ExtremeSwitching 5420 MACsec Support

MACsec support is available on ExtremeSwitching 5420 series switches beginning with ExtremeXOS 31.5. MACsec is available on all ports of all models except stacking ports. The maximum number of MACsec-enabled ports per system is 48. In the case of a stacked system, each slot supports up to 48 MACsec-enabled ports.

Note

The MACsec feature requires the installation of the MAC Security feature pack license.

Protocol Exclusions

On ExtremeSwitching 5420 series switches, the MACsec protocol is mutually exclusive with other protocols. If MACsec is enabled, then the following list of protocols cannot be enabled. If any of the other protocols are enabled, then MACsec cannot be enabled:

Audio Video Bridge (AVB) - The MACsec/AVB restriction is system-wide, not per port. AVB configuration is not allowed when MACsec is enabled on any port.
Virtual Port Extender (VPEX) - VPEX configuration is not allowed when MACsec is enabled on any port.

Supported Platform

The details of this feature are specific to the ExtremeSwitching 5420 series.

Limitations

Note the following limitations with ExtremeSwitching 5420 MACsec support:

MKA and MACsec is not supported on the management port, or stacking ports when stacking-support is enabled.
ExtremeXOS restricts enabling MACsec on a given port if MACsec on the port will exceed the maximum port count of 48 per system.
If the bandwidth of MACsec-enabled ports exceeds the switch‘s maximum MACsec capacity (25Gbps, 40Gbps or 50Gbps, bidirectional), then packets will be dropped according to their QoS priority.
Hardware Assisted IPsec is not supported.
MACSec-enabled sharing ports cannot be used as a VXLAN tenant or network port.

CLI Command

To display the number of ports that have MACsec enabled and the maximum number of ports allowed per slot, use the following command:

show macsec ports usage

show macsec usage