transport-security

transport-security
+  macsec
   +  interface name string 
      +  admin-state keyword
      +  exclude-mac destination-mac string 
      +  exclude-protocols protocol keyword 
      +  interface-ref
         +  interface reference
      +  mka
         -  ca-key-name string
         -  encryption-offset keyword
         -  hello-interval number
         +  key-chain reference
         -  key-number number
         -  key-server boolean
         -  key-server-priority number
         -  latest-sak-an number
         -  latest-sak-ki binary
         -  latest-sak-lpn number
         -  member-id binary
         -  message-count number
         -  mka-peer member-id binary 
            -  key-server-priority number
            -  lowest-acceptable-pn number
            -  message-number number
            -  mka-peer-mid binary
            -  sci binary
            -  type keyword
         +  mka-policy reference
         -  oper-cipher keyword
         -  oper-state keyword
         -  outbound-sci binary
         -  previous-sak-an number
         -  previous-sak-ki binary
         -  previous-sak-lpn number
         -  statistics
            -  cak-info-missing number
            -  ckn-not-found number
            -  in-cak-mkpdu number
            -  in-mkpdu number
            -  in-mkpdu-errors
               -  bad-peer-errors number
               -  icv-verification-errors number
               -  peer-list-errors number
               -  validation-errors number
            -  in-sak-mkpdu number
            -  invalid-ckn-length number
            -  key-number-invalid number
            -  liveness-check-fail number
            -  max-peers-set-zero number
            -  new-live-peer number
            -  out-cak-mkpdu number
            -  out-mkpdu number
            -  out-mkpdu-errors
               -  pdu-invalid-number number
               -  pdu-not-quad-size number
               -  pdu-too-big number
               -  pdu-too-small number
            -  out-sak-mkpdu number
            -  parameter-not-quad-size number
            -  parameter-size-invalid number
            -  peer-same-mi number
            -  peers-removed number
            -  sak-cipher-mismatch-errors number
            -  sak-decryption-errors number
            -  sak-encryption-errors number
            -  sak-generated number
            -  sak-generation-errors number
            -  sak-hash-errors number
            -  sak-install-fail number
            -  sak-no-key-server number
            -  sak-non-live-peer number
            -  unsupported-algorithm-agility number
      -  oper-state keyword
      +  replay-protection
         +  admin-state keyword
         +  window-size number
      +  rx-must-be-encrypted boolean
      -  scsa-rx sci-rx string 
         -  delayed-packets number
         -  late-packets number
         -  not-using-sa-packets number
         -  sc-invalid number
         -  sc-octets-invalid number
         -  sc-octets-valid number
         -  sc-sak-installed-count number
         -  sc-valid number
         -  sci-rx-identifier string
         -  security-association rx-sa-an number 
            -  discarded-active number
            -  discarded-inactive number
            -  sa-invalid number
            -  sa-sak-installed boolean
            -  sa-valid number
         -  unchecked-packets number
      -  scsa-tx sci-tx string 
         -  sc-auth-only number
         -  sc-encrypted number
         -  sc-octets-auth-only number
         -  sc-octets-encrypted number
         -  sc-sak-installed-count number
         -  sci-tx-identifier string
         -  security-association tx-sa-an number 
            -  sa-auth-only number
            -  sa-encrypted number
            -  sa-sak-installed boolean
      -  statistics
         -  rx-badtag-pkts number
         -  rx-nosci-pkts number
         -  rx-overrun-packets number
         -  rx-unknownsci-pkts number
         -  rx-untagged-pkts number
         -  tx-too-long-packets number
         -  tx-untagged-pkts number
   +  mka
      +  policy name string 
         +  admin-state keyword
         +  clear-tag-mode keyword
         +  confidentiality-offset keyword
         +  eapol-destination-address string
         +  encrypt boolean
         +  hello-interval number
         +  key-server-priority number
         +  macsec-cipher-suite keyword
         +  sak-rekey-on-live-peer-loss boolean
      -  statistics
         -  in-mkpdu-errors
            -  bad-peer-errors number
            -  icv-verification-errors number
            -  peer-list-errors number
            -  validation-errors number
         -  out-mkpdu-errors
            -  pdu-invalid-number number
            -  pdu-not-quad-size number
            -  pdu-too-big number
            -  pdu-too-small number
         -  sak-cipher-mismatch-errors number
         -  sak-decryption-errors number
         -  sak-encryption-errors number
         -  sak-generation-errors number
         -  sak-hash-errors number
         -  sak-install-fail number

transport-security Descriptions

transport-security

Description Enclosing container for transport security
Contexttransport-security
Treetransport-security
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b

macsec

Description Enter the macsec context
Context transport-security macsec
Treemacsec
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b

interface name string

Description List of interfaces on which MACsec is enabled / available When interface is configured the entire interface is protected via macsec.
Contexttransport-security macsec interface name string
Treeinterface
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
name string
Description Name of the interface being created for the MACSec
Contexttransport-security macsec interface name string
String Length1 to 255
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
exclude-mac destination-mac string
Description list of destination macs to be excluded from the macsec encryption
Contexttransport-security macsec interface name string exclude-mac destination-mac string
Treeexclude-mac
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
exclude-protocols protocol keyword
Description protocols to be excluded from macsec
Context transport-security macsec interface name string exclude-protocols protocol keyword
Treeexclude-protocols
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
protocol keyword
Description exclude this protocol
Context transport-security macsec interface name string exclude-protocols protocol keyword
Options

  • lacp

    LACP protocol

  • lldp

    LLDP protocol

  • cdp

    Cisco discovery protocol

  • eapol-start

    EAP over LAN start packets

  • efm-oam

    Ethernet in first mile protocol

  • eth-cfm

    Connectivity fault management protocol

  • ptp

    Precision Time Protocol

  • ubfd

    Micro BFD protocol

ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
interface-ref
Description Enter the interface-ref context
Context transport-security macsec interface name string interface-ref
Treeinterface-ref
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
mka
Description Enclosing container for the MKA interface
Contexttransport-security macsec interface name string mka
Treemka
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
encryption-offset keyword
Description Indicates the operational encryption offset used for the datapath PDUs when all parties in the CA have the SAK. This value is specified by the key server
Contexttransport-security macsec interface name string mka encryption-offset keyword
Treeencryption-offset
Options

  • 0-bytes

    No octets are sent unencrypted

  • 30-bytes

    30 octects are sent unencrypted

  • 50-bytes

    50 octects are sent unencrypted

ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
key-number number
Description

Indicates the number of the currently assigned CAK

When a new CAK is generated, this number is incremented.

Contexttransport-security macsec interface name string mka key-number number
Treekey-number
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
latest-sak-an number
Description

Indicates the Association Number (AN) of the latest Secure Association Key (SAK)

This number is concatenated with an SCI to identify a Secure Association (SA).

Contexttransport-security macsec interface name string mka latest-sak-an number
Treelatest-sak-an
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
latest-sak-ki binary
Description

Indicates the Key Identifier (KI) of the latest SAK

This number is derived from the MI of the key server and the key number.

Contexttransport-security macsec interface name string mka latest-sak-ki binary
Treelatest-sak-ki
String Length16
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
mka-peer member-id binary
Description List of MKA peers.
Context transport-security macsec interface name string mka mka-peer member-id binary
Treemka-peer
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
type keyword
Description Indicates the type of the peer entry
Context transport-security macsec interface name string mka mka-peer member-id binary type keyword
Treetype
Options

  • live-peer-list

    These peer entry is in the Live Peer List

  • potential-peer-list

    These peer entry is in the Potential Peer List

ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
oper-cipher keyword
Description Indicates the operational encryption algorithm used for datapath PDUs when all parties in the CA have the SAK. This value is specified by the key server
Contexttransport-security macsec interface name string mka oper-cipher keyword
Treeoper-cipher
Options

  • gcm-aes-128

    gcm-aes-128 Cipher Suite

  • gcm-aes-256

    gcm-aes-256 Cipher Suite

  • gcm-aes-xpn-128

    gcm-aes-xpn-128 Cipher Suite

  • gcm-aes-xpn-256

    gcm-aes-xpn-256 Cipher Suite

ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
oper-state keyword
Description The operational state of the mka instance
Contexttransport-security macsec interface name string mka oper-state keyword
Treeoper-state
Options

  • up

    Component or process is operational

  • down

    Component or process is not operational

  • empty

    Component slot is empty

  • downloading

    Component is downloading image into memory

  • booting

    Component is booting downloaded image

  • starting

    Component image operational, application processes starting

  • failed

    Component or process has failed

  • synchronizing

    Component is currently being synchronized

  • upgrading

    Component is currently being upgraded

  • low-power

    Component is offline due to insufficient system power

  • degraded

    Component or process is in a degraded state

  • warm-reboot

    Component or process is currently warm rebooting

    This state is set during a warm reboot immediately following initiation of the reboot, continuing after startup until the system has completed audit. In this state the system will not accept configuration changes.

  • waiting

    Component or process is currently waiting

    This state can be set by event handler when the reinvoke-with-delay action is used, and indicates that the event handler is waiting for the provided delay before reinvoking the instance.

ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
previous-sak-an number
Description

Indicates the Association Number (AN) of the previous Security Association key (SAK)

This number is concatenated with an SCI to identify an Secure Association SA.

Contexttransport-security macsec interface name string mka previous-sak-an number
Treeprevious-sak-an
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
previous-sak-ki binary
Description

Indicates the Key Identifier (KI) of the previous SAK

This number is derived from the Member Identifier (MI) of the key server and the key number.

Contexttransport-security macsec interface name string mka previous-sak-ki binary
Treeprevious-sak-ki
String Length16
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
statistics
Description MKA interface counters
Context transport-security macsec interface name string mka statistics
Treestatistics
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
in-mkpdu-errors
Description Enter the in-mkpdu-errors context
Context transport-security macsec interface name string mka statistics in-mkpdu-errors
Treein-mkpdu-errors
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
out-mkpdu-errors
Description Enter the out-mkpdu-errors context
Context transport-security macsec interface name string mka statistics out-mkpdu-errors
Treeout-mkpdu-errors
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
oper-state keyword
Description Indicates the operational state of macsec on this subinterface
Contexttransport-security macsec interface name string oper-state keyword
Treeoper-state
Options

  • up

    Component or process is operational

  • down

    Component or process is not operational

  • empty

    Component slot is empty

  • downloading

    Component is downloading image into memory

  • booting

    Component is booting downloaded image

  • starting

    Component image operational, application processes starting

  • failed

    Component or process has failed

  • synchronizing

    Component is currently being synchronized

  • upgrading

    Component is currently being upgraded

  • low-power

    Component is offline due to insufficient system power

  • degraded

    Component or process is in a degraded state

  • warm-reboot

    Component or process is currently warm rebooting

    This state is set during a warm reboot immediately following initiation of the reboot, continuing after startup until the system has completed audit. In this state the system will not accept configuration changes.

  • waiting

    Component or process is currently waiting

    This state can be set by event handler when the reinvoke-with-delay action is used, and indicates that the event handler is waiting for the provided delay before reinvoking the instance.

ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
replay-protection
Description Enter the replay-protection context
Context transport-security macsec interface name string replay-protection
Treereplay-protection
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
window-size number
Description

MACsec window size, as defined by the number of out-of-order frames that are accepted.

A value of 0 means that frames are accepted only in the correct order.

Contexttransport-security macsec interface name string replay-protection window-size number
Treewindow-size
Default0
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
scsa-rx sci-rx string
Description RX Secure Channel and Secure Association Statistics
Contexttransport-security macsec interface name string scsa-rx sci-rx string
Treescsa-rx
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
sci-rx string
Description RX Secure Channel and Secure Association Statistics
Contexttransport-security macsec interface name string scsa-rx sci-rx string
String Length16
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
delayed-packets number
Description Indicates the number of received packets with the condition that the PN of the packets is lower than the lower bound of the replay protection PN
Contexttransport-security macsec interface name string scsa-rx sci-rx string delayed-packets number
Treedelayed-packets
Default0
Unitspackets
Configurable False
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
sc-invalid number
Description

Invalid Secure Channel RX Packets counter

This counter reflects the number of invalid received packets in a secure channel. Indicates the summation of counter /macsec/rx-sa/not-valid-packets information for all the SAs which belong to this SC.

Contexttransport-security macsec interface name string scsa-rx sci-rx string sc-invalid number
Treesc-invalid
Default0
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
sc-octets-valid number
Description

Valid Secure Channel RX Packets counter

This counter reflects the number of valid received packets in a secure channel. Indicates the number of octets of plain text recovered from received packets that were integrity protected and encrypted.

Contexttransport-security macsec interface name string scsa-rx sci-rx string sc-octets-valid number
Treesc-octets-valid
Default0
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
sc-valid number
Description

Valid Secure Channel RX Packets counter

This counter reflects the number of valid received packets in a secure channel. Indicates the summation of counter /macsec/rx-sa/ok-packets information for all the SAs which belong to this SC.

Contexttransport-security macsec interface name string scsa-rx sci-rx string sc-valid number
Treesc-valid
Default0
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
security-association rx-sa-an number
Description Enter the receiving-sa list instance
Context transport-security macsec interface name string scsa-rx sci-rx string security-association rx-sa-an number
Treesecurity-association
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
scsa-tx sci-tx string
Description TX Secure Channel and Secure Association Statistics
Contexttransport-security macsec interface name string scsa-tx sci-tx string
Treescsa-tx
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
sci-tx string
Description TX Secure Channel and Secure Association Statistics
Contexttransport-security macsec interface name string scsa-tx sci-tx string
String Length16
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
sc-auth-only number
Description

Secure Channel Authenticated only TX Packets counter

This counter reflects the number of authenticated only transmitted packets in a secure channel.

Contexttransport-security macsec interface name string scsa-tx sci-tx string sc-auth-only number
Treesc-auth-only
Default0
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
sc-encrypted number
Description

Secure Channel Encrypted TX Packets counter

This counter reflects the number of encrypted and authenticated transmitted packets in a secure channel.

Contexttransport-security macsec interface name string scsa-tx sci-tx string sc-encrypted number
Treesc-encrypted
Default0
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
security-association tx-sa-an number
Description Enter the transmitting-sa list instance
Contexttransport-security macsec interface name string scsa-tx sci-tx string security-association tx-sa-an number
Treesecurity-association
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
statistics
Description MACsec interface counters
Context transport-security macsec interface name string statistics
Treestatistics
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
rx-badtag-pkts number
Description

MACsec interface level Receive Bad Tag Packets counter

This counter will increment if MACsec is enabled on interface and incoming packet has incorrect MACsec tag.

Contexttransport-security macsec interface name string statistics rx-badtag-pkts number
Treerx-badtag-pkts
Default0
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
rx-nosci-pkts number
Description

MACsec interface level Receive No SCI Packets counter

This counter will increment if MACsec is enabled on interface and incoming packet does not have SCI field in MACsec tag.

Contexttransport-security macsec interface name string statistics rx-nosci-pkts number
Treerx-nosci-pkts
Default0
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
rx-unknownsci-pkts number
Description

MACsec interface level Receive Unknown SCI Packets counter

This counter will increment if MACsec is enabled on the interface and SCI present in the MACsec tag of the incoming packet does not match any SCI present in ingress SCI table.

Contexttransport-security macsec interface name string statistics rx-unknownsci-pkts number
Treerx-unknownsci-pkts
Default0
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
rx-untagged-pkts number
Description

MACsec interface level Receive untagged Packets counter

This counter will increment if MACsec is enabled on interface and the incoming packet does not have MACsec tag.

Contexttransport-security macsec interface name string statistics rx-untagged-pkts number
Treerx-untagged-pkts
Default0
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
tx-too-long-packets number
Description

Indicates the number of transmitted packets discarded because of long lenght

The packet length is greater than the Maximum Transmission Unit (MTU) of the Ethernet physical interface.

Contexttransport-security macsec interface name string statistics tx-too-long-packets number
Treetx-too-long-packets
Default0
Unitspackets
Configurable False
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
tx-untagged-pkts number
Description

MACsec interface level Transmit untagged Packets counter

This counter will increment if MACsec is enabled on interface and the outgoing packet is not tagged with MACsec header.

Contexttransport-security macsec interface name string statistics tx-untagged-pkts number
Treetx-untagged-pkts
Default0
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b

mka

Description The MKA
Contexttransport-security macsec mka
Treemka
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
policy name string
Description List of MKA policies
Context transport-security macsec mka policy name string
Treepolicy
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
name string
Description Name of the MKA policy
Context transport-security macsec mka policy name string
String Length1 to 255
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
admin-state keyword
Description

Enable mka policy

While MKA policy is enabled no policy parameters can be configured or modified.

Contexttransport-security macsec mka policy name string admin-state keyword
Treeadmin-state
Defaultdisable
Options

  • enable

  • disable

Configurable True
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
clear-tag-mode keyword
Description Specifies the number of tags that will be in clear infront of the sectag
Contexttransport-security macsec mka policy name string clear-tag-mode keyword
Treeclear-tag-mode
Defaultno-tag
Options

  • no-tag

    Do not put any tags into clear

  • single-tag

    Put 4 bytes after the MAC header into clear

  • double-tag

    Put 8 bytes after the MAC header into clear

ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
confidentiality-offset keyword
Description The confidentiality offset specifies a number of octets in an Ethernet frame that are sent in unencrypted and in plain-text
Contexttransport-security macsec mka policy name string confidentiality-offset keyword
Treeconfidentiality-offset
Default0-bytes
Options

  • 0-bytes

    No octets are sent unencrypted

  • 30-bytes

    30 octects are sent unencrypted

  • 50-bytes

    50 octects are sent unencrypted

ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
encrypt boolean
Description Enable or disable PDU encryption, if enabled the PDUs are encrypted and authenticated if disabled the PDU is only authenticated and not encrypted
Contexttransport-security macsec mka policy name string encrypt boolean
Treeencrypt
Defaulttrue
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
hello-interval number
Description MKA hello interval, the intervals are 1000 ms up to 6000 ms
Contexttransport-security macsec mka policy name string hello-interval number
Treehello-interval
Range1000 | 2000 | 3000 | 4000 | 5000 | 6000
Default2000
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
key-server-priority number
Description

Specifies the key server priority used by the macsec

Macsec Key Agreement (MKA) advertises and selects a key server. The node with the lower priority-number is selected as the key server. If the priority-number is identical on both sides of a point-to-point link, the MKA protocol selects the device with the lower MAC address as the key server

Contexttransport-security macsec mka policy name string key-server-priority number
Treekey-server-priority
Default16
ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
macsec-cipher-suite keyword
Description Set cipher suite(s) for security association key (SAK) derivation
Contexttransport-security macsec mka policy name string macsec-cipher-suite keyword
Treemacsec-cipher-suite
Options

  • gcm-aes-128

    gcm-aes-128 Cipher Suite

  • gcm-aes-256

    gcm-aes-256 Cipher Suite

  • gcm-aes-xpn-128

    gcm-aes-xpn-128 Cipher Suite

  • gcm-aes-xpn-256

    gcm-aes-xpn-256 Cipher Suite

ConfigurableTrue
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
statistics
Description Operational state data for MKA
Context transport-security macsec mka statistics
Treestatistics
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
in-mkpdu-errors
Description Enter the in-mkpdu-errors context
Context transport-security macsec mka statistics in-mkpdu-errors
Treein-mkpdu-errors
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b
out-mkpdu-errors
Description Enter the out-mkpdu-errors context
Context transport-security macsec mka statistics out-mkpdu-errors
Treeout-mkpdu-errors
ConfigurableFalse
Platforms7250 IXR-10e, 7250 IXR-6e, 7250 IXR-X1b, 7250 IXR-X3b