Purpose
Command or Action
Creates a MACsec policy.
macsec policy name
Example:
Step 2
switch(config)# macsec policy abc
switch(config-macsec-policy)#
Configures one of the following ciphers: GCM-AES-128,
GCM-AES-256, GCM-AES-XPN-128, or
GCM-AES-XPN-256.
cipher-suite name
Example:
switch(config-macsec-policy)# cipher-suite
GCM-AES-256
Step 3
Configures the key server priority to break the tie between
peers during a key exchange. The range is from 0 (highest)
and 255 (lowest), and the default value is 16.
key-server-priority number
Example:
switch(config-macsec-policy)# key-server-priority
0
Step 4
Configures one of the following security policies to define
the handling of data and control packets:
security-policy name
Example:
Step 5
•
must-secure
—Packets not carrying MACsec headers
will be dropped.
switch(config-macsec-policy)# security-policy
should-secure
•
should-secure
—Packets not carrying MACsec
headers will be permitted. This is the default value.
Configures the replay protection window such that the
secured interface will not accept any packet that is less
window-size number
Example:
Step 6
than the configured window size. The range is from 0 to
596000000.
switch(config-macsec-policy)# window-size 512
Configures the time in seconds to force an SAK rekey.
This command can be used to change the session key to a
predictable time interval. The default is 0.
sak-expiry-time time
Example:
switch(config-macsec-policy)# sak-expiry-time 100
Step 7
Configures one of the following confidentiality offsets in
the Layer 2 frame, where encryption begins:
conf-offset name
Example:
Step 8
CONF-OFFSET-0, CONF-OFFSET-30, or
switch(config-macsec-policy)# conf-offset
CONF-OFFSET-0
CONF-OFFSET-50. This command might be necessary
for intermediate switches to use packet headers {dmac,
smac, etype} like MPLS tags.
Displays the MACsec policy configuration.
(Optional)
show macsec policy
Example:
Step 9
switch(config-macsec-policy)# show macsec policy
Copies the running configuration to the startup
configuration.
(Optional)
copy running-config startup-config
Example:
Step 10
switch(config-macsec-policy)# copy running-config
startup-config
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
510
Configuring MACsec
Configuring a MACsec Policy
