MACsec application modes

MACsec supports client-oriented and device-oriented modes.

Client-oriented mode

As shown in Figure 176, MACsec secures data transmission between the client and the access device. In this mode, MACsec must operate with 802.1X authentication.

Client-oriented MACsec includes the following entities:

Figure 176: Client-oriented mode


[NOTE: ]

NOTE:

In client-oriented mode, an MKA-enabled port on the access device must perform port-based 802.1X access control. The authentication method must be EAP relay.


Device-oriented mode

As shown in Figure 177, MACsec secures data transmission between devices. In this mode, the devices do not perform identity authentication, and the same preshared key must be configured on the MACsec ports that connect the devices. The devices use the configured preshared key as the CAK.

Figure 177: Device-oriented mode