Protected link configuration

Define the link and success criteria

R1 and R2 use their supported Te1/0/1 ports as an access link in VLAN 100. Each has an SVI in that VLAN: R1 is 192.0.2.1/30 and R2 is 192.0.2.2/30. These documentation addresses allow a local test without a routing protocol. The devices must support the SVI and physical-port features shown; the labels R1/R2 describe their roles.

Read the prerequisites lesson first. Use console or a separate management path, a dedicated VLAN and a scheduled maintenance window. Success means matching peer identity, a secured MKA session, the intended cipher and mandatory-protection policy, and increasing encrypted/validated traffic counters in both directions.

The first stage establishes an unprotected baseline on the controlled study link. Do not perform that stage on a path whose policy already requires encryption. In that case prepare the VLAN and addresses with the port shut, then enable it only after protection is configured.

Prepare the common Layer 2 baseline

Apply this common baseline to both devices, keeping any reviewed management/AAA policy. A switch-to-switch access link does not need PortFast; allow normal spanning-tree convergence and verify forwarding.

configure terminal
vlan 100
 name MACSEC-STUDY
exit
interface TenGigabitEthernet1/0/1
 switchport
 switchport mode access
 switchport access vlan 100
 flowcontrol receive desired
 no shutdown
exit
interface Vlan100
 no shutdown
end

Assign one SVI address per device. Do not paste both address blocks into one device.

configure terminal
interface Vlan100
 ip address 192.0.2.1 255.255.255.252
end

configure terminal
interface Vlan100
 ip address 192.0.2.2 255.255.255.252
end

Check the link and SVI are up, VLAN 100 is forwarding, and the peer address is reachable before moving on. If the baseline fails, correct VLAN, port or addressing first. Do not try to repair ordinary Layer 2 mistakes by changing cryptographic settings.

Create credentials and enable mandatory protection

Apply the same block to both devices. The public hex CAK is an example: replace it with one randomly generated 128-bit secret shared securely between these peers. The CKN 01 identifies that secret. No lifetime command means the example key remains active indefinitely; use the key-lifecycle lesson to plan operational rollover.

configure terminal
aaa new-model
dot1x system-auth-control
key chain LINK-KEY macsec
 key 01
  cryptographic-algorithm aes-128-cmac
  key-string 8c40a71d25f6913b70e2c94a56d809be
 exit
exit
mka policy LINK-MKA
 macsec-cipher-suite gcm-aes-128
 confidentiality-offset 0
exit
interface TenGigabitEthernet1/0/1
 shutdown
 macsec access-control must-secure
 mka policy LINK-MKA
 mka pre-shared-key key-chain LINK-KEY
 macsec replay-protection window-size 0
 macsec network-link
 no shutdown
end

The port is shut while interface protection is attached. Provision both ends through independent management; until both are ready, mandatory protection can prevent ordinary link traffic. aaa new-model is a global change: on an existing managed device, use the already reviewed AAA configuration instead of blindly reapplying a study recipe.

The key-chain CMAC setting authenticates MKA; the MKA policy's GCM setting selects the data cipher. Offset zero protects the complete secure data. A replay window of zero assumes ordered direct-link delivery. must-secure prevents ordinary unsecured data fallback; key-management control traffic remains able to establish the association.

Verify the protected result

R1# show mka sessions
Total MKA Sessions....... 1
 Secured Sessions... 1
 Pending Sessions... 0

R1# show macsec interface TenGigabitEthernet1/0/1
MACsec is enabled
 Replay protect : enabled
 Replay window : 0
 Cipher : GCM-AES-128
 Confidentiality Offset : 0
 Access control : must secure
 Transmit Secure Channels
  SA State: inUse(1)
  Confidentiality : yes

The association is secured and the active transmit association uses confidentiality. Repeat on R2; inspect its receive and transmit associations as well. A configured cipher alone is weaker evidence than active association state.

R1# ping 192.0.2.2 source 192.0.2.1
!!!!!
Success rate is 100 percent (5/5)

Ping proves the test addresses communicate, not that this flow is encrypted. Compare the protected association's counters before and after the test on both devices as shown in Session and counter checks. Confirm near-maximum intended packet sizes also work within the qualified frame-size budget.

Change or restore without accidental cleartext

Keep an export of the intended baseline and secret references in secure storage. If a policy must change, use management access to shut the participating test ports first, remove MACsec activation while they remain shut, edit both peers' compatible policy, reattach it and reenable the protected ports. The platform guide requires disabling the existing PSK session before replacing its attached MKA policy.

configure terminal
interface TenGigabitEthernet1/0/1
 shutdown
 no macsec network-link
end

This is the start of a controlled change, not a finished working configuration. After the policy edit, reapply macsec network-link and then no shutdown on the intended port, verify the secured result and save the reviewed final configuration. If restoration cannot be completed, leave the data link shut or use an already approved alternate path. Removing encryption and resuming data is a separate security decision.