Table of Contents
Advertisement
If you execute this command on a port to which an MKA policy has been applied, the configuration
overwrites the replay protection window size in the MKA policy. The MKA policy application is
removed from the port. However, other settings (settings for parameters except the replay protection
window size) of the MKA policy are effective on the port.
Examples
# Set the MACsec replay protection window size to 100 on GigabitEthernet 1/0/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/0/1
[Sysname-GigabitEthernet1/0/1] macsec replay-protection window-size 100
Related commands
display macsec
macsec replay-protection enable
mka apply policy
replay-protection window-size
macsec validation mode
Use macsec validation mode to set a MACsec validation mode on a port.
Use undo macsec validation mode to restore the default.
Syntax
macsec validation mode { check | strict }
undo macsec validation mode
Default
The MACsec validation mode is check on a port.
Views
Ethernet interface view
Predefined user roles
network-admin
mdc-admin
Parameters
check: Performs validation only and does not drop illegal frames.
strict: Performs validation and drops illegal frames.
Usage guidelines
To avoid data loss, use the default validation mode check on the MACsec devices in case of MKA
negotiation failure. After you use the display macsec command to verify that MKA negotiation has
succeeded, change the validation mode to strict.
If you execute this command on a port to which an MKA policy has been applied, the configuration
overwrites the validation mode in the MKA policy. The MKA policy application is removed from the
port. However, other settings (settings for parameters except the validation mode) of the MKA policy
are effective on the port.
Examples
# Set the MACsec validation mode to strict on GigabitEthernet 1/0/1.
<Sysname> system-view
680
Advertisement
Table of Contents
