HPE FlexNetwork 5510 HI Series

462
MACsec applications
MACsec supports the following application modes:
• Client-oriented mode—Secures data transmission between the client and the access device.
In this mode, the authentication server generates and distributes the CAK-related parameters
to the client and the access device. In this mode, MACsec must operate with 802.1X
authentication.
Figure 138 Client-oriented mode
NOTE:
In client
-oriented mode, an MKA-enabled port on the access device must perform port-based
802.1X access control. The authentication method must be EAP relay.
• Device-oriented mode—Secures data transmission between devices. In this mode, the
devices do not perform identity authentication, and the same preshared key must be configured
on the MACsec ports that connect the devices. The devices use the configured preshared key
as the CAK.
Figure 139 Device-oriented mode
MACsec operating mechanism
Operating mechanism for client-oriented mode
Figure 140 illustrates how MACsec operates in client-oriented mode.
Authentication server
Client
Device
Device BDevice A