Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.x

Auto MACsec for wireless APs

Updated: September 14, 2026

Want to summarize with AI?

Log in

Introduces Auto MACsec for wireless APs, detailing peer detection via LLDP, 802.1X authentication, encrypted link establishment, default settings, onboarding processes, compatibility requirements, and instructions for disabling the feature in AP join profiles.

Auto MACsec is a link-security capability that

  • detects a compatible peer through LLDP

  • authenticates the AP through 802.1X using a hardware-backed identity, and

  • establishes hop-by-hop MACsec protection before the AP joins the wireless controller.

Auto MACsec reduces the manual configuration required to protect the wired uplink between a wireless AP and its directly connected access switch. The encrypted link helps protect traffic on the last network hop from interception and man-in-the-middle attacks.

Auto MACsec peer detection functionality is supported on Wi-Fi 7 APs equipped with MACsec-capable physical layer (PHY) interfaces.

Note

Cisco IOS XE 26.2 uses LLDP for Auto MACsec peer detection.

During initial Auto MACsec onboarding, the access point can use its hardware SUDI when no locally significant certificate (LSC) or other port-authentication configuration is available.

This feature supports Day 0 APs and APs that do not have an 802.1X username or MACsec preshared key (PSK) configured.

Auto MACsec is enabled by default. If an AP does not have an 802.1X username or MACsec PSK configuration, it automatically attempts to establish an Auto MACsec connection.

You can disable Auto MACsec in the AP join profile. If the AP currently uses an Auto MACsec connection, disabling the feature immediately interrupts the connection and causes the AP to rejoin. If the AP cannot recover, verify the switch configuration and remove the corresponding Auto MACsec configuration from the switch.

If an AP has an 802.1X username or MACsec PSK configured, it uses that configuration instead of Auto MACsec, even when Auto MACsec is enabled.

Benefits of auto MACsec

Outlines how auto MACsec improves network security and simplifies deployment through automated discovery, authentication, and configuration.

Automatic MACsec provides these benefits:

  • Encrypts traffic between a supported access point and access switch.

  • Mitigates packet snooping and man-in-the-middle attacks on the last network hop.

  • Discovers Auto MACsec-capable access points automatically through LLDP.

  • Applies the required switch access-session configuration automatically.

  • Uses HW SUDI to authenticate a new access point without requiring a previously provisioned access-point identity.

  • Reduces manual MACsec configuration on individual access-point-facing ports.

  • Supports access-port deployments and customized trunk-port deployments.

  • Rediscovers and resecures validated access-point links after a switch reload.

Enable auto MACsec (GUI)

Enable auto MACsec to ensure secure wired communication between access points and their connected switches using MACsec encryption.

Auto MACsec simplifies the process of enabling secure link encryption for access points. By following these instructions, you configure an AP join profile to automatically enable MACsec, protecting data on the wired interface and preventing replay attacks.

Procedure

  1. Choose Configuration > Tags & Profiles > AP Join.

  2. Click Add to create an AP join profile or edit the AP Join Profile assigned to your AP.

  3. In the AP join profile page, click the AP tab.

  4. In the General tab, under the AP MACsec Configuration section, complete these steps:

    1. MACsec: Enable or disable MACsec on the AP wired interface. By default, MACsec is disabled. When enabled, communication between the AP and the connected switch is secured using MACsec encryption.
    2. Replay Protection Window Size: Enter a value to configure the security parameter that defines how many sequence numbers (packets) can arrive out of order and still be accepted before the device starts treating them as replay attacks and drops them. The range is from 0 to 4294967295.
    3. Pre-Shared Key Chain: Select a Pre-Shared Key Chain. Choose the key chain configured earlier in the Add Key Chain window.
    4. Auto MACsec: Indicates whether automatic MACsec link encryption is enabled on the AP. By default, Auto MACsec is enabled.

  5. Click Update & Apply to Device.

Auto MACsec is successfully enabled on the access point, securing wired communication with the connected switch using MACsec encryption.

Enable auto MACsec in AP join profile (CLI)

Secure AP wired interfaces by enabling automatic MACsec within the AP join profile.

Procedure

  1. Enter the global configuration mode.

    Example:

    Device# configure terminal

  2. Configure an AP profile and enter AP profile configuration mode.

    Example:

    Device (config)# ap profile profile-name

  3. Enable auto MACsec on the AP wired interface.

    Example:

    Device (config-ap-profile)# [no] auto secure macsec

    Use the no form of this command to disable the feature.

The AP join profile is configured to automatically enable MACsec encryption on the wired interface of access points, enhancing network security.

Verify auto MACsec

Provide clear criteria and methods for verifying the proper operation and security status of auto MACsec on network devices, helping users assess whether auto MACsec is correctly configured and functioning.

To view the MACsec configuration summary for all APs, use this command:

Device# show ap macsec summary
Capability Codes:
(M) MACSec, (A) Auto-MACSec

AP Name                           AP Mac                        Capability     Auto        Port 0          Port 1  
-----------------------------------------------------------------------------------------------------------------
AP6849.926F.A870         10a8.29f3.d9a0                             M          Disabled   NA                  NA  
AP780F.819F.2140          2c65.8db6.e0e0                            M,A         Disabled   SUCCESS       UNKNOWN  
APF01D.2DB7.4138         84f1.476e.0b40                             -           Disabled    NA                 NA

To view the common information for a particular Cisco AP, use this command:

Device# show ap name Cisco-AP config general
Macsec Capability                               : Capable
  Auto MACsec                                   : Disabled
  Port 0
    Macsec Status                               : SUCCESS
    Macsec Ciphersuite                          : GCM_AES_128
  Port 1
    Macsec Status                               : UNKNOWN
    Macsec Ciphersuite                          : GCM_AES_128

Recovery for Auto MACsec

Summary

The recovery process for Auto MACsec addresses issues where an Access Point (AP) fails to join a controller or obtain an IP address due to Auto-MACsec configuration mismatches. The process involves verifying switch and AP configurations, identifying handshake or MACsec failures, temporarily disabling Auto-MACsec on the switch interface to allow the AP to reboot and connect without MACsec security, and then restoring the MACsec configuration after confirming connectivity and controller settings.

Workflow

  1. Verify switch-side configuration: Run these commands on the switch to check interface status and MACsec sessions.

    • show interface <interface_id> status

    • show macsec interface <interface_id>

    • show run interface <interface_id>

    • show derived-config interface <interface_id>

  2. Verify AP-side status: On the Access Point, check MACsec and authentication status.

    • show macsec status

    • show ap authentication status details

  3. Look for EAP handshake failures or MACsec failures in the outputs.

  4. Trigger recovery mode: Temporarily disable Auto MACsec on the switch interface by executing: 
    shutdown
no access-session interface-template sticky
access-session inherit disable interface-template-sticky
no auto detect macsec
no shutdown

    This allows the AP to reboot, obtain an IP address, and join the Wireless LAN Controller without MACsec security.

  5. Restore connectivity: Verify controller management settings with show ip http secure-server status command.

    Ensure secure access policies are not blocking discovery.

  6. Reapply MACsec configuration:

    • Confirm the configuration template and MKA parameters are correct on the switch.

    • Re-enable Auto MACsec on the switch port.

Result

This workflow ensures recovery from Auto-MACsec configuration mismatches by temporarily disabling MACsec to restore network connectivity and then re-enabling it after verification.