Link prerequisites and platform support
Decide whether the intended link can carry protected traffic before treating a configuration as deployable.
Prerequisite: Introduction to MACsec.
Identify the actual protection endpoints
Start with two devices on one physical Ethernet link. Record model, installed software, interface type and port identifier, enabled license, supported ciphers and keying method at both ends. “Supports MACsec” is too broad: a platform can support it on some ports or speeds and omit certificate authentication, XPN or a particular aggregation mode.
For this course the main recipe uses one supported physical port per device, PSK MKA, GCM-AES-128 and no EtherChannel or provider transport. Use the exact platform guide and release notes to qualify other combinations. Newer software cannot add a missing line-card encryption engine.
| Record | Acceptance question |
|---|---|
| Hardware and port | Does this port at this speed implement the required MACsec data plane? |
| Software/license | Are this keying method, cipher and replay policy supported and enabled? |
| Interoperability | Do both peers agree on MKA version, CKN encoding and cipher/key sizes? |
| Trust and policy | Do both ends have a common active credential and mandatory-protection policy? |
Qualify the whole transport
MKA needs EAPOL reachability, and protected data needs MACsec frame transport. On the ordinary Ethernet profile those are different EtherTypes, 0x888E and 0x88E5. Allowing IP unicast alone does not establish either requirement. Link-local EAPOL destinations can be consumed or filtered by an intermediate bridge; do not assume a carrier transparently forwards them.
For an Ethernet service, obtain its supported service model, control-protocol handling, maximum frame size, VLAN tag placement and reordering characteristics. The provider may require a documented EAPOL tunnel/customization feature at both endpoints. Such features are platform and service specific; they are not extra commands to add to the direct-link recipe.
The MACsec frame-size increase must fit at every relevant physical hop. Test small and near-maximum intended packets in both directions after protection is enabled. A small ping can pass even when larger protected frames are dropped. Retain enough replay tolerance for measured legitimate reordering if the policy allows it, and document the resulting exposure.
Prepare management and credentials
- Keep console or separate management access. Mandatory protection can intentionally block ordinary data when MKA is not secured.
- Choose PSK or certificate authentication before configuring the link. Securely provision matching PSK material, or prepare certificate enrollment, AAA/identity policy and service reachability.
- Synchronize clocks before using scheduled key lifetimes or validating certificates. Check the time zone used in any local-time schedule.
- Confirm matching Layer 2 access/trunk configuration and forwarding state. Routing or VLAN mistakes can prevent the test flow even when MACsec is healthy.
- Prepare a rollback that returns the test port to a known state under administrative shutdown. Do not silently authorize cleartext service as a recovery method.
Changing global AAA settings can affect administrative access. The example recipes assume a dedicated study environment or an already reviewed management policy; merge security prerequisites into an existing device policy rather than overwriting it.
Collect evidence of capability and readiness
R1# show macsec interface TenGigabitEthernet1/0/1
MACsec is enabled
Capabilities
ICV length : 16
Ciphers supported : GCM-AES-128
GCM-AES-256
GCM-AES-XPN-128
GCM-AES-XPN-256This example shows what an already enabled capable interface can report. A capability list does not prove that a cipher is licensed, selected or interoperable with R2; verify the peer, license and operational result. Inventory software and hardware using their normal platform commands before choosing the recipe.
R1# ping 192.0.2.2 source 192.0.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.0.2.2, timeout is 2 seconds:
Packet sent with a source address of 192.0.2.1
!!!!!
Success rate is 100 percent (5/5)The configuration lesson assigns these SVI addresses on VLAN 100. Record this reachability baseline on a controlled link, then repeat after enabling protection and check MACsec counters. This output alone says nothing about encryption.
Use a virtual topology honestly
GNS3 is a topology environment, not a promise that an imported image implements a given physical feature. Some virtual platforms expose a subset of CLI without the corresponding hardware MACsec data path. Others can implement software MACsec through a different operating system and syntax. Check the specific image's documented feature set rather than borrowing physical Catalyst commands.
If supported endpoints are unavailable, use the diagrams and constructed output to practice reasoning. Label this as configuration study. Do not claim measured throughput, successful hardware offload, captures or validated encryption from a drawing. A future live exercise needs appropriate devices and separate authorization to run it.
Key Takeaways
- Qualify exact hardware, port, release, license, cipher and keying method at both endpoints.
- EAPOL key-management reachability and MACsec data-frame transport are separate prerequisites.
- Frame size, VLAN handling and reordering must be checked across the actual transport.
- Independent management, credential readiness and valid time protect the change process.
- A GNS3 topology or accepted command does not prove an image implements the MACsec data plane.
Technical references and example notes
IEEE 802.1AE · IEEE 802.1X and MKA · Platform configuration and verification · Topology-symbol attribution.
Diagrams, frame sequences and command results are constructed teaching examples, not recorded captures or lab measurements.