MACsec

MACsec (IEEE 802.1AE) provides hop-by-hop encryption and integrity protection of Ethernet frames between directly connected devices on NX-OS. MACsec policies define the MKA parameters such as the cipher suite (or a set of peer cipher suites to enforce), confidentiality offset, key server priority, replay window size, SAK expiry time and whether unsecured traffic is permitted (should-secure) or dropped (must-secure). Pre-shared keys are provided by MACsec key chains (key chain <name> macsec), and each Ethernet interface binds a key chain, a policy and an optional fallback key chain with macsec keychain <name> policy <name> fallback-keychain <name>. The global macsec shutdown command disables all MACsec sessions without removing the configuration.

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
macsec	Class	macsec	No

macsec (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
shutdown	Boolean	true, false	No
key_chain_macsec_psk_no_show	Boolean	true, false	No
policies	List	policies	No

policies (nxos.devices.configuration.macsec)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
cipher_suite	Choice	GCM-AES-128, GCM-AES-256, GCM-AES-XPN-128, GCM-AES-XPN-256	No
cipher_suite_enforce_peer	List	Choice[GCM-AES-128, GCM-AES-256, GCM-AES-XPN-128, GCM-AES-XPN-256]	No
conf_offset	Choice	CONF-OFFSET-0, CONF-OFFSET-30, CONF-OFFSET-50	No
include_icv_indicator	Boolean	true, false	No
include_sci	Boolean	true, false	No
key_server_priority	Integer	min: 0, max: 255	No
ppk_crypto_qkd_profile	String		No
protocol_lldp_encrypted	Boolean	true, false	No
sak_expiry_time	Integer	min: 30, max: 2592000	No
security_policy	Choice	must-secure, should-secure	No
window_size	Integer	min: 0, max: 596000000	No

Examples

Example 1: MACsec policy with a key chain applied to an uplink

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          macsec: true
        key_chains:
          - name: MACSEC-KC1
            macsec: true
            keys:
              - id: 1a2b3c4d
                key_octet_string: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
                cryptographic_algorithm: AES_256_CMAC
                send_lifetime:
                  start_time: "00:00:00"
                  start_month: Jan
                  start_day: 1
                  start_year: 2026
                  infinite: true
        macsec:
          policies:
            - name: MACSEC-POLICY1
              cipher_suite: GCM-AES-XPN-256
              key_server_priority: 32
              security_policy: must-secure
              sak_expiry_time: 3600
        interfaces:
          ethernets:
            - id: 1/49
              macsec_keychain: MACSEC-KC1
              macsec_policy: MACSEC-POLICY1

Example 2: Enforcing peer cipher suites with a fallback key chain and hidden pre-shared keys

nxos:
  devices:
    - name: SPINE1
      configuration:
        feature:
          macsec: true
        key_chains:
          - name: MACSEC-PRIMARY
            macsec: true
            keys:
              - id: 1a2b3c4d
                key_octet_string: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
                cryptographic_algorithm: AES_256_CMAC
                send_lifetime:
                  local: true
                  start_time: "00:00:00"
                  start_month: Jan
                  start_day: 1
                  start_year: 2026
                  end_time: "23:59:59"
                  end_month: Dec
                  end_day: 31
                  end_year: 2026
          - name: MACSEC-FALLBACK
            macsec: true
            keys:
              - id: 9f8a7b6c
                key_octet_string: fedcba9876543210fedcba9876543210
                cryptographic_algorithm: AES_128_CMAC
        macsec:
          key_chain_macsec_psk_no_show: true
          policies:
            - name: MACSEC-DCI
              cipher_suite_enforce_peer:
                - GCM-AES-256
                - GCM-AES-XPN-256
              conf_offset: CONF-OFFSET-30
              include_icv_indicator: true
              include_sci: false
              window_size: 1000
              security_policy: should-secure
        interfaces:
          ethernets:
            - id: 1/1
              macsec_keychain: MACSEC-PRIMARY
              macsec_policy: MACSEC-DCI
              macsec_fallback_keychain: MACSEC-FALLBACK
            - id: 1/2
              macsec_keychain: MACSEC-PRIMARY
              macsec_policy: MACSEC-DCI
              macsec_fallback_keychain: MACSEC-FALLBACK