MACsec Encryption

MACsec encryption

Explains how MACsec authenticates and encrypts Ethernet traffic on switch-to-host and switch-to-switch links to protect data confidentiality and integrity, and describes link-layer security elements and MACsec support available on different switch port connections.

MACsec key agreement

Explains how the MACsec Key Agreement (MKA) protocol supplies session and encryption keys for MACsec after authentication and manages peer discovery, mutual authentication, and key distribution within EAPOL-based wired networks.

Certificate-based MACsec MKA

Describes certificate-based MACsec MKA for switch-to-switch uplinks, where device certificates enable mutual authentication and an MSK is used to derive the connectivity association key (CAK) for MKA operations. Explains release support beginning with the Cisco IOS XE 17.13.1 release.

Switch-to-switch MKA MACsec must-secure policy

Describes the must-secure policy for switch-to-switch MKA MACsec, where ingress and egress are secured, only EAPoL remains unencrypted, all other traffic is encrypted, unencrypted packets are dropped, and the mode is enabled by default.

MKA and MACsec for port channels

Describes how MKA and MACsec operate on port channel member ports, where MKA sessions form between individual member ports. Explains PSK-based MACsec support, lack of certificate-based support, and security considerations when enabling MACsec across all member links.

MACsec cipher announcements

Describes MACsec cipher announcements, which let the supplicant and authenticator exchange MACsec cipher suite capabilities, negotiate the largest common suite for MKA keying, and validate capabilities through unsecured EAPoL PDUs and secure MKPDUs during authentication.

How to configure MACsec encryption

Configure MACsec encryption to secure Ethernet traffic using MKA policies.

Additional references for MACsec encryption

Lists standards and references for MACsec encryption, including IEEE 802.1AE, 802.1X, and RFC 4493, and provides a link to Cisco Support resources for troubleshooting, product alerts, newsletters, and RSS feeds that require a Cisco.com user ID.

Feature history for MACsec encryption

Provides feature history and release details for MACsec encryption and certificate-based MACsec encryption on Cisco platforms, including release versions, feature descriptions, and platform support notes. Provides a link to Cisco Feature Navigator for platform and software image support information.

Overview of PQC for MACsec with EAP-TLS

Describes what Post Quantum Cryptography is and how it functions with MACsec encryption with EAP-TLS.

Key elements of PQC

Explains the key elements of Post-Quantum Cryptography for MACSec with EAP-TLS.

PQC implementation in EAP-TLS

Explains MACsec encryption with EAP-TLS secures switch-to-switch communication by using certificate-based mutual authentication to derive cryptographic keys. These keys are then managed by the MACsec Key Agreement (MKA) protocol to ensure data confidentiality and integrity across Ethernet interfaces.

Prerequisites

Specifies the prerequisites before you configure Post-Quantum Cryptography for MACSec with EAP-TLS.

Restrictions

Provides the limitations for configuring Post-Quantum Cryptography in MACSec with EAP-TLS.

Configuration matrix for MACsec with EAP-TLS

Provides details about the protocol and TLS version matrix for Post-Quantum Cryptography to function as expected for EAP-TLS.

Workflow to set up PQC for MACsec with EAP-TLS

Describes how an authenticator and a supplicant can complete EAP-TLS authentication using ML-KEM for the TLS key exchange. This process results in the establishment of a secure MACsec session.

Configure EAP-TLS 1.3

Describes the steps to configure TLS version 1.3.

Configure PQC for EAP-TLS sessions

Explains the procedure to enable Post-Quantum Cryptography for EAP-TLS sessions.

Verify PQC for EAP-TLS sessions

Provides the verification commands to check whether Post-Quantum Cryptography implementation is successful for EAP-TLS sessions.