Rotating Psks; About Configurable Eapol Destination And Ethernet Type; Enabling Eapol Configuration - Cisco Nexus 9000 Series Configuration Manual

Configuring MACsec

Rotating PSKs

Follow this procedure to rotate PSKs when the SAK expiry time is configured for 60 seconds in the MACsec
policy.
Step 1
Use the no sak-expiry-time command to remove the SAK expiry timer from the MACsec policy.
You need to remove the SAK expiry timer only for the number of policies in the configuration. You do not
Note
need to remove it for each interface. If you have defined only one policy and applied it to all interfaces, you
need to remove the SAK expiry timer only from this policy.
Step 2
Wait for 2 minutes.
Step 3 Use the key key-id command to program the new key under the keychain.
Step 4
Once the session with the new key is secured, use the no key key-id command to delete the old key.
Step 5 Wait for 2 minutes.
Step 6
Use the sak-expiry-timer 60 command to add the SAK rekey timer to the MACsec policy.

About Configurable EAPOL Destination and Ethernet Type

Beginning Cisco NX-OS Release 9.2(2), Cisco enables networks with WAN MACsec to change the Extensible
Authentication Protocol (EAP) over LAN (EAPOL) protocol destination address, and the Ethernet type values
to nonstandard values.
Configurable EAPOL MAC and Ethernet type provides you the ability to change the MAC address and the
Ethernet type of the MKA packet, inorder to allow CE device to form MKA sessions over the ethernet networks
that consume the standard MKA packets.
The EAPOL destination Ethernet type can be changed from the default Ethernet type of 0x888E to an alternate
value or, the EAPOL destination MAC address can be changed from the default DMAC of 01:80:C2:00:00:03
to an alternate value, to avoid being consumed by a provider bridge.
This feature is available at the interface level and the alternate EAPOL configuration can be changed on any
interface at any given time as follows:
• If the MACsec is already configured on an interface, the sessions will come up with a new alternate
• When MACsec is not configured on an interface, the EAPOL configuration is applied to the interface

Enabling EAPOL Configuration

You can enable the EAPOL configuration on any available interface.
EAPOL configuration.
and is effective when MACsec is configured on that inferface.
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
Rotating PSKs
511