Macsec Applications; Macsec Operating Mechanism - HPE FlexNetwork 5510 HI Series Macsec Configuration Manual

MACsec applications

MACsec supports the following application modes:
•
Client-oriented mode—Secures data transmission between the client and the access device.
In this mode, the authentication server generates and distributes the CAK to the client and the
access device. In this mode, MACsec must operate with 802.1X authentication.
Figure 1 Client-oriented mode
NOTE:
In client-oriented mode, an MKA-enabled port on the access device must perform port-based
802.1X access control. The authentication method must be EAP relay.
•
Device-oriented mode—Secures data transmission between devices. In this mode, the
devices do not perform identity authentication, and the same preshared key must be configured
on the MACsec ports that connect the devices. The devices use the configured preshared key
as the CAK.
Figure 2 Device-oriented mode

MACsec operating mechanism

Operating mechanism for client-oriented mode
Figure 3 illustrates how MACsec operates in client-oriented mode.
3