Macsec Configuration Task List; Enabling Mka; Enabling Macsec Desire - HPE FlexNetwork 5510 HI Series Security Configuration Manual

MACsec configuration task list

In device-oriented mode, the MACsec configuration takes effect on Layer 2 and Layer 3 Ethernet
ports. In client-oriented mode, the MACsec configuration takes effect only on 802.1X-enabled ports.
To configure MACsec, perform the following tasks:
Tasks at a glance
(Required.)
(Optional.)

Enabling MACsec desire

(Optional.) Configuring a preshared key
(Optional.) Configuring the MKA key server priority
(Optional.) Use one of the following methods to configure MACsec
protection parameters:
•
Configuring MACsec protection parameters in interface
Configuring the MACsec confidentiality offset

Configuring MACsec replay protection

Configuring the MACsec validation mode

•
Configuring MACsec protection parameters by MKA
Configuring an MKA policy

Applying an MKA policy


Enabling MKA

MKA establishes and manages MACsec secure channels on a port. It also negotiates keys used by
MACsec.
You cannot enable MKA on a MACsec-incapable port.
To enable MKA:
Step
1. Enter system view.
2. Enter interface view.
3. Enable MKA.
Enabling MACsec desire
The MACsec desire feature expects MACsec protection for outbound frames. The key server
determines whether MACsec protects the outbound frames.
MACsec protects the outbound frames of a port when the following requirements are met:
•
The key server is MACsec capable.
•
Both the local participant and its peer are MACsec capable.
Enabling MKA
view:
policy:
Command
system-view
interface interface-type
interface-number
mka enable
465
Remarks
N/A
N/A
This task is required
device-oriented mode.
N/A
N/A
Remarks
N/A
N/A
By default, MKA is disabled on the
port.
in