HPE FlexNetwork 5510 HI Series Security Configuration Guide

465
MACsec configuration task list
In device-oriented mode, the MACsec configuration takes effect on Layer 2 and Layer 3 Ethernet
ports. In client-oriented mode, the MACsec configuration takes effect only on 802.1X-enabled ports.
To configure MACsec, perform the following tasks:
Tasks at a glance
Remarks
(Required.) Enabling MKA N/A
(Optional.) Enabling MACsec desire N/A
(Optional.) Configuring a preshared key
This task is required in
device-oriented mode.
(Optional.) Configuring the MKA key server priority N/A
(Optional.) Use one of the following methods to configure MACsec
protection parameters:
• Configuring MACsec protection parameters in interface view:
 Configuring the MACsec confidentiality offset
 Configuring MACsec replay protection
 Configuring the MACsec validation mode
• Configuring MACsec protection parameters by MKA policy:
 Configuring an MKA policy
 Applying an MKA policy
N/A
Enabling MKA
MKA establishes and manages MACsec secure channels on a port. It also negotiates keys used by
MACsec.
You cannot enable MKA on a MACsec-incapable port.
To enable MKA:
Step
Command
Remarks
1. Enter system view.
system-view
N/A
2. Enter interface view.
interface
interface-type
interface-number
N/A
3. Enable MKA.
mka enable
By default, MKA is disabled on the
port.
Enabling MACsec desire
The MACsec desire feature expects MACsec protection for outbound frames. The key server
determines whether MACsec protects the outbound frames.
MACsec protects the outbound frames of a port when the following requirements are met:
• The key server is MACsec capable.
• Both the local participant and its peer are MACsec capable.

HPE FlexNetwork 5510 HI Series Specifications

General

Brand	HPE
Model	FlexNetwork 5510 HI Series
Category	Switch
Language	English