Configure a MACsec Cipher Suite on a Port

1. Enter GigabitEthernet Interface Configuration mode:

   enable

   configure terminal

   interface GigabitEthernet {slot/port[/sub-port][-slot/port[/sub-port]][,...]}

   

   Note

   If the platform supports channelization and the port is channelized, you must also specify the sub-port in the format slot/port/sub-port.

2. Configure a MACsec encryption cipher suite:

   macsec cipher-suite {gcm-aes-128 | gcm-aes-256}

   The default cipher suite is GCM-AES-128.

   Ensure that you configure the same cipher suite on both MACsec peers.

3. Verify the configuration:

   show macsec status {slot/port[/sub-port] [-slot/port[/sub-port]] [,...]}

Example

Configure the 256–bit MACsec cipher suite on the port 1/3 and verify the configuration.

Switch:1>enable
Switch:1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch:1(config)#interface gigabitEthernet 1/3
Switch:1(config-if)#macsec cipher-suite gcm-aes-256

Switch:1#show macsec status 1/3

==========================================================================================================================
                                                    MACSEC Port Status
==========================================================================================================================
         MACSEC     Encryption  Replay      Replay        Encryption       Cipher     CA       MKA-Profile      MKA Connect
PortId   Status     Status      Protect     Protect W'dow   Offset         Suite      Name     Name             Status
--------------------------------------------------------------------------------------------------------------------------
1/3     enabled     disabled    enabled     50        ipv4Offset(30)  AES-256   mkanka   extreme           pending

The system displays the following error message if you attempt to configure a cipher suite on a port that is not MACsec capable.

Switch:1>enable
Switch:1(config)#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch:1(config)#interface gigabitEthernet 1/2 
Switch:1(config-if)#macsec cipher suite gcm-aes-256 

Error: port 1/2, Port is not MACSec capable. No MACSec configurations allowed on port

The system displays the following error message if your hardware does not support the MACsec 256-bit cipher suite.

Switch:1>enable
Switch:1(config)#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Switch:1(config)#interface gigabitEthernet 5/1   
Switch:1(config-if)#macsec cipher-suite gcm-aes-256 

Error: port 5/1, MACSec cipher-suite cannot be modified on port. Cipher-suite is by default AES-128