• If there are any intermediate switches present between two MACsec endpoints, any P2P protocols like STP or CDP will not work. • Network-Based Application Recognition (NBAR) is not supported on MACsec switch-to-host connections. • RSPAN or ERSPAN does not capture encrypted packets at egress and decrypted packets at ingress for MACsec enabled interfaces. Information About MACsec Encryption The following sections provide information about MACsec encryption. Recommendations for MACsec Encryption This section list the recommendations for configuring MACsec encryption: • Use the confidentiality (encryption) offset as 0 in switch-to-host connections.
• Use Bidirectional Forwarding and Detection (BFD) timer value as 750 milliseconds for 10Gbps ports and 1.25 seconds for any port with speed above 10Gbps. • Execute the shutdown command, and then the no shutdown command on a port, after changing any MKA policy or MACsec configuration for active sessions, so that the changes are applied to active sessions. • Use Extended Packet Numbering (XPN) Cipher Suite for port speeds of 40Gbps and above. • Set the connectivity association key (CAK) rekey overlap timer to 30 seconds or more. • Do not use Cisco TrustSec Security Association Protocol (SAP) MACsec encryption for port speeds above 10Gbps.
• Do not enable both Cisco TrustSec SAP and uplink MKA at the same time on any interface. • Use MACsec MKA encryption. • Use the macsec replay-protection window-size command to avoid packet drops for WAN MACsec configuration. • Do not use the delay-protection command when defining MKA policy if MACsec scale sessions are configured. MACsec Encryption Overview MACsec is the IEEE 802.1AE standard for authenticating and encrypting packets between two MACsec-capable devices. Catalyst switches support 802.1AE encryption with MACsec Key Agreement (MKA) on switch-to-host links for encryption between the switch and host device.
The switch also supports MACsec encryption for switch-to-switch (inter-network device) security using both Cisco TrustSec Network Device Admission Control (NDAC), Security Association Protocol (SAP) and MKA-based key exchange protocol. Configuring MACsec Encryption Information About MACsec Encryption Configuring MACsec Encryption 3