Protect frames between MACsec peers
IEEE 802.1AE MACsec authenticates the origin of protected Ethernet frames and checks their integrity. With confidentiality enabled, it also encrypts the protected payload. Packet numbers support replay protection. The protection ends at the receiving MACsec peer, so traffic beyond that point needs its own protection.
MACsec Key Agreement (MKA), specified in IEEE 802.1X, helps peers establish secure associations and distribute the keys used to protect frames. Port authorization answers whether an endpoint may use the link. MACsec answers how the peers protect the frames they exchange on it.
Try it in a lab
- On a supported lab link, establish a MACsec association with confidentiality enabled and send test traffic. Verify the association and protected-frame counters at both peers.
- Compare a capture of the link with traffic at a peer after decapsulation. The protected link capture shows the MACsec header, while the peer can deliver the original payload after verification and decryption.