Applying An Mka Policy; Displaying And Maintaining Macsec - HPE FlexNetwork 7500 Series Security Configuration Manual

Step
3. (Optional.) Set the MACsec
confidentiality offset.
4. (Optional.) Configure
MACsec replay protection.
5. Set a MACsec validation
mode.

Applying an MKA policy

MKA policy provides a centralized method to configure MACsec confidentiality offset, replay
protection, and validation mode. An MKA policy can be applied to a port or multiple ports. When you
apply an MKA policy to a port, follow these restrictions and guidelines:
•
The MACsec parameter settings configured in the MKA policy overwrite the MACsec
parameters previously configured on the port.
•
Any modifications to the MKA policy take effect immediately.
•
When you remove an MKA policy application from the port, the MACsec parameter settings on
the port restore to the default.
•
When you apply a nonexistent MKA policy to the port, the port automatically uses the default
MKA policy. If you create the policy, the policy will be automatically applied to the port.
To apply an MKA policy to a port:
Step
1. Enter system view.
2. Enter interface view.
3. Apply an MKA policy.

Displaying and maintaining MACsec

Execute display commands in any view and reset commands in user view.
Task
Display MACsec information on ports.
Display MKA session information.
Command
macsec confidentiality-offset
offset-value
a Enable MACsec replay
protection:
replay-protection enable
b Set the replay protection
window size:
replay-protection
window-size size-value
macsec validation mode
{ check | strict }
Command
system-view
interface interface-type
interface-number
mka apply policy policy-name
Command
display macsec [ interface interface-type
interface-number ] [ verbose ]
display mka session [ interface interface-type
484
Remarks
You cannot delete or modify the
default MKA policy.
You can create multiple MKA
policies.
The default setting is 0.
MACsec uses the confidentiality
offset propagated by the key
server.
By default, MACsec replay
protection is enabled.
The default replay protection
window size is 0. Frames are
accepted only in the correct order.
The default setting is check.
Remarks
N/A
N/A
By default, no MKA policy is
applied to the port.