Configuration Guide for Cisco NCS 1014, IOS XR Releases 26.x.x
Is this content helpful?
Thank you for your feedback. Your response has been recorded.
AI responses are currently only available to logged in users. Log in
Only ask questions about this document. To ask questions about this product as a whole, go to Technical Documentation .
Suggestions
Sorry, we couldn't generate a response for this query.
Configuration Guide for Cisco NCS 1014, IOS XR Releases 26.x.x
Updated: September 23, 2026
Want to summarize with AI?
Log inProvides the workflow to provision the 800G service, configure keychains and policies, enable MACsec on the controller, optionally add fallback protection, and verify the encrypted session.
Configure MACsec encryption for an OXP2-K9 800G trunk by completing the required setup and MACsec-specific tasks in sequence.
MACsec encryption is configured and verified on the OXP2-K9 800G controller.
Create the key material that MKA uses to authenticate the peer and derive SAKs for data encryption.
Configure the same CKN, CAK, cryptographic algorithm, and compatible key lifetime on both MACsec peers.
Create the keychain and enter MACsec keychain configuration mode.
RP/0/RP0/CPU0:ios# configure
RP/0/RP0/CPU0:ios(config)# key chain keyChain_common
RP/0/RP0/CPU0:ios(config-keychain)# macsecCreate the CKN.
RP/0/RP0/CPU0:ios(config-keychain-macsec)# key 1234Configure the CAK and cryptographic algorithm.
RP/0/RP0/CPU0:ios(config-keychain-macsec-key)# key-string clear <64-hex-character-cak> cryptographic-algorithm aes-256-cmacConfigure the key lifetime.
RP/0/RP0/CPU0:ios(config-keychain-macsec-key)# lifetimeCommit the configuration.
RP/0/RP0/CPU0:ios(config-keychain-macsec-key)# commitVerify the keychain in the running configuration.
RP/0/RP0/CPU0:ios# show running-config key chain keyChain_commonThe primary MACsec keychain is configured and available for controller configuration.
Define the MACsec data-plane protection and key server behavior for the encrypted 800G link.
If you apply MACsec without a user-defined policy, the system uses the default values: GCM-AES-XPN-256, CONF-OFFSET-0, must-secure, and key server priority 16.
Create a MACsec policy.
RP/0/RP0/CPU0:ios(config)# macsec-policy mac_policyConfigure the confidentiality offset.
RP/0/RP0/CPU0:ios(config-macsec-policy)# conf-offset CONF-OFFSET-0Configure strict traffic protection.
RP/0/RP0/CPU0:ios(config-macsec-policy)# security-policy must-secureConfigure the MACsec cipher suite.
RP/0/RP0/CPU0:ios(config-macsec-policy)# cipher-suite GCM-AES-XPN-256Configure the SAK rekey interval.
RP/0/RP0/CPU0:ios(config-macsec-policy)# sak-rekey-interval seconds 3600Configure the key server priority.
RP/0/RP0/CPU0:ios(config-macsec-policy)# key-server-priority 8Commit the configuration.
RP/0/RP0/CPU0:ios(config-macsec-policy)# commitThe MACsec policy is configured and ready to apply to an EightHundredGigECtrlr controller.
Enable the controller to start MKA negotiation and protect 800G traffic with MACsec encryption.
Before you enable MACsec on the controller, ensure that:
The 800G client service, AppSel code, and optical frequency are configured.
The primary MACsec keychain is configured on both peers.
The MACsec policy is configured on both peers.
Enter configuration mode.
RP/0/RP0/CPU0:ios# configureEnter the 800G controller configuration mode.
RP/0/RP0/CPU0:ios(config)# controller EightHundredGigECtrlr0/0/0/30/31To configure MACsec on the Ethernet controllers of OXP2-K9 line cards, follow this hardware interface naming convention. For non-breakout ports, use a controller name with five tuple values in the format: EightHundredGigECtrlrR/S/I/<trunk>/<client> . On OXP2-K9 line cards, the trunk value is an even-numbered port, while the client value is an odd-numbered port.
Apply the MACsec keychain and policy.
RP/0/RP0/CPU0:ios(config-EightHundredGigECtrlr)# macsec psk-keychain keyChain_common policy mac_policyCommit the configuration.
RP/0/RP0/CPU0:ios(config-EightHundredGigECtrlr)# commitRepeat the controller configuration on the far-end peer.
After both endpoints are configured, the MACsec session can move from Init to Secured state.
Add a backup keychain for MACsec session continuity during primary key expiration, deletion, or mismatch.
Configure a fallback key lifetime that starts at the same time as, or overlaps with, the primary key lifetime. An infinite end lifetime is recommended when the operational policy allows it.
Create the fallback keychain and enter MACsec keychain configuration mode.
RP/0/RP0/CPU0:ios# configure
RP/0/RP0/CPU0:ios(config)# key chain fallback_keyChain
RP/0/RP0/CPU0:ios(config-keychain)# macsecCreate the fallback CKN.
RP/0/RP0/CPU0:ios(config-keychain-macsec)# key 9994Configure the fallback CAK and cryptographic algorithm.
RP/0/RP0/CPU0:ios(config-keychain-macsec-key)# key-string clear <64-hex-character-cak> cryptographic-algorithm aes-256-cmacConfigure the fallback key lifetime.
RP/0/RP0/CPU0:ios(config-keychain-macsec-key)# lifetime 09:46:55 june 26 2026 infiniteApply the primary and fallback keychains to the controller.
RP/0/RP0/CPU0:ios(config)# controller EightHundredGigECtrlr0/0/0/0/1
RP/0/RP0/CPU0:ios(config-EightHundredGigECtrlr)# macsec psk-keychain keyChain_common fallback-psk-keychain fallback_keyChain policy mac_policyCommit the configuration.
RP/0/RP0/CPU0:ios(config-EightHundredGigECtrlr)# commitRepeat the fallback configuration on the far-end peer.
The controller has a primary MACsec keychain and a fallback keychain for session recovery.
Confirm that the MACsec session is secured and traffic is protected on the 800G controller.
Enter the show macsec mka summary command to review the session summary.
RP/0/RP0/CPU0:ios# show macsec mka summary
NODE: node0_RP0_CPU0
========================================================================================
Interface-Name Status Cipher-Suite KeyChain PSK/EAP CKN
========================================================================================
EhC0/2/0/28/29 Secured GCM-AES-XPN-256 keyChain_common PRIMARY 1234
Total MACSec Sessions : 1
Secured Sessions : 1
Pending Sessions : 0
Suspended Sessions : 0
Active Sessions : 0Enter the show macsec mka session command to verify peer and key server status.
Non-key server:
RP/0/RP0/CPU0:ios# show macsec mka session
NODE: node0_RP0_CPU0
===============================================================================================
Interface-Name Local-TxSCI #Peers Status Key-Server PSK/EAP CKN
===============================================================================================
EhC0/0/0/0/1 2c14.4d1d.6d00/0001 1 Secured NO PRIMARY 1234
Key server:
RP/0/RP0/CPU0:ios# show macsec mka session
NODE: node0_RP0_CPU0
===============================================================================================
Interface-Name Local-TxSCI #Peers Status Key-Server PSK/EAP CKN
===============================================================================================
EhC0/2/0/30/31 2c14.491d.6df0/1e1f 1 Secured YES PRIMARY 1234
Enter the show macsec mka session controller controller-type port command to verify detailed session status.
Non-key server:
RP/0/RP0/CPU0:ios# show macsec mka session controller EightHundredGigECtrlr 0/0/0/0/1 detail
MKA Detailed Status for MKA Session
===================================
Status: Secured - Secured MKA Session with MACsec
Local Tx-SCI : 2c14.4d1d.6d00/0001
Local Tx-SSCI : 1
Interface MAC Address : 2c14.4d1d.6d00
MKA Port Identifier : 1
Interface Name : EhC0/0/0/0/1
CAK Name (CKN) : B6A88FD2A98313B42866C094613B0D15
CA Authentication Mode : EAP
Keychain : NA (EAP mode)
Member Identifier (MI) : 23A4122F8852601422037272
Message Number (MN) : 13
Authenticator : NO
Key Server : NO
MKA Cipher Suite : AES-256-CMAC
Configured MACSec Cipher Suite : GCM-AES-XPN-256
Key Distribution Mode : SAK
Latest SAK Status : Rx & Tx
Latest SAK AN : 0
Latest SAK KI (KN) : DB0C8204B4D27BCB4E56227E00000001 (1)
Old SAK Status : FIRST-SAK
Old SAK AN : 0
Old SAK KI (KN) : FIRST-SAK (0)
SAK Transmit Wait Time : 0s (Not waiting for any peers to respond)
SAK Retire Time : 0s (No Old SAK to retire)
Time to SAK Rekey : NA
Time to exit suspension : NA
MKA Policy Name : mac_policy
Key Server Priority : 16
Delay Protection : FALSE
Replay Window Size : 64
Include ICV Indicator : FALSE
Confidentiality Offset : 0
Algorithm Agility : 80C201
SAK Cipher Suite : 0080C20001000004 (GCM-AES-XPN-256)
MACsec Capability : 3 (MACsec Integrity, Confidentiality, & Offset)
MACsec Desired : YES
# of MACsec Capable Live Peers : 1
# of MACsec Capable Live Peers Responded : 0
Live Peer List:
-------------------------------------------------------------------------------
MI MN Rx-SCI SSCI KS-Priority
-------------------------------------------------------------------------------
DB0C8204B4D27BCB4E56227E 12 2c14.491d.6de0/1c1d 2 16
Potential Peer List:
-------------------------------------------------------------------------------
MI MN Rx-SCI SSCI KS-Priority
-------------------------------------------------------------------------------
Peers Status:
Last Tx MKPDU : 2026 Aug 04 10:33:28.755
Peer Count : 1
RxSCI : 2C14491D6DE01C1D
MI : DB0C8204B4D27BCB4E56227E
Peer CAK : Match
Latest Rx MKPDU : 2026 Aug 04 10:33:28.755
Key server:
RP/0/RP0/CPU0:ios# show macsec mka session controller EightHundredGigECtrlr 0/0/0/0/1 detail
MKA Detailed Status for MKA Session
===================================
Status: Secured - Secured MKA Session with MACsec
Local Tx-SCI : 2c14.491d.6de0/1c1d
Local Tx-SSCI : 2
Interface MAC Address : 2c14.491d.6de0
MKA Port Identifier : 7197
Interface Name : EhC0/2/0/28/29
CAK Name (CKN) : B6A88FD2A98313B42866C094613B0D15
CA Authentication Mode : EAP
Keychain : NA (EAP mode)
Member Identifier (MI) : DB0C8204B4D27BCB4E56227E
Message Number (MN) : 13
Authenticator : YES
Key Server : YES
MKA Cipher Suite : AES-256-CMAC
Configured MACSec Cipher Suite : GCM-AES-XPN-256
Key Distribution Mode : SAK
Latest SAK Status : Rx & Tx
Latest SAK AN : 0
Latest SAK KI (KN) : DB0C8204B4D27BCB4E56227E00000001 (1)
Old SAK Status : FIRST-SAK
Old SAK AN : 0
Old SAK KI (KN) : FIRST-SAK (0)
SAK Transmit Wait Time : 0s (Not waiting for any peers to respond)
SAK Retire Time : 0s (No Old SAK to retire)
Time to SAK Rekey : 282s
Time to exit suspension : NA
MKA Policy Name : mac_policy
Key Server Priority : 16
Delay Protection : FALSE
Replay Window Size : 64
Include ICV Indicator : FALSE
Confidentiality Offset : 0
Algorithm Agility : 80C201
SAK Cipher Suite : 0080C20001000004 (GCM-AES-XPN-256)
MACsec Capability : 3 (MACsec Integrity, Confidentiality, & Offset)
MACsec Desired : YES
# of MACsec Capable Live Peers : 1
# of MACsec Capable Live Peers Responded : 1
# of MACSec Suspended Peers : 0
Live Peer List:
-------------------------------------------------------------------------------
MI MN Rx-SCI SSCI KS-Priority
-------------------------------------------------------------------------------
23A4122F8852601422037272 12 2c14.4d1d.6d00/0001 1 16
Potential Peer List:
-------------------------------------------------------------------------------
MI MN Rx-SCI SSCI KS-Priority
-------------------------------------------------------------------------------
Suspended Peer List:
-------------------------------------------------------------------------------
Rx-SCI SSCI
-------------------------------------------------------------------------------
Peers Status:
Last Tx MKPDU : 2026 Aug 04 10:33:43.441
Peer Count : 1
RxSCI : 2C144D1D6D000001
MI : 23A4122F8852601422037272
Peer CAK : Match
Latest Rx MKPDU : 2026 Aug 04 10:33:43.443
Confidentiality Offset : 0
Algorithm Agility : 80C201
SAK Cipher Suite : 0080C20001000004 (GCM-AES-XPN-256)
MACsec Capability : 3 (MACsec Integrity, Confidentiality, & Offset)
MACsec Desired : YES
# of MACsec Capable Live Peers : 1
# of MACsec Capable Live Peers Responded : 1
# of MACSec Suspended Peers : 0
Live Peer List:
-------------------------------------------------------------------------------
MI MN Rx-SCI SSCI KS-Priority
-------------------------------------------------------------------------------
23A4122F8852601422037272 12 2c14.4d1d.6d00/0001 1 16
Potential Peer List:
-------------------------------------------------------------------------------
MI MN Rx-SCI SSCI KS-Priority
-------------------------------------------------------------------------------
Suspended Peer List:
-------------------------------------------------------------------------------
Rx-SCI SSCI
-------------------------------------------------------------------------------
Peers Status:
Last Tx MKPDU : 2026 Aug 04 10:33:43.441
Peer Count : 1
RxSCI : 2C144D1D6D000001
MI : 23A4122F8852601422037272
Peer CAK : Match
Latest Rx MKPDU : 2026 Aug 04 10:33:43.443
Enter the show macsec mka controller controller-name detail command to verify controller programming and protected traffic status.
Non-key server:
RP/0/RP0/CPU0:ios# show macsec mka controller EightHundredGigECtrlr0/0/0/0/1 detail
Number of interfaces on node node0_RP0_CPU0 : 1
----------------------------------------------------
Interface Name : EightHundredGigECtrlr0/0/0/0/1
Interface Namestring : EightHundredGigECtrlr0/0/0/0/1
Interface short name : EhC0/0/0/0/1
Interface handle : 0x800055c
Interface number : 0x800055c
MacSecControlledIfh : 0x8000584
MacSecUnControlledIfh : 0x800058c
Interface MAC : 2c14.4d1d.6d00
Ethertype : 888E
EAPoL Destination Addr : 0180.c200.0003
MACsec Shutdown : FALSE
Config Received : TRUE
IM notify Complete : TRUE
MACsec Power Status : N/A
Interface CAPS Add : TRUE
RxSA CAPS Add : TRUE
TxSA CAPS Add : TRUE
SPIO Status : Attach Success
Principal Actor : Primary
Policy : mac_policy
SKS Profile : N/A
Traffic Status : Protected
EFD
Enabled : FALSE
Status : None
Rx SC 1
Rx SCI : 2c14491d6de01c1d
Rx SSCI : 2
Peer MAC : 2c:14:49:1d:6d:e0
Is XPN : YES
SC State : Provisioned
SAK State[0] : Provisioned
Rx SA Program Req[0] : 2026 Aug 04 10:33:12.881
Rx SA Program Rsp[0] : 2026 Aug 04 10:33:12.995
SAK Data
SAK[0] : ***
SAK Len : 32
SAK Version : 1
HashKey[0] : ***
HashKey Len : 16
Conf offset : 0
Cipher Suite : GCM-AES-XPN-256
CtxSalt[0] : db 0d 82 06 b4 d2 7b cb 4e 56 22 7e
CtxSalt Len : 12
ssci : 2
Tx SC
Tx SCI : 2c144d1d6d000001
Tx SSCI : 1
Active AN : 0
Old AN : 255
Is XPN : YES
Next PN : 1, 0, 0, 0
SC State : Provisioned
SAK State[0] : Provisioned
Tx SA Program Req[0] : 2026 Aug 04 10:33:13.122
Tx SA Program Rsp[0] : 2026 Aug 04 10:33:13.230
SAK Data
SAK[0] : ***
SAK Len : 32
SAK Version : 1
HashKey[0] : ***
HashKey Len : 16
Conf offset : 0
Cipher Suite : GCM-AES-XPN-256
CtxSalt[0] : db 0d 82 05 b4 d2 7b cb 4e 56 22 7e
CtxSalt Len : 12
ssci : 1
Key server:
RP/0/RP0/CPU0:ios# show macsec mka controller EightHundredGigECtrlr0/2/0/28/29 detail
Number of interfaces on node node0_RP0_CPU0 : 1
----------------------------------------------------
Interface Name : EightHundredGigECtrlr0/2/0/28/29
Interface Namestring : EightHundredGigECtrlr0/2/0/28/29
Interface short name : EhC0/2/0/28/29
Interface handle : 0x8000d9c
Interface number : 0x8000d9c
MacSecControlledIfh : 0x8000dc4
MacSecUnControlledIfh : 0x8000dcc
Interface MAC : 2c14.491d.6de0
Ethertype : 888E
EAPoL Destination Addr : 0180.c200.0003
MACsec Shutdown : FALSE
Config Received : TRUE
IM notify Complete : TRUE
MACsec Power Status : N/A
Interface CAPS Add : TRUE
RxSA CAPS Add : TRUE
TxSA CAPS Add : TRUE
SPIO Status : Attach Success
Principal Actor : Primary
Policy : mac_policy
SKS Profile : N/A
Traffic Status : Protected
EFD
Enabled : FALSE
Status : None
Rx SC 1
Rx SCI : 2c144d1d6d000001
Rx SSCI : 1
Peer MAC : 2c:14:4d:1d:6d:00
Is XPN : YES
SC State : Provisioned
SAK State[0] : Provisioned
Rx SA Program Req[0] : 2026 Aug 04 10:33:27.434
Rx SA Program Rsp[0] : 2026 Aug 04 10:33:27.563
SAK Data
SAK[0] : ***
SAK Len : 32
SAK Version : 1
HashKey[0] : ***
HashKey Len : 16
Conf offset : 0
Cipher Suite : GCM-AES-XPN-256
CtxSalt[0] : db 0d 82 05 b4 d2 7b cb 4e 56 22 7e
CtxSalt Len : 12
ssci : 1
Tx SC
Tx SCI : 2c14491d6de01c1d
Tx SSCI : 2
Active AN : 0
Old AN : 255
Is XPN : YES
Next PN : 1, 0, 0, 0
SC State : Provisioned
SAK State[0] : Provisioned
Tx SA Program Req[0] : 2026 Aug 04 10:33:27.684
Tx SA Program Rsp[0] : 2026 Aug 04 10:33:27.804
SAK Data
SAK[0] : ***
SAK Len : 32
SAK Version : 1
HashKey[0] : ***
HashKey Len : 16
Conf offset : 0
Cipher Suite : GCM-AES-XPN-256
CtxSalt[0] : db 0d 82 06 b4 d2 7b cb 4e 56 22 7e
CtxSalt Len : 12
ssci : 2
Optional: Enter the show macsec mka summary command after fallback configuration to verify the primary and fallback sessions.
Non-key server:
RP/0/RP0/CPU0:ios# show macsec mka summaryNODE: node0_RP0_CPU0
========================================================================================
Interface-Name Status Cipher-Suite KeyChain PSK/EAP CKN
========================================================================================
EhC0/0/0/0/1 Secured GCM-AES-XPN-256 keyChain_common PRIMARY 1234
EhC0/0/0/0/1 Active GCM-AES-XPN-256 fallback_keychain FALLBACK 7890
Total MACSec Sessions : 2
Secured Sessions : 1
Pending Sessions : 0
Suspended Sessions : 0
Active Sessions : 1Key server:
RP/0/RP0/CPU0:ios#show macsec mka summary
Wed Jul 8 08:22:01.098 UTC
NODE: node0_RP0_CPU0
========================================================================================
Interface-Name Status Cipher-Suite KeyChain PSK/EAP CKN
========================================================================================
EhC0/2/0/28/29 Secured GCM-AES-XPN-256 keyChain_common PRIMARY 1234
EhC0/2/0/28/29 Active GCM-AES-XPN-256 fallback_keychain. FALLBACK 7890
Total MACSec Sessions : 2
Secured Sessions : 1
Pending Sessions : 0
Suspended Sessions : 0
Active Sessions : 1
The MACsec session is secured when the session summary and detail outputs show Secured status, one live peer, the expected cipher suite, and protected controller traffic.
Need help?
(Requires a Cisco Service Contract)
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.