Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Media Access Control Security (MACsec) on Chassis Cluster

This topic explains how Media Access Control Security (MACsec), an industry‑standard security technology, that provides secure communication for all traffic on Ethernet links.

Use Feature Explorer to confirm platform and release support for specific features.

Review the Platform-Specific MACsec Behavior section for notes related to your platform.

Understand Media Access Control Security (MACsec)

Media Access Control Security (MACsec) is an industry-standard security technology that provides secure communication for all traffic on Ethernet links. MACsec delivers point-to-point security between directly connected nodes and helps protect against a wide range of threats, including denial-of-service attacks, intrusions, man-in-the-middle attacks, masquerading, passive eavesdropping, and replay attacks.

MACsec secures nearly all Ethernet traffic, including frames generated by protocols such as Link Layer Discovery Protocol (LLDP), Link Aggregation Control Protocol (LACP), Dynamic Host Configuration Protocol (DHCP), Address Resolution Protocol (ARP), and other protocols that are typically unsecured by traditional Ethernet security mechanisms. MACsec can also be used alongside other security technologies, such as IP Security (IPsec) and Secure Sockets Layer (SSL), to provide comprehensive end-to-end network security.

How MACsec Works

MACsec provides industry-standard security by establishing secure point-to-point Ethernet links. These links are secured after the participating interfaces successfully authenticate using matching security keys. When MACsec is enabled in static connectivity association key (CAK) mode, user-configured pre-shared keys are exchanged and verified between the interfaces at each end of the point-to-point Ethernet link.

Once MACsec is enabled on a point-to-point Ethernet link, all traffic traversing the link is protected using data integrity checks and, if configured, encryption.

MACsec ensures data integrity by appending an 8-byte header and a 16-byte trailer to each Ethernet frame transmitted over the secured link.The receiving interface validates this header and trailer to verify that the data was not altered in transit. If any integrity violation is detected, the affected traffic is dropped.

MACsec can also encrypt all traffic on the Ethernet link, preventing unauthorized parties from viewing frame contents. When MACsec is enabled using static Connectivity Association Key (CAK) mode, encryption is enabled by default for all ingress and egress traffic on the interface.

MACsec is configured on point-to-point Ethernet links between MACsec-capable interfaces. To secure multiple Ethernet links, you must configure MACsec individually on each point-to-point link.

Connectivity Associations and Secure Channels

MACsec is configured using connectivity associations (CAs). MACsec is enabled on an interface when a connectivity association is assigned to that interface.

When MACsec is enabled using either static CAK or dynamic security mode, you must create and configure a connectivity association. Upon assignment, two secure channels are automatically created: one for inbound traffic and one for outbound traffic. These secure channels do not have user-configurable parameters; all configuration is performed within the connectivity association rather than on the secure channels themselves.

Static Connectivity Association Key Security Mode

When MACsec is enabled using static connectivity association key (CAK) security mode, two keys are used to secure the point-to-point Ethernet link:a Connectivity Association Key (CAK), which protects control‑plane traffic, and a Secure Association Key (SAK), which is randomly generated and protects data‑plane traffic. Both keys are periodically exchanged between the devices at each end of the link to maintain link security.

In static CAK mode, a MACsec-secured link is initially established using a user-configured pre-shared key. The pre-shared key consists of a Connectivity Association Name (CKN) and its associated CAK. Both the CKN and CAK must be configured in the connectivity association and must match on both ends of the Ethernet link for MACsec to be successfully enabled.

Once matching pre-shared keys are successfully exchanged, the MACsec Key Agreement (MKA) protocol is activated. MKA is responsible for maintaining MACsec operation on the link and determining which device on the point-to-point Ethernet link becomes the key server.

The key server generates a Secure Association Key (SAK) and securely distributes it only to the peer device at the other end of the link., This SAK is then used to protect all data traffic traversing the link. As long as MACsec remains enabled, the key server periodically generates and shares new, randomly created SAKs to maintain ongoing link security.

You enable MACsec in static CAK security mode by configuring a connectivity association on both ends of the point‑to‑point Ethernet link. All MACsec configuration is performed within the connectivity association and not on the secure channels themselves. When static CAK mode is used, two secure channels—one for inbound traffic and one for outbound traffic—are automatically created. These secure channels have no user-configurable parameters beyond those defined in the connectivity association.

We recommend enabling MACsec using static CAK security mode. Static CAK mode enhances security by periodically refreshing randomly generated security keys and by restricting key sharing exclusively to the two devices on the MACsec-secured point-to-point link. In addition, certain optional MACsec features—such as replay protection, Secure Channel Identifier (SCI) tagging, and the ability to exclude specific traffic from MACsec protection—are available only when MACsec is enabled in static CAK mode.

Firewalls support MACsec on HA control and fabric links. However, if the restart 802.1x-protocol-daemon command is executed on the primary node, the chassis cluster control and fabric links will flap, potentially causing the cluster nodes to enter a split-brain condition.

MACsec Considerations

All types of Spanning Tree Protocol (STP) frames are not currently supported for encryption using MACsec.

A connectivity association can be defined globally, at the node level, or within any configuration group, provided it is visible to the MACsec interface configuration.

For MACsecto operate correctly, identical configurations must be present on both ends of the link. Each node must have the same MACsec configuration.If MACsec is not configured, or is configured incorrectly, on the peer node, the interface is disabled and traffic forwarding stops.

Configure Media Access Control Security (MACsec)

This topic shows how to configure MACsec on control and fabric ports of supported Firewalls operating in a chassis cluster to secure point-to-point Ethernet links between peer devices. Each point-to-point Ethernet link that requires MACsec protection must be configured independently. MACsec encryption on device-to-device links is enabled using static connectivity association key (CAK) security mode.

This document provides the configuration steps for both processes.

Configuration Considerations When Configuring MACsec on Chassis Cluster Setup

Before you begin, follow these steps to configure MACsec on control ports:

  1. If the chassis cluster is already operational, disable it by running the following command set chassis cluster disable on both nodes.

    Reboot both nodes.

  2. Configure MACsec on the control ports with the required attributes, as described in the following sections. Configure Static CAK on the Chassis Cluster Control Port. Ensure that both nodes are configured independently and that the MACsec configuration is identical on both nodes.
  3. Reenable the chassis cluster by configuring the set chassis cluster cluster-id id on both nodes.

    Reboot both nodes to apply the configuration.

Control port states are critical to the stability and integrity of a chassis cluster. Consider the following when configuring MACsec on control ports:

  • Any new MACsec configuration for chassis cluster ports, or any modification to an existing MACsec configuration, requires the chassis cluster to be disabled. When you attempt such a change, a warning message Modifying cluster control port CA will break chassis cluster is displayed indicating that modifying the control port connectivity association (CA) will disrupt the chassis cluster. After disabling the cluster, you can apply the required MACsec configuration and then reenable the chassis cluster.

  • By default, a chassis cluster synchronizes all configurations between nodes. You must ensure that configuration synchronization does not result in the loss of any MACsec settings. For node-specific or nonsymmetric MACsec configurations, identical MACsec configurations must exist on both nodes. If the configurations differ, the chassis clsuter can break.

Any change to MACsec configuration on control ports requires repeating the previously described steps.

When configuring MACsec on fabric ports, consider the following:

  • Configuring MACsec can cause link state changes that affect traffic forwarding. When configuring fabric ports, always account for the effective link state.

  • An incorrect MACsec configuration on either end of a fabric link can cause the link to transition to an ineligible state.

  • Both ends of the fabric links must be configured simultaneously when the chassis cluster is formed.

  • Incorrect configuration can lead to fabric link failures and errors in fabric recovery logic.

    Due to the potential for link failure scenarios, it is recommend to configure fabric links during the initial formation of the chassis cluster.

Configure MACsec Using Static Connectivity Association Key Security Mode

You can enable MACsec encryption on a point-to-point Ethernet link by using static connectivity association key (CAK) security mode. This procedure explains how to configure MACsec using static CAK mode.

In a chassis cluster with dual control links, MACsec is configured on control port 0 [em0] and control port 1 [em1]. MACsec configured on revenue interfaces is used to establish fabric links, which are configured on fabric ports mge-0/0/1 and mge-7/0/1.

To configure MACsec by using static CAK security mode to secure a device-to-device Ethernet link:

  1. Create a connectivity association. You can skip this step if you are configuring an existing connectivity association.

    For instance, to create a connectivity association named ca1, enter:

  2. Configure the MACsec security mode as static-cak for the connectivity association.

    For instance, to configure the MACsec security mode to static-cak on connectivity association ca1:

  3. Create the preshared key by configuring the connectivity association key name (CKN) and connectivity association key (CAK).

    A preshared key is exchanged between directly-connected links to establish a MACsec-secure link. The pre-shared-key includes the CKN and the CAK. The CKN is a 64-digit hexadecimal number and the CAK is a 64-digit hexadecimal number. The CKN and the CAK must match on both ends of a link to create a MACsec-secured link.

    To maximize security, we recommend configuring all 64 digits of a CKN and all 64 digits of a CAK.

    After the preshared keys are successfully exchanged and verified by both ends of the link, the MACsec Key Agreement (MKA) protocol is enabled and manages the secure link. The MKA protocol then elects one of the two directly-connected devices as the key server. The key server then shares a random security with the other device over the MACsec-secure point-to-point link. The key server will continue to periodically create and share a random security key with the other device over the MACsec-secured point-to-point link as long as MACsec is enabled.

    To configure a CKN of 11c1c1c11xxx012xx5xx8ef284aa23ff6729xx2e4xxx66e91fe34ba2cd9fe311 and CAK of 228xx255aa23xx6729xx664xxx66e91f on connectivity association ca1:

    MACsec is not enabled until a connectivity association is attached to an interface. See the final step of this procedure to attach a connectivity association to an interface.

  4. (Optional) Set the MKA key server priority.

    Specifies the key server priority used by the MKA protocol to select the key server. The device with the lower priority-number is selected as the key server.

    The default priority-number is 16.

    If the key-server-priority is identical on both sides of the point-to-point link, the MKA protocol selects the interface with the lower MAC address as the key server. Therefore, if this statement is not configured in the connectivity associations at each end of a MACsec-secured point-to-point link, the interface with the lower MAC address becomes the key server.

    To change the key server priority to 0 to increase the likelihood that the current device is selected as the key server when MACsec is enabled on the interface using connectivity association ca1:

    To change the key server priority to 255 to decrease the likelihood that the current device is selected as the key server in connectivity association ca1:

  5. (Optional) Set the MKA transmit interval.

    The MKA transmit interval setting sets the frequency for how often the MKA protocol data unit (PDU) is sent to the directly connected device to maintain MACsec connectivity on the link. A lower interval increases bandwidth overhead on the link; a higher interval optimizes MKA protocol communication.

    The default interval is 2000 milliseconds. We recommend increasing the interval to 6000 ms in high-traffic load environments. The transmit interval settings must be identical on both ends of the link when MACsec using static CAK security mode is enabled.

    For SRX340, SRX345, SRX4600 Firewalls, the default MKA transmit interval is 10000 ms on HA links.

    For instance, if you wanted to increase the MKA transmit interval to 6000 milliseconds when connectivity association ca1 is attached to an interface:

  6. (Optional) Disable MACsec encryption.

    Encryption is enabled for all traffic entering or leaving the interface when MACsec is enabled using static CAK security mode, by default.

    When encryption is disabled, traffic is forwarded across the Ethernet link in clear text. You are able to view unencrypted data in the Ethernet frame traversing the link when you are monitoring it. The MACsec header is still applied to the frame, however, and all MACsec data integrity checks are run on both ends of the link to ensure the traffic sent or received on the link has not been tampered with and does not represent a security threat.

  7. (Optional) Set an offset for all packets traversing the link.

    For instance, if you wanted to set the offset to 30 in the connectivity association named ca1:

    The default offset is 0. All traffic in the connectivity association is encrypted when encryption is enabled and an offset is not set.

    When the offset is set to 30, the IPv4 header and the TCP/UDP header are unencrypted while encrypting the rest of the traffic. When the offset is set to 50, the IPv6 header and the TCP/UDP header are unencrypted while encrypting the rest of the traffic.

    You would typically forward traffic with the first 30 or 50 octets unencrypted if a feature needed to see the data in the octets to perform a function, but you otherwise prefer to encrypt the remaining data in the frames traversing the link. Load balancing features, in particular, typically need to see the IP and TCP/UDP headers in the first 30 or 50 octets to properly load balance traffic.

  8. (Optional) Enable replay protection.

    When MACsec is enabled on a link, an ID number is assigned to each packet on the MACsec-secured link.

    When replay protection is enabled, the receiving interface checks the ID number of all packets that have traversed the MACsec-secured link. If a packet arrives out of sequence and the difference between the packet numbers exceeds the replay protection window size, the packet is dropped by the receiving interface. For instance, if the replay protection window size is set to five and a packet assigned the ID of 1006 arrives on the receiving link immediately after the packet assigned the ID of 1000, the packet that is assigned the ID of 1006 is dropped because it falls outside the parameters of the replay protection window.

    Replay protection is especially useful for fighting man-in-the-middle attacks. A packet that is replayed by a man-in-the-middle attacker on the Ethernet link will arrive on the receiving link out of sequence, so replay protection helps ensure the replayed packet is dropped instead of forwarded through the network.

    Replay protection should not be enabled in cases where packets are expected to arrive out of order.

    You can require that all packets arrive in order by setting the replay window size to 0.

    To enable replay protection with a window size of five on connectivity association ca1:

  9. (Optional) Exclude a protocol from MACsec.

    For instance, if you did not want Link Level Discovery Protocol (LLDP) to be secured using MACsec:

    When this option is enabled, MACsec is disabled for all packets of the specified protocol—in this case, LLDP—that are sent or received on the link.

  10. Assign the connectivity association to a chassis cluster control interface.

    Assigning the connectivity association to an interface is the final configuration step for enabling MACsec on an interface.

    For instance, to assign connectivity association ca1 to interface ge-0/0/1 (For SRX340 or SRX345 or to interface ge-0/0/0 for SRX380):

  11. Assign a connectivity association for enabling MACsec on a chassis cluster fabric interface.

MACsec using static CAK security mode is not enabled until a connectivity association on the opposite end of the link is also configured, and contains preshared keys that match on both ends of the link.

Configure Static CAK on the Chassis Cluster Control Port

To establish a CA over a chassis cluster control link on two SRX345 devices.

  1. Configure the MACsec security mode as static-cak for the connectivity association:
  2. Create the preshared key by configuring the connectivity association key name (CKN).

    The CKN must be an even-length string up to 64 hexadecimal characters (0-9, a-f, A-F).

  3. Create the pre-shared key by configuring the connectivity association key (CAK).

    The CAK must contain 64 hexadecimal characters (0-9, a-f, A-F).

  4. Specify chassis cluster control ports for the connectivity association.

Configure Static CAK on the Chassis Cluster Fabric Port

To establish a connectivity association over a chassis cluster fabric link on two SRX345 devices:

  1. Configure the MACsec security mode as static-cak for the connectivity association.
  2. Create the preshared key by configuring the connectivity association key name (CKN).

    The CKN must be an even-length string up to 64 hexadecimal characters (0-9, a-f, A-F).

  3. Create the preshared key by configuring the connectivity association key (CAK).

    The CAK must contain 64 hexadecimal characters (0-9, a-f, A-F).

  4. Specify a chassis cluster fabric ports to a connectivity association.

Configure Static CAK on the Control Port

Configure a connectivity association over a chassis cluster control link. Use two SRX1600 Firewalls, two SRX2300 Firewalls, two SRX4120 Firewalls or two SRX4300 Firewalls.

  1. Configure the MACsec security mode as static-cak for the connectivity association.
  2. Create the preshared key by configuring the connectivity association key name (CKN).

    The CKN must be an even-length string up to 64 hexadecimal characters (0-9, a-f, A-F).

  3. Create the preshared key by configuring the connectivity association key (CAK).

    The CAK must contain 64 hexadecimal characters (0-9, a-f, A-F).

  4. Specify a chassis cluster control port for the connectivity association.

To view the status of the active MACsec connections, run the show security macsec connections command.

To view the MACsec key agreement session information, run the show security mka sessions command.

To view the security status of control and fabric ports. MACsec is enabled for both control port 0 and control port 1, run the show chassis cluster interfaces command.

Configure Static CAK on the Control Port on SRX4600

To configure a CA over a chassis cluster control link on two SRX4600 Firewalls.

  1. Configure the MACsec security mode as static-cak for the connectivity association:
  2. Create the preshared key by configuring the connectivity association key name (CKN).

    The CKN must be an even-length string up to 64 hexadecimal characters (0-9, a-f, A-F).

  3. Create the preshared key by configuring the connectivity association key (CAK).

    The CAK must contain 64 hexadecimal characters (0-9, a-f, A-F).

  4. Specify a chassis cluster control port for the connectivity association.

Verify MACSEC Configuration

To confirm that the configuration provided in Configure Static CAK on the Control Port on SRX4600 is working properly, perform these tasks:

Display the Status of Active MACsec Connections on the Device

Purpose

Verify that MACsec is operational on the chassis cluster setup.

Action

From the operational mode, enter the show security macsec connections interface interface-name command on one or both of the nodes of chassis cluster setup.

Meaning

The Interface name and CA name outputs show that the MACsec connectivity association is operational on the interface em0. The output does not appear when the connectivity association is not operational on the interface.

Display MACsec Key Agreement (MKA) Session Information

Purpose

Display MACsec Key Agreement (MKA) session information for all interfaces.

Action

From the operational mode, enter the show security mka sessions command.

Meaning

The outputs show the status of MKA sessions.

Verify the MACsec-Secured Traffic Is Traversing Through the Interface

Purpose

Verify that traffic traversing through the interface is MACsec-secured.

Action

From the operational mode, enter the show security macsec statistics command.

Meaning

The Encrypted packets line under the Secure Channel transmitted field are the values incremented each time a packet is sent from the interface that is secured and encrypted by MACsec.

The Accepted packets line under the Secure Association received field are the values incremented each time a packet that has passed the MACsec integrity check is received on the interface. The Decrypted bytes line under the Secure Association received output is incremented each time an encrypted packet is received and decrypted.

Verify Chassis Cluster Ports Are Secured with MACsec Configuration

Purpose

Verify that MACsec is configured on chassis cluster ports.

Action

From operational mode, enter the show chassis cluster interfaces command.

Meaning

The Security line under the Control interfaces output for em0 interface shown as Secured means that the traffic sent from the em0 interface is secured and encrypted by MACsec.

You can also use the show chassis cluster status command to display the current status of the chassis cluster.

See Also

Platform-Specific MACsec Behavior

Use Feature Explorer to confirm platform and release support for specific features.

Use the following table to review platform-specific behaviors for your platform.

Platform

Difference

SRX Series

  • SRX340, SRX345, and SRX380 Firewalls that support MACsec have a 300 seconds ineligible timer when MACsec is enabled on the chassis cluster control port. If both control links fail, Junos OS changes the secondary node's operating state to ineligible for 180 seconds.

  • SRX4600 Firewalls that support MACsec on the control port, the ineligibility duration is 200 seconds.

  • SRX340, SRX345, and SRX380 Firewalls that support MACsec set the initial hold timer to 120 seconds instead of 30 seconds.

  • SRX340 and SRX345 Firewalls that support MACsec use the following ports:

    • ge-0/0/0 is a fabric port

    • ge-0/0/1 is a control port for the chassis cluster.

      The chassis cluster assigns ge-0/0/1 as cluster-control-port 0.

  • SRX380 Firewall supports MACsec. Place each node in standalone mode before configuring MACsec on the cluster-control-port and cluster-data-port. Apply MACsec on both nodes, then reboot them to chassis cluster mode.

  • SRX380 Firewall that support MACsec uses ge-0/0/0 as a fabric port. Interface ge-0/0/15 serves as a control port for the chassis cluster.

  • SRX4600 Firewalls that support MACsec includes dedicated control and fabric ports. Configure MACsec on control links with dedicated control port 0 [em0] and port 1 [em1]. Configure MACsec on fabric links on dedicated fabric ports:

    • Port 2 and Port 3 of fpc0 pic0 (e.g. xe-0/0/2 and xe-0/0/3)

    • Port 2 and Port 3 of fpc7 pic0

  • SRX1600 Firewall that support MACsec includes dedicated dual control ports (em0/em1) , and provides dual fabric ports.

  • SRX2300 and SRX4120 Firewalls that support MACsec includes dual control ports (em0/em1), and provides dual fabric ports.

  • SRX340 and SRX345 Firewalls support MACsec on control and fabric ports in chassis cluster mode.

  • SRX340, SRX345, and SRX380 Firewalls support host-to-host or switch-to-host MACsec.

  • SRX4600 Firewall does not support MACsec for host-to-host connections. Only dedicated fab ports support MACsec. The Firewall does not allow MACsec if any other traffic port serves as fab.

  • SRX340, SRX345, and SRX380 Firewalls that support MACsec require local MACsec configurations on each node. Otherwise, these Firewalls cannot reach the fabric link.

  • SRX1600, SRX2300, SRX4120, and SRX4300 Firewalls that support MACsec can use dual control ports under a MACsec configuration.

Related Documentation

Change History Table

Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.

Release
Description
20.1
Starting in Junos OS Release 20.1R1, MACsec is supported on control ports, fabric ports and revenue ports of SRX380 devices in chassis cluster mode to secure the traffic. MACsec is supported on 16X1Gigabit Ethernet ports (ge-0/0/0 to ge-0/0/15) and 4X10Gigabit Ethernet ports (xe-0/0/16 to xe-0/0/19).