the fallback key chain is to act as a last resort key. The fallback key feature is only applicable for PSK based MKA or MACsec sessions. Replay Protection Window Size Replay protection is a feature provided by MACsec to counter replay attacks. Each encrypted packet is assigned a unique sequence number and the sequence is verified at the remote end. Frames transmitted through a Metro Ethernet service provider network are highly susceptible to reordering due to prioritization and load balancing mechanisms used within the network. A replay window is necessary to support the use of MACsec over provider networks that reorder frames.
Frames within the window can be received out of order, but are not replay protected. The default window size is 0, which enforces strict reception ordering. The replay window size can be configured in the range of 0 to 2 32 - 1. In case of XPN cipher suite, maximum replay window size is 2 30 - 1, and if a higher window size is configured, the window size gets restricted to 2 30 - 1. If the cipher suite is changed to a non-XPN cipher suite, then there is no restriction and the configured window size is used. MACsec, MKA, and 802.1x Host Modes You can use MACsec and the MKA Protocol with 802.1x single-host mode, multi-host mode, or Multi Domain Authentication (MDA) mode.
Multiple authentication mode is not supported. Single-Host Mode The figure shows how a single EAP authenticated session is secured by MACsec by using MKA Figure 1: MACsec in Single-Host Mode with a Secured Data Session Multiple Host Mode In standard (not 802.1x REV) 802.1x multiple-host mode, a port is open or closed based on a single authentication. If one user, the primary secured client services client host, is authenticated, the same level of network access is provided to any host connected to the same port. If a secondary host is a MACsec supplicant, it cannot be authenticated and traffic would not flow.
A secondary host that is a non-MACsec host can send traffic to the network without authentication because it is in multiple-host mode. The figure shows MACsec in Standard Multiple-Host Unsecure Mode. Configuring MACsec Encryption Replay Protection Window Size Configuring MACsec Encryption 7