HPE FlexNetwork 5510 HI Series

469
Step
Command
Remarks
The settings for parameters in the
default policy are the same as the
default settings for the parameters
on a port.
You cannot delete or modify the
default MKA policy.
You can create
multiple MKA
policies.
3. (Optional.)
Configure the
MACsec confidentiality
offset.
macsec confidentiality-offset
offset-value
The default setting is 0.
MACsec uses t
he confidentiality
offset propagated
by the key
server.
4. (Optional.) Configure
MACsec replay protection.
a.
Enable MACsec replay
protection:
replay-protection
enable
b. Set the replay protection
window size:
replay-protection
window-size size-value
By default,
MACsec replay
protection is enabled.
The default replay protection
window size is 0. F
rames are
accepted only in the correct order.
5.
Configure the MACsec
validation mode.
validation mode
{
check
|
disabled
|
strict
}
In the current software version,
only the
strict
mode is supported.
Applying an MKA policy
MKA policy provides a centralized method to configure MACsec confidentiality offset, replay
protection, and validation mode. An MKA policy can be applied to a port or multiple ports. When you
apply an MKA policy to a port, follow these restrictions and guidelines:
• The MACsec parameter settings configured in the MKA policy overwrite the MACsec
parameters previously configured on the port.
• Any modifications to the MKA policy take effect immediately.
• When you remove an MKA policy application from the port, the MACsec parameter settings on
the port restore to the default.
• When you apply a nonexistent MKA policy to the port, the port automatically uses the default
MKA policy. If you create the policy, the policy will be automatically applied to the port.
To apply an MKA policy to a port:
Step
Command
Remarks
1. Enter system view.
system-view
N/A
2. Enter interface view.
interface
interface-type
interface-number
N/A
3. Apply an MKA policy.
mka apply policy
policy-name
By default, no MKA policy is
applied to the port.
Displaying and maintaining MACsec
Execute display commands in any view and reset commands in user view.