MACsec Switch-to-Switch Encryption with MKA

MACsec encrypts at Layer 2, on the wire, between two directly connected devices - which makes it the right tool for links that cross untrusted physical paths and the wrong tool for encrypting flows that traverse many hops. Because it operates below routing it protects everything the link carries, including protocols that cannot be encrypted at Layer 3. This guide covers the MKA key exchange model that authenticates both ends before encryption starts, the exact key chain configuration, interface policy application, and the verification and troubleshooting commands that tell you whether the secure channel is actually up.

How MKA fits together

MACsec uses the MACsec Key Agreement protocol to negotiate session keys. Each link is configured with a connectivity association made of two values:

• CKN - Connectivity Key Name, the identifier of the association. It must be an even number of hexadecimal characters on most platforms, and both ends must match.
• CAK - Connectivity Association Key, the shared secret. The CKN and CAK together authenticate both sides.

From these, MKA derives the security association keys. Encryption is AES-GCM at line rate in hardware, so throughput impact is minimal compared to CPU-based encryption, and each secured frame carries an integrity check value.

Key chain configuration

key chain MACSEC-KC macsec
 key 01
  cryptographic-algorithm aes-128-cmac
  key-string 0123456789ABCDEF0123456789ABCDEF
  lifetime 00:00:00 Jan 1 2026 infinite
 !
!
mka policy MKA-POLICY
 key-server priority 0
 macsec-cipher-suite gcm-aes-128

The key server priority decides which end leads the MKA negotiation; give the two ends different values rather than leaving both at the default, because a tie is resolved by other parameters that are harder to control. Choose the cipher suite explicitly rather than relying on negotiation: mixed capability ends up with a down secure channel and a vague log message.

Apply to the link

interface GigabitEthernet1/0/1
 description Uplink-to-core (MACsec)
 macsec network-link
 mka policy MKA-POLICY
 macsec
 no shutdown
!

macsec network-link selects the point-to-point mode used for switch-to-switch encryption, as opposed to the host-facing mode. Apply MACsec to both ends of the same physical link before the link is needed - bringing one side up first means an unencrypted-then-encrypted transition, so schedule it in a maintenance window or stage it on a secondary path.

Verify the secure channel

show macsec mka summary
show macsec mka session interface GigabitEthernet1/0/1
show macsec interface GigabitEthernet1/0/1
show macsec statistics interface GigabitEthernet1/0/1

Look for the MKA session in Secured state with matching key server and cipher suite, and for the interface counters to show encrypted frames increasing. A session stuck in Pending is almost always a key mismatch: verify that the CKN, CAK, cipher suite and lifetime windows agree on both sides, and check for an intervening device that does not pass EAPoL (MKA) frames.

Troubleshooting checklist

• Both ends must support the same cipher suite in hardware; a feature mismatch fails closed, not open.
• MKA uses EAPoL ethertype frames. An intervening switch, media converter or WAN circuit that filters them will prevent the session.
• Confirm the key lifetime window covers the current date on both devices; a passed expiry silently prevents new secure associations.
• Test with an unused port pair before touching a production uplink, and verify forwarding with a ping plus show macsec statistics.

Where MACsec stops and other tools start

MACsec protects one link; it does not protect a path. For transport across shared networks, use a Layer 3 tunnel - the trade-offs are covered in IPsec VTI versus policy-based VPN and WireGuard site-to-site VPN. For link-layer hardening alongside MACsec, see port security with MAC lockout and client limits.

原文链接：https://community.cisco.com/t5/networking-knowledge-base/configuring-macsec-switch-to-switch-with-pre-shared-key/ta-p/4436093