cak (secret): security-administrator@host:fips# set security macsec connectivity-association CA1 offset 30
Set the trace option values.
[edit] security-administrator@host:fips# set security macsec traceoptions file MACsec.log security-administrator@host:fips# set security macsec traceoptions file size 4000000000 security-administrator@host:fips# set security macsec traceoptions flag all
Assign the trace to an interface.
[edit] security-administrator@host:fips# set security macsec interfaces interface-name traceoptions file mka_xe size 1g security-administrator@host:fips# set security macsec interfaces interface-name traceoptions flag all
Configure the MACsec security mode as
static-cakfor the connectivity association.[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 security-mode static-cak
Set the MKA transmit interval.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 mka transmit-interval 3000
Enable the MKA secure channel.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 include-sci
Assign the connectivity association to an interface.
[edit] security-administrator@host:fips# set security macsec interfaces interface-name connectivity-association CA1 security-administrator@host:fips# set interfaces interface-name unit 0 family inet address 10.1.1.2/24
Configure MACsec with Keychain for Layer 3 Traffic
Synchronize both MACsec endpoint devices to NTP, as the time set for key start-time trigger must be the same on both the devices. To configure MACsec with keychain for Layer 3 traffic between devices R0 and R1:
In R0:
Configure MACsec with a keychain for Layer 3 traffic with the following steps.
In R1:
Assign a tolerance value to the authentication keychain.
[edit] security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 tolerance 20
-
Create a secret password. It is a string of hexadecimal digits with up to 64 characters. The password can include spaces if the character string is enclosed in quotation marks. The keychain's secret data is used as a CAK.
You can configure up to 64 keys. See the following sample secret keys for reference:
[edit] security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 0 key-name 2345678922334455667788992223334445556667778889992222333344445551 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 0 start-time 2018-03-20.20:35 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 1 key-name 2345678922334455667788992223334445556667778889992222333344445552 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 1 start-time 2018-03-20.20:37 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 2 key-name 2345678922334455667788992223334445556667778889992222333344445553 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 2 start-time 2018-03-20.20:39 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 3 key-name 2345678922334455667788992223334445556667778889992222333344445554 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 3 start-time 2018-03-20.20:41 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 4 key-name 2345678922334455667788992223334445556667778889992222333344445555 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 4 start-time 2018-03-20.20:43
Use the
promptcommand to enter a secret key value. For example, the secret key value is 2345678922334455667788992223334123456789223344556677889922233341.You can configure up to 64 secret keys. See the following sample secret keys for reference:
[edit] security-administrator@host:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 0 secret New cak (secret): Retype new cak (secret): security-administrator@host:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 1 secret New cak (secret): Retype new cak (secret): security-administrator@host:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 2 secret New cak (secret): Retype new cak (secret): security-administrator@host:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 3 secret New cak (secret): Retype new cak (secret): security-administrator@host:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 4 secret New cak (secret): Retype new cak (secret):
Associate the preshared keychain name with the connectivity association.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 pre-shared-key-chain macsec-kc1 security-administrator@host:fips# set security macsec connectivity-association CA1 offset 50 security-administrator@host:fips# set security macsec connectivity-association CA1 cipher-suite gcm-aes-256
-
Note:
- You can use the non-XPN ciphers
AES-GCM-128andAES-GCM-256for 10Gbps or xe interfaces MACsec configuration only. - You can use the XPN ciphers
AES-GCM-XPN-128andAES-GCM-XPN-256for 40Gbps and 100Gbps rates MACsec configuration. You can also use the XPN ciphersAES-GCM-XPN-128andAES-GCM-XPN-256for 10Gbps or xe interfaces MACsec configuration, if it supports.
- You can use the non-XPN ciphers
Set the trace option values.
[edit] security-administrator@host:fips# set security macsec traceoptions file MACsec.log security-administrator@host:fips# set security macsec traceoptions file size 4000000000 security-administrator@host:fips# set security macsec traceoptions flag all
Assign the trace to an interface.
[edit] security-administrator@host:fips# set security macsec interfaces interface-name traceoptions file mka_xe size 1g security-administrator@host:fips# set security macsec interfaces interface-name traceoptions flag all
Configure the MACsec security mode as
static-cakfor the connectivity association.[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 security-mode static-cak
Set the MKA key server priority.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 mka key-server-priority 1
Set the MKA transmit interval.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 mka transmit-interval 3000
Enable the MKA secure channel.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 include-sci
Assign the connectivity association to an interface.
[edit] security-administrator@host:fips# set security macsec interfaces interface-name connectivity-association CA1 security-administrator@host:fips# set interfaces interface-name unit 0 family inet address 10.1.1.2/24
Configure Static MACsec for Layer 2 Traffic
To configure static MACsec for Layer 2 traffic between the devices R0 and R1:
In R0:
In R1:
Create the secret password to use. It is a string of hexadecimal digits with up to 64 characters. The password can include spaces if the character string is enclosed in quotation marks. The keychain's secretc data is used as a CAK.
[edit] security-administrator@host:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 0 secret New cak (secret): Retype new cak (secret):
For example, the secret key value can be set as 2345678922334455667788992223334123456789223344556677889922233341.
Associate the preshared keychain name with the connectivity association.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 pre-shared-key-chain macsec-kc1 security-administrator@host:fips# set security macsec connectivity-association CA1 offset 50 security-administrator@host:fips# set security macsec connectivity-association CA1 cipher-suite gcm-aes-256
Set the trace option values.
[edit] security-administrator@host:fips# set security macsec traceoptions file MACsec.log security-administrator@host:fips# set security macsec traceoptions file size 4000000000 security-administrator@host:fips# set security macsec traceoptions flag all
Assign the trace to an interface.
[edit] security-administrator@host:fips# set security macsec interfaces interface-name traceoptions file mka_xe size 1g security-administrator@host:fips# set security macsec interfaces interface-name traceoptions flag all
Configure the MACsec security mode as
static-cakfor the connectivity association.[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 security-mode static-cak
Set the MKA key server priority.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 mka key-server-priority 1
Set the MKA transmit interval.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 mka transmit-interval 3000
Enable the MKA secure channel.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 include-sci
Assign the connectivity association to an interface.
[edit] security-administrator@host:fips# set security macsec interfaces interface-name connectivity-association CA1
Configure VLAN tagging.
[edit] security-administrator@host:fips# set interfaces interface-name1 flexible-vlan-tagging security-administrator@host:fips# set interfaces interface-name1 encapsulation flexible-ethernet-services security-administrator@host:fips# set interfaces interface-name1 unit 100 encapsulation vlan-bridge security-administrator@host:fips# set interfaces interface-name1 unit 100 vlan-id 100 security-administrator@host:fips# set interfaces interface-name2 flexible-vlan-tagging security-administrator@host:fips# set interfaces interface-name2 encapsulation flexible-ethernet-services security-administrator@host:fips# set interfaces interface-name2 unit 100 encapsulation vlan-bridge security-administrator@host:fips# set interfaces interface-name2 unit 100 vlan-id 100
Configure a bridge domain.
[edit] security-administrator@host:fips# set bridge-domains BD-110 domain-type bridge security-administrator@host:fips# set bridge-domains BD-110 vlan-id 100 security-administrator@host:fips# set bridge-domains BD-110 interface interface-name1 100 security-administrator@host:fips# set bridge-domains BD-110 interface interface-name2 100
Configure MACsec with Keychain for Layer 2 Traffic
Synchronize both MACsec endpoint devices to NTP, as the time set for key start time trigger must be the same on both the devices. To configure MACsec with keychain for Layer 3 traffic between the device R0 and R1:
In R0:
In R1:
Assign a tolerance value to the authentication key chain.
[edit] security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 tolerance 20
-
Create a secret password. It is a string of hexadecimal digits with up to 64 characters. The password can include spaces if the character string is enclosed in quotation marks. The keychain's secret-data is used as a CAK.
[edit] security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 0 key-name 2345678922334455667788992223334445556667778889992222333344445551 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 0 start-time 2018-03-20.20:35 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 1 key-name 2345678922334455667788992223334445556667778889992222333344445552 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 1 start-time 2018-03-20.20:37 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 2 key-name 2345678922334455667788992223334445556667778889992222333344445553 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 2 start-time 2018-03-20.20:39 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 3 key-name 2345678922334455667788992223334445556667778889992222333344445554 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 3 start-time 2018-03-20.20:41 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 4 key-name 2345678922334455667788992223334445556667778889992222333344445555 security-administrator@host:fips# set security authentication-key-chains key-chain macsec-kc1 key 4 start-time 2018-03-20.20:43
Use the
promptcommand to enter a secret key value. For example, the secret key value can be set as 2345678922334455667788992223334123456789223344556677889922233341.You can configure up to 64 secret keys. See the following sample secret keys for reference:
[edit] security-administrator@host:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 0 secret New cak (secret): Retype new cak (secret): security-administrator@host:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 1 secret New cak (secret): Retype new cak (secret): security-administrator@host:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 2 secret New cak (secret): Retype new cak (secret): security-administrator@host:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 3 secret New cak (secret): Retype new cak (secret): security-administrator@host:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 4 secret New cak (secret): Retype new cak (secret):
Associate the preshared keychain name with the connectivity association.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 pre-shared-key-chain macsec-kc1 security-administrator@host:fips# set security macsec connectivity-association CA1 cipher-suite gcm-aes-256
Set the trace option values.
[edit] security-administrator@host:fips# set security macsec traceoptions file MACsec.log security-administrator@host:fips# set security macsec traceoptions file size 4000000000 security-administrator@host:fips# set security macsec traceoptions flag all
Assign the trace to an interface.
[edit] security-administrator@host:fips# set security macsec interfaces interface-name traceoptions file mka_xe size 1g security-administrator@host:fips# set security macsec interfaces interface-name traceoptions flag all
Configure the MACsec security mode as
static-cakfor the connectivity association.[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 security-mode static-cak
Set the MKA key server priority.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 mka key-server-priority 1
Set the MKA transmit interval.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 mka transmit-interval 3000
Enable the MKA secure channel.
[edit] security-administrator@host:fips# set security macsec connectivity-association CA1 include-sci
Assign the connectivity association to an interface.
[edit] security-administrator@host:fips# set security macsec interfaces interface-name connectivity-association CA1
Configure VLAN tagging.
[edit] security-administrator@host:fips# set interfaces interface-name1 flexible-vlan-tagging security-administrator@host:fips# set interfaces interface-name1 encapsulation flexible-ethernet-services security-administrator@host:fips# set interfaces interface-name1 unit 100 encapsulation vlan-bridge security-administrator@host:fips# set interfaces interface-name1 unit 100 vlan-id 100 security-administrator@host:fips# set interfaces interface-name2 flexible-vlan-tagging security-administrator@host:fips# set interfaces interface-name2 encapsulation flexible-ethernet-services security-administrator@host:fips# set interfaces interface-name2 unit 100 encapsulation vlan-bridge security-administrator@host:fips# set interfaces interface-name2 unit 100 vlan-id 100
Configure bridge domain.
[edit] security-administrator@host:fips# set bridge-domains BD-110 domain-type bridge security-administrator@host:fips# set bridge-domains BD-110 vlan-id 100 security-administrator@host:fips# set bridge-domains BD-110 interface interface-name1 100 security-administrator@host:fips# set bridge-domains BD-110 interface interface-name2 100