MACsec policy exception

Updated: September 11, 2026

Want to summarize with AI?

Explains how to configure MACsec policy exceptions to permit specific packet types, such as LACP, pause frames, and LLDP, to bypass encryption and be transmitted in clear text for troubleshooting and interoperability.

This chapter explains how to configure MACsec policy exceptions to permit specific packet types—such as LACP, pause frames, and LLDP packets—to bypass MACsec encryption and be transmitted in clear text. It provides step-by-step procedures, example commands, and important security considerations for enabling these exceptions in Cisco environments.

Create a MACsec policy exception

Allow specific MACsec policy exceptions to enable or permit particular packet types in clear-text format.

Procedure

Use the macsec-policy command to access the desired MACsec policy configuration by specifying the policy name.
Example:
```
Router# configure
Router(config)# macsec-policy mp1
```
Use the allow lacp-in-clear command to permit LACP packets in clear-text format.
Example:
```
Router(config-macsec-policy)# allow lacp-in-clear
```

Use the allow pause-frames-in-clear command to permit pause frames in clear-text.

Example:

Router(config-macsec-policy)# allow pause-frames-in-clear
Router(config-macsec-policy)# commit

Use the show running config command to confirm the policy exception.

Example:

Router# show running-config macsec-policy mp1
macsec-policy mp1
…
allow lacp-in-clear
allow pause-frames-in-clear
!

Use the show macsec policy detail command to verify detailed MACsec policy status.

Example:

Router# show macsec policy detail
Total Number of Policies = 1
--------------------------------------------------------
Policy Name : mp1
Cipher Suite : GCM-AES-XPN-256
Key-Server Priority : 10
Window Size : 64
Conf Offset : 50
Replay Protection : TRUE
Delay Protection : FALSE
Security Policy : Must Secure
Vlan Tags In Clear : 1
LACP In Clear : TRUE
LLDP In Clear : FALSE
Pause Frame In Clear : TRUE
Sak Rekey Interval : 60 seconds

The MACsec policy is updated to allow the specified packet exceptions in clear text, using the recommended allow commands for new configurations.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.