Restrictions for MACsec Encryption • For C9300-48UXM and C9300-48UN switch models, MACsec is supported only on the first 16 downlink network ports and on all uplink network module ports. MACsec is not supported on the last 32 downlink network ports of C9300-48UXM and C9300-48UN switch models. • MACsec configuration is not supported on EtherChannel ports. Instead, MACsec configuration can be applied on the individual member ports of an EtherChannel. To remove MACsec configuration, you must first unbundle the member ports from the EtherChannel, and then remove it from the individual member ports. • MACsec with MKA is supported only on point-to-point links.
• Cisco IOS XE supports only MKA version 1. This causes MACsec interoperability issues when connecting to third-party devices that require MKA version 2 or higher. • GCM-AES-256 and XPN cipher suites (GCM-AES-XPN-128 and GCM-AES-XPN-256) are supported only with Network Advantage license. • The MACsec Cipher announcement is not supported for MACsec Extended Packet Numbering (XPN) Ciphers and switch-to-switch MACsec connections. • MACsec XPN Cipher Suites are not supported in switch-to-host MACsec connections. • MACsec XPN Cipher Suites do not provide confidentiality protection with a confidentiality offset, and these together are not supported in switch-to-switch MACsec connections.
• As per IEEE standards, the maximum value of replay window is 2 30-1 for MACsec XPN Cipher Suites. Even if you configure a higher value than this, it will be restricted to 2 30-1 only. • Certificate-based MACsec is supported only if the access-session is configured as closed or in multiple-host mode. None of the other configuration modes are supported. • If the dot1q tag vlan native command is configured globally, the dot1x reauthentication will fail on trunk ports. • MACsec switch-to-host connections in an overlay network are not supported. • MACsec is not supported with Multicast VPN (mVPN). • MACsec switch-to-host connections are not supported on Software-Defined Access deployments.
• Access control options are only applicable to switch-to-switch MACsec. These options are not supported for switch-to-host MACsec. • The should-secure access mode is supported on switch-to-switch ports only using PSK authentication. • PSK fallback key chain is not supported on Ethernet Virtual Circuit (EVC), point-to-multipoint cases, and Security Association Protocol (SAP). • PSK fallback key chain supports infinite lifetime with one key only. The connectivity association key name (CKN) ID used in the fallback key chain must not match any of the CKN IDs used in the primary key chain.
• EAPOL packets of EtherType 0x888E are not intercepted by the interface if MACsec or dot1x is not enabled on the interface. Configuring MACsec Encryption Restrictions for MACsec Encryption Configuring MACsec Encryption 2