Uncontrolled Ports and Controlled Ports

When MKA is enabled, two new logical interfaces are instantiated (Uncontrolled Port and Controlled Port) and stacked on top of the physical port (Common Port). The Uncontrolled Port provides insecure (unencrypted) MAC service to the Port Access Entity (PAE), which is responsible for sending and receiving MKA protocol packets (MKPDUs). The Controlled Port provides secure (encrypted) MAC service to all MAC clients which were previously attached to the Common Port (everything except the PAE). The Secure Entity (SecY) is responsible for encrypting Controlled Port traffic.

Network Access Control with MACsec and a Point-to-Point LAN (Courtesy of IEEE)

Controlled and Uncontrolled Ports names are derived from the Common Port name. Examples are shown below:

You can monitor status and statistics for both the Uncontrolled and Controlled ports using the CLI (show port status) or SNMP (MIB-II ifEntry). Status of the Uncontrolled Port mirrors that of the Common Port (when physical port is up, the uncontrolled port is up too). Status of the Controlled Port is controlled by the PAE‘s Logon Process and is a product of physical port status, of MACsec configuration, and of MKA status.

The show macsec logon command displays logon connect and port valid states:

• Pending—MKA unsuccessful or PSK not configured. Controlled Port is down, port valid is false, and all traffic dropped.
• Unauthenticated—MKA unsuccessful, but unauthAllowed is enabled. Controlled Port is up, port valid is false, and all traffic in the clear.
• Unsecured—MKA successful, but Key Server selected no MACsec. Controlled Port is up, port valid is false, and all traffic in the clear.
• Secured—MKA successful and Key Server selected MACsec. Controlled Port is up, port valid is true, and all traffic encrypted.