Show commands

Show command for MACsec policies

Syntax

show macsec policy <policy-name>

Shows one or more MACsec policies.

policy-name

A MACsec policy name up to 32 characters long.

show macsec policy

switch(config)# show macsec policy
Configuration - MACsec Policy
Policy Name : policy1
Cipher Suite      : AES-GCM-128
Include-SCI       : Yes
Confidentiality   : On             Confidentiality offset   : 0
Replay-Protection : On             Replay-Protection Window : 0
Mode : pre-shared-key (PSK)
CKN  : abcd
CAK  : abcd
Policy Name : macsecpolicy5
Cipher Suite      : AES-GCM-128
Include-SCI       : No
Confidentiality   : Off            Confidentiality offset   : 0
Replay-Protection : On             Replay-Protection Window : 0
Mode : pre-shared-key (PSK)
CKN  : abcd11111111121212121212abcd3434
CAK  : abab121212121212abcd34343434121212121212abcd34343434abcdefabcdef

show macsec policy Policy1

switch(config)# show macsec policy Policy1
Configuration - MACsec Policy
Policy Name : policy1
Cipher Suite      : AES-GCM-128
Include-SCI       : Yes
Confidentiality   : On             Confidentiality offset   : 0
Replay-Protection : On             Replay-Protection Window : 0
Mode : pre-shared-key (PSK)
CKN  : abcd
CAK  : abcd

Command validations

Validation	Error/Warning/Prompt
Check whether the policy with the name exists.	MACsec policy %s does not exist.
There are no MACsec policies configured on the system.	No MACsec policy is found.

Details


	NOTE: In Manager mode.

Condition	Behavior
Include-credentials enabled/disabled	CAK value is displayed in plaintext format.
Encrypt-credentials enabled/disabled	CAK value is displayed in plaintext format.
In Enhanced Secure Mode (FIPS)	A dialogue is provided to proceed with display of sensitive information and only on a consent to proceed, policy details are displayed.

Show command for MACsec status

Syntax

show macsec status

Show the status of all MACsec-enabled ports.

status

Show the status of all MACsec-enabled ports.

show macsec status

switch(config)# show macsec status

Status and Configuration - MACsec Protocol
Interface  Policy                           Mode    Status Protection
 --------- -------------------------------- ------- ------ ---------------
 A2        policy1                          PSK     Up     Confidentiality
 L22       policy1                          PSK     Down   Confidentiality

Command validation

Validation	Error/Warning/Prompt
MACsec is not enabled on ports.	MACsec is not enabled on any port.

Show command for MACsec status on a port

Syntax

show macsec status <port-num>
Show the status of all MACsec-enabled ports.

show macsec status

switch(config)# show macsec status A1

show command output

switch(config)# show macsec status A1
Status and Configuration - MACsec Protocol
Interface : A1
Policy       : Policy1
Transmitting : Yes
Receiving    : Yes
Protection   : Confidentiality
Transmit secure Channel
SCI                  : 000C29F6A4380004c
Secure Association
Association Number : 1 (old)
KI               : 4F18CE25228178FD15976E4C
LPN                : 2
SA-Start-time      : 01:02:19 
SA-Stop-time       : 02:04:29
Association Number : 0 (current)
KI               : 4F18CE25228178FD15976E4C
LPN                : 3
SA-Start           : 04:05:11
SA-Stop-time       : 04:10:12
Receive secure Channel
SCI                  : 000C29F6A4380003b
Secure Association
Association Number : 0 (current)
KI               : 4F18CE29456aefFD15976E4C
LPN                : 121198
SA-Start           : 04:05:12
SA-Stop-time       : 04:10:13

Validation	Error/Warning/Prompt
Check whether MACsec is enabled on the port.	MACsec is not enabled on port %s.

Show command for MACsec statistics

Syntax

show macsec statistics <port-num>

statistics	Show MACsec statistics.
[ethernet] PORT-NUM	The port to show MACsec statistics for.

Show macsec statistics

switch(config)# show macsec statistics

Status and Counters - MACsec Protocol
 Interface : A1
 Receive Statistics
Totals (Since boot or last clear) :
Bytes Received        : 234435
Unicast Packets       : 0 
Multicast Packets     : 0
Broadcast Packets     : 0
Errors (Since boot or last clear) :
Discarded Packets     : 0
Crypto Overruns      : 0
Packets With No Tag  : 0
Erroneous Packets     : 0
Packets With Bad Tag : 0
Packets With No SCI  : 0

Transmit Statistics
Totals (Since boot or last clear) :
Bytes Transmitted     : 28733989
Unicast Packets       : 0
Multicast Packets     : 0
Broadcast Packets     : 0
Errors (Since boot or last clear) :
Erroneous Packets     : 0
Packets Too Long      : 0
Interface : A2
Receive Statistics
Totals (Since boot or last clear) : 
Bytes Received        : 234435
Unicast Packets       : 0 
Multicast Packets     : 0
Broadcast Packets     : 0
Errors (Since boot or last clear) :
Discarded Packets     : 0
Crypto Overruns      : 0
Packets With No Tag  : 0
Erroneous Packets     : 0
Packets With Bad Tag : 0
Packets With No SCI  : 0

Transmit Statistics
Totals (Since boot or last clear) :
Bytes Transmitted     : 28733989 
Unicast Packets       : 0
Multicast Packets     : 0 
Broadcast Packets     : 0
Errors (Since boot or last clear) :
Erroneous Packets     : 0
Packets Too Long      : 0

Show macsec statistics A1

switch(config)# show macsec statistics A1
Status and Counters - MACsec Protocol
Interface : A1
Receive Statistics
Totals (Since boot or last clear) :  
Bytes Received        : 234435
Unicast Packets       : 0
Multicast Packets     : 0
Broadcast Packets     : 0
Errors (Since boot or last clear) :
Discarded Packets     : 0
Crypto Overruns      : 0
Packets With No Tag  : 0
Erroneous Packets     : 0
Packets With Bad Tag : 0
Packets With No SCI  : 0

Transmit Statistics
Totals (Since boot or last clear) :
Bytes Transmitted     : 28733989
Unicast Packets       : 0
Multicast Packets     : 0
Broadcast Packets     : 0
Errors (Since boot or last clear) :
Erroneous Packets     : 0
Packets Too Long      : 0

Command validations


	NOTE: In Manager mode.

Validation	Error/Warning/Prompt
Check whether MACsec is enabled on the port.	MACsec is not enabled on port %s.

Show command for detailed MACsec statistics on a port

Syntax

show macsec statistics <port-num> detail

Show detailed statistics for a MACsec-enabled port.

statistics	Show MACsec statistics.
detail	Show detailed statistics for a MACsec-enabled port.
[ethernet] PORT-NUM	The port to show MACsec statistics for.

show macsec statistics A1 detail

switch(config)# show macsec statistics A1 detail

Status and Counters - MACsec Protocol
Interface : A1
Receive Statistics
Totals (Since boot or last clear) :  
Bytes Received        : 234435
Unicast Packets       : 0
Multicast Packets     : 0
Broadcast Packets     : 0
Errors (Since boot or last clear) :
Discarded Packets     : 0
Crypto Overruns      : 0
Packets With No Tag  : 0
Erroneous Packets     : 0

Packets With Bad Tag : 0
Packets With No SCI  : 0

Transmit Statistics
Totals (Since boot or last clear) :
Bytes Transmitted     : 28733989
Unicast Packets       : 0
Multicast Packets     : 0 
Broadcast Packets     : 0
Errors (Since boot or last clear) :
Erroneous Packets     : 0
Packets Too Long      : 0

Secure Channel Transmit Statistics
Encrypted Packets    : 0
Bytes Protected      : 0 
Bytes Encrypted      : 0

Secure Association Statistics
Association Number   : 0 (old)
Protected Packets  : 0

Encrypted Packets  : 0
Association Number   : 1 (current)
Protected Packets  : 0
Encrypted Packets  : 0

Secure Channel Receive Statistics
Not using SA         : 0
Late                 : 0
Not Valid            : 0
Delayed              : 0
Valid                : 0
Bytes Validated      : 0
Bytes Decrypted      : 0

Secure Association Statistics
Association Number   : 1 (current)
Not using SA        : 0
Not Valid           : 0
Valid               : 0

Command validations


	NOTE: In Manager mode.

Validation	Error/Warning/Prompt
Check whether MACsec is enabled on the port.	MACsec is not enabled on port %s.

Show command for MKA status

Syntax

show port-access mka status <port-num>

Show the MKA protocol status information.

show port-access authenticator [...]|supplicant [...]|summary [...]| mka...

Show 802.1X (Port Based Network Access) supplicant or authenticator current status and configuration.

[ethernet] PORT-LIST	Show Web/MAC Authentication statistics and configuration.
authenticator	Show 802.1X (Port Based Network Access) authenticator current status, configuration or last session counters.
config	Show status of 802.1X, Web Auth, and MAC Auth configurations.
local-mac	Show Local MAC Authentication statistics and configuration.
mac-based	Show MAC Authentication statistics and configuration.
mka	Show the MKA protocol information.
summary	Show summary configuration information for all ports, including that overridden by RADIUS attributes.
supplicant	Show 802.1X (Port Based Network Access) supplicant current status and configuration.
web-based	Show Web Authentication statistics and configuration.
statistics	Show the MKA statistics.
status	Show the MKA protocol status information.

Show port-access mka status

switch(config)# show port-access mka status
Status and Configuration - MKA Protocol
Interface : A2 
Port MAC Address      : f0921c-4576fe 
MKA Session Status    : Secured  
CKN                   : abcd                            
MI                    : 1c64f054f894b5482defdf81 
MN                    : 86      
Capability            : IC, Conf, Offset 0  
Transmit Interval     : 2  
Key Server Priority   : 16 
Key Server            : No 

Live Peer List: 

MI                       MN       PRI Capability            Rx-SCI          
------------------------ -------- --- --------------------- ----------------
fb7f82788e4cd38dbc65dc55 119      16  IC, Conf, Offset 0    a45d36489bfe0002

Potential Peer List:
MI                       MN       PRI Capability            Rx-SCI          
 ------------------------ -------- --- --------------------- ----------------

Interface : L2 
Port MAC Address      : f0921c-4576fe
MKA Session Status    : Secured
CKN                   : abcdefabcd
MI                    : 1c64f054f894b5482defdf81
MN                    : 86 
Capability            : IC, Conf, Offset 0  
Transmit Interval     : 2 
Key Server Priority   : 16 
Key Server            : No

Live Peer List: 
   MI                       MN       PRI Capability            Rx-SCI
------------------------ -------- --- --------------------- ----------------
fb7f82788e4cd38dbc65dc55 119      16  IC, Conf, Offset 0    a45d36489bfe0002

Potential Peer List: 
    MI                       MN       PRI Capability            Rx-SCI
------------------------ -------- --- --------------------- ----------------

Show port-access MKA status A2

switch(config)# show port-access mka status A2
Status and Configuration - MKA Protocol
Interface : A2 
Port MAC Address      : f0921c-4576fe  
MKA Session Status    : Secured
CKN                   : abcd
MI                    : 1c64f054f894b5482defdf81 
MN                    : 86
Capability            : IC, Conf, Offset 0  
Transmit Interval     : 2
Key Server Priority   : 16 
Key Server            : No

Live Peer List: 
MI                       MN       PRI Capability            Rx-SCI          
------------------------ -------- --- --------------------- ----------------
fb7f82788e4cd38dbc65dc55 119      16  IC, Conf, Offset 0    a45d36489bfe0002

Potential Peer List: 
MI                       MN       PRI Capability            Rx-SCI          
------------------------ -------- --- --------------------- ----------------

Command validations


	NOTE: In Operator mode.

Validation	Error/Warning/Prompt
Check whether MACsec is enabled on the port.	MACsec is not enabled on port %s.

Show command for MKA statistics

Syntax

show port-access mka statistics <port-num>
Show the MKA statistics. When a PORT-NUM is used, the MKA statistics of the selected port are shown.

[ethernet] PORT-LIST
Show Web/MAC Authentication statistics and configuration.

authenticator
Show 802.1X (Port Based Network Access) authenticator current status, configuration or last session counters.

config
Show status of 802.1X, Web Auth, and MAC Auth configurations.

local-mac
Show Local MAC Authentication statistics and configuration.

mac-based
Show MAC Authentication statistics and configuration.

mka
Show the MKA protocol information.

summary
Show summary configuration information for all ports, including that overridden by RADIUS attributes.

supplicant
Show 802.1X (Port Based Network Access) supplicant current status and configuration.

web-based
Show Web Authentication statistics and configuration.

statistics
Show the MKA statistics.

status
Show the MKA protocol status information.

[ethernet] PORT-NUM
Specify the port number.
Show port-access MKA statistics
switch(config)# show port-access mka statistics
Status and Counters - MKA Protocol
CAs Established : 32
CAs Deleted     : 1
Interface : A1
  Tx MKPDUs                    : 16534893
  Rx MKPDUs                    : 16534893
  SAKs Distributed             : 0
  SAKs Received                : 0 
  MKPDUs With Invalid Version  : 0
  MKPDUs With Invalid CKN      : 0 
  MKPDUs With Invalid ICV      : 0 
  MKPDUs With Duplicate MI     : 0 
  MKPDUs With Invalid MN       : 0 
 Interface : A2
  Tx MKPDUs                    : 16534893 
  Rx MKPDUs                    : 16534893
  SAKs Distributed             : 0
  SAKs Received                : 0 
  MKPDUs With Invalid Version  : 0
  MKPDUs With Invalid CKN      : 0 
  MKPDUs With Invalid ICV      : 0 
  MKPDUs With Duplicate MI     : 0 
  MKPDUs With Invalid MN       : 0
Show port-access MKA statistics A1
switch(config)# show port-access mka statistics A1
Status and Counters - MKA Protocol
Interface : A1
  Tx MKPDUs                    : 16534893
  Rx MKPDUs                    : 16534893
  SAKs Distributed             : 0
  SAKs Received                : 0 
  MKPDUs With Invalid Version  : 0
  MKPDUs With Invalid CKN      : 0 
  MKPDUs With Invalid ICV      : 0
  MKPDUs With Duplicate MI     : 0
   MKPDUs With Invalid MN       : 0 

Command validations


	NOTE: In Operator mode.

Validation	Error/Warning/Prompt
Check whether MACsec is enabled on the port (in case where the Port-Num is given)	MACsec is not enabled on port %s.
Check whether MACsec is enabled on any port.	MACsec is not enabled on any port.

Show tech command

Syntax

show tech macsec status|statistics
Show tech MACsec for either status or statistics.

prev	up	next
MACsec configuration commands	home	Mutually exclusive commands with MACsec configuration on a port

Show commands

Show command for MACsec policies

​Syntax

Command validations

Details

Show command for MACsec status

​Syntax

Command validation

Show command for MACsec status on a port

​Syntax

Show command for MACsec statistics

​Syntax

Command validations

Show command for detailed MACsec statistics on a port

​Syntax

Command validations

Show command for MKA status

​Syntax

Command validations

Show command for MKA statistics

​Syntax

Command validations

Show tech command

​Syntax

Syntax

Syntax

Syntax

Syntax

Syntax

Syntax

Syntax

Syntax