Configuring MACsec protection parameters in interface view
Enter system view.
system-view
Enter interface view.
interface interface-type interface-number
Set the MACsec confidentiality offset.
macsec confidentiality-offset offset-value
The default setting is 0, and the entire frame needs to be encrypted.
MACsec uses the confidentiality offset propagated by the key server.
Configure MACsec replay protection:
Enable MACsec replay protection.
macsec replay-protection enable
By default, MACsec replay protection is enabled on the port.
Set the MACsec replay protection window size.
macsec replay-protection window-size size-value
The default setting is 0. The device accepts only frames that arrive in the correct order. Out-of-order or duplicated frames will be dropped.
The configured replay protection window size takes effect only when MACsec replay protection is enabled.
Set a MACsec validation mode.
macsec validation mode { check| strict }
The default setting is check.
To avoid data loss, use the display macsec command to verify that MKA negotiation with the peer device has succeeded before you change the mode to strict.
Parameter
Description
check
Verifies incoming frames but does not drop illegal frames.
strict
Verifies incoming frames and drops illegal frames.