Key Chain

Keychains provide a centralized mechanism for managing cryptographic keys used by routing protocol authentication on NX-OS, enabling secure neighbor adjacency establishment for OSPF, IS-IS, BGP, and other protocols. Each keychain contains one or more keys identified by numeric ID, with configurable cryptographic algorithms including md5, hmac-sha-1, hmac-sha-256, hmac-sha-384, hmac-sha-512, 3des, and aes for varying levels of authentication strength. MACsec key chains (key chain <name> macsec) hold the pre-shared connectivity association keys used by MACsec, with hexadecimal key IDs, key-octet-string key material using AES_128_CMAC or AES_256_CMAC, and an optional send-lifetime. Keys support multiple encryption types (unencrypted, type7, type6) for secure storage of key material. Classic keys can be bound to an accept-lifetime and a send-lifetime, each with a start time and either an end time, a duration in seconds or infinite, optionally interpreted in the local time zone, allowing seamless key rotation and algorithm upgrades without disrupting routing protocol adjacencies.

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
key_chains	List	key_chains	No

key_chains (nxos.devices.configuration)

Name	Type	Constraint	Mandatory
name	String		Yes
macsec	Boolean	`true`, `false`	No
keys	List	keys	No

key_chains (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
keys	List	keys	No

keys (nxos.devices.configuration.key_chains)

Name	Type	Constraint	Mandatory
id	Any	Integer[min: `0`, max: `65535`] or String[Regex: `^[0-9a-fA-F]{1,64}$`] or String[Regex: `^.[\$\%]\{.$`]	Yes
cryptographic_algorithm	Choice	`none`, `md5`, `hmac-sha-1`, `hmac-sha-256`, `hmac-sha-384`, `hmac-sha-512`, `3des`, `aes`, `AES_128_CMAC`, `AES_256_CMAC`	No
encryption_type	Choice	`unencrypted`, `type7`, `type6`	No
key_string	String		No
key_octet_string	String		No
accept_lifetime	Class	accept_lifetime	No
send_lifetime	Class	send_lifetime	No

keys (nxos.devices.configuration.key_chains)

Name	Type	Constraint	Mandatory
id	Integer	min: `0`, max: `65535`	Yes
cryptographic_algorithm	Choice	`none`, `md5`, `hmac-sha-1`, `hmac-sha-256`, `hmac-sha-384`, `hmac-sha-512`, `3des`, `aes`	No
encryption_type	Choice	`unencrypted`, `type7`, `type6`	No
key_string	String		No

accept_lifetime (nxos.devices.configuration.key_chains.keys)

Name	Type	Constraint	Mandatory
local	Boolean	`true`, `false`	No
start_time	String		No
start_month	Choice	`Jan`, `Feb`, `Mar`, `Apr`, `May`, `Jun`, `Jul`, `Aug`, `Sep`, `Oct`, `Nov`, `Dec`	No
start_day	Integer	min: `1`, max: `31`	No
start_year	Integer	min: `1993`, max: `2035`	No
end_time	String		No
end_month	Choice	`Jan`, `Feb`, `Mar`, `Apr`, `May`, `Jun`, `Jul`, `Aug`, `Sep`, `Oct`, `Nov`, `Dec`	No
end_day	Integer	min: `1`, max: `31`	No
end_year	Integer	min: `1993`, max: `2035`	No
duration	Integer	min: `1`, max: `2147483646`	No
infinite	Boolean	`true`, `false`	No

send_lifetime (nxos.devices.configuration.key_chains.keys)

Name	Type	Constraint	Mandatory
local	Boolean	`true`, `false`	No
start_time	String		No
start_month	Choice	`Jan`, `Feb`, `Mar`, `Apr`, `May`, `Jun`, `Jul`, `Aug`, `Sep`, `Oct`, `Nov`, `Dec`	No
start_day	Integer	min: `1`, max: `31`	No
start_year	Integer	min: `1993`, max: `2035`	No
end_time	String		No
end_month	Choice	`Jan`, `Feb`, `Mar`, `Apr`, `May`, `Jun`, `Jul`, `Aug`, `Sep`, `Oct`, `Nov`, `Dec`	No
end_day	Integer	min: `1`, max: `31`	No
end_year	Integer	min: `1993`, max: `2035`	No
duration	Integer	min: `1`, max: `2147483646`	No
infinite	Boolean	`true`, `false`	No

Examples

Example 1: OSPF authentication keychain with hmac-sha-256

nxos:
  devices:
    - name: LEAF1
      configuration:
        key_chains:
          - name: OSPF-AUTH
            keys:
              - id: 1
                cryptographic_algorithm: hmac-sha-256
                encryption_type: type7
                key_string: 0739a6b5d4e1f208

Example 2: Multiple keychains for OSPF and BGP with key rotation support

nxos:
  devices:
    - name: SPINE1
      configuration:
        key_chains:
          - name: OSPF-UNDERLAY-AUTH
            keys:
              - id: 1
                cryptographic_algorithm: hmac-sha-256
                encryption_type: type7
                key_string: 0739a6b5d4e1f208
              - id: 2
                cryptographic_algorithm: hmac-sha-256
                encryption_type: type7
                key_string: 1840b7c6e5f2a319
          - name: BGP-FABRIC-AUTH
            keys:
              - id: 10
                cryptographic_algorithm: hmac-sha-256
                encryption_type: type7
                key_string: 2951c8d7f6a3b420

Example 3: Keychain with multiple algorithm strengths for migration scenarios

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        key_chains:
          - name: ISIS-DCI-AUTH
            keys:
              - id: 1
                cryptographic_algorithm: hmac-sha-512
                encryption_type: type6
                key_string: JDYkZHNmam...

Example 4: MACsec key chain with a time-bound send lifetime

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          macsec: true
        key_chains:
          - name: MACSEC-KEYCHAIN
            macsec: true
            keys:
              - id: 1a2b3c4d
                key_octet_string: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
                cryptographic_algorithm: AES_256_CMAC
                send_lifetime:
                  start_time: "00:00:00"
                  start_month: Jan
                  start_day: 1
                  start_year: 2026
                  duration: 31536000

Example 5: Key rotation with overlapping accept and send lifetimes

nxos:
  devices:
    - name: LEAF1
      configuration:
        key_chains:
          - name: OSPF-ROTATION
            keys:
              - id: 1
                cryptographic_algorithm: hmac-sha-256
                key_string: CurrentKey123
                accept_lifetime:
                  local: true
                  start_time: "00:00:00"
                  start_month: Jan
                  start_day: 1
                  start_year: 2026
                  end_time: "23:59:59"
                  end_month: Jul
                  end_day: 15
                  end_year: 2026
                send_lifetime:
                  local: true
                  start_time: "00:00:00"
                  start_month: Jan
                  start_day: 1
                  start_year: 2026
                  end_time: "23:59:59"
                  end_month: Jun
                  end_day: 30
                  end_year: 2026
              - id: 2
                cryptographic_algorithm: hmac-sha-256
                key_string: NextKey456
                accept_lifetime:
                  local: true
                  start_time: "00:00:00"
                  start_month: Jun
                  start_day: 15
                  start_year: 2026
                  infinite: true
                send_lifetime:
                  local: true
                  start_time: "00:00:00"
                  start_month: Jul
                  start_day: 1
                  start_year: 2026
                  infinite: true

Examples

Example 1: OSPF authentication keychain with hmac-sha-256

nxos:
  devices:
    - name: LEAF1
      configuration:
        key_chains:
          - name: OSPF-AUTH
            keys:
              - id: 1
                cryptographic_algorithm: hmac-sha-256
                encryption_type: type7
                key_string: 0739a6b5d4e1f208

Example 2: Multiple keychains for OSPF and BGP with key rotation support

nxos:
  devices:
    - name: SPINE1
      configuration:
        key_chains:
          - name: OSPF-UNDERLAY-AUTH
            keys:
              - id: 1
                cryptographic_algorithm: hmac-sha-256
                encryption_type: type7
                key_string: 0739a6b5d4e1f208
              - id: 2
                cryptographic_algorithm: hmac-sha-256
                encryption_type: type7
                key_string: 1840b7c6e5f2a319
          - name: BGP-FABRIC-AUTH
            keys:
              - id: 10
                cryptographic_algorithm: hmac-sha-256
                encryption_type: type7
                key_string: 2951c8d7f6a3b420

Example 3: Keychain with multiple algorithm strengths for migration scenarios

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        key_chains:
          - name: ISIS-DCI-AUTH
            keys:
              - id: 1
                cryptographic_algorithm: hmac-sha-512
                encryption_type: type6
                key_string: JDYkZHNmam...
          - name: MACSEC-KEYCHAIN
            keys:
              - id: 100
                cryptographic_algorithm: aes
                encryption_type: type6
                key_string: UjNwbGFjZW...