Configuring MACsec protection parameters in interface view

Enter system view.

system-view

Enter interface view.

interface interface-type interface-number

Set the MACsec confidentiality offset.

macsec confidentiality-offset offset-value

The default setting is 0, and the entire frame needs to be encrypted.

MACsec uses the confidentiality offset propagated by the key server.

Configure MACsec replay protection:

1. Enable MACsec replay protection.

   macsec replay-protection enable

   By default, MACsec replay protection is enabled on the port.

2. Set the MACsec replay protection window size.

   macsec replay-protection window-size size-value

   The default setting is 0. The device accepts only frames that arrive in the correct order. Out-of-order or duplicated frames will be dropped.

   The configured replay protection window size takes effect only when MACsec replay protection is enabled.

Set a MACsec validation mode.

macsec validation mode { check| strict }

The default setting is check.

To avoid data loss, use the display macsec command to verify that MKA negotiation with the peer device has succeeded before you change the mode to strict.