the EAP session ID generates a secure connectivity association key name (CKN). The switch acts as the authenticator for both switch-to-switch and switch-to-host; and acts as the key server for switch-to-host. It generates a random secure association key (SAK), which is sent to the client partner. The client is never a key server and can only interact with a single MKA entity, the key server. After key derivation and generation, the switch sends periodic transports to the partner at a default interval of 2 seconds. The packet body in an EAPOL Protocol Data Unit (PDU) is referred to as a MACsec Key Agreement PDU (MKPDU).
MKA sessions and participants are deleted when the MKA lifetime (6 seconds) passes with no MKPDU received from a participant. For example, if a MKA peer disconnects, the participant on the switch continues to operate MKA until 6 seconds have elapsed after the last MKPDU is received from the MKA peer. Integrity check value (ICV) indicator in MKPDU is optional. ICV is not optional when the traffic is encrypted. Note MKA Policies You apply a defined MKA policy to an interface to enable MKA on the interface. Removing the MKA policy disables MKA on that interface. You can configure these options: • Policy name, not to exceed 16 ASCII characters.
• Confidentiality (encryption) offset of 0, 30, or 50 bytes for each physical interface. Confidentiality offset of 50 bytes with MACsec XPN Cipher Suites is not supported. Note Definition of Policy-Map Actions This section describes the policy-map actions and its definition: • Activate: Applies a service template to the session. • Authenticate: Starts authentication of the session. • Authorize: Explicitly authorizes a session. • Set-domain: Explicitly sets the domain of a client. • Terminate: Terminates the method that is running, and deletes all the method details associated with the session. • Deactivate: Removes the service-template applied to the session.
If not applied, no action is taken. • Set-timer: Starts a timer and gets associated with the session. When the timer expires, any action that needs to be started can be processed. • Authentication-restart: Restarts authentication. • Clear-session: Deletes a session. • Pause: Pauses authentication. Configuring MACsec Encryption MKA Policies Configuring MACsec Encryption 5