close
keyboard_arrow_left
Table of Contents
- play_arrow Overview
- Understanding the Common Criteria Evaluated Configuration
- Understanding Junos OS in FIPS Mode of Operation
- Understanding FIPS Mode of Operation Terminology and Supported Cryptographic Algorithms
- Identifying Secure Product Delivery
- Applying Tamper-Evident Seals to the Cryptographic Module
- Understanding Management Interfaces
- play_arrow Configuring Roles and Authentication Methods
- Understanding Roles and Services for Junos OS in FIPS Mode of Operation
- Understanding Services for Junos OS in FIPS Mode of Operation
- Downloading Software Packages from Juniper Networks
- Installing Junos Software Packages
- Understanding Zeroization to Clear System Data for FIPS Mode of Operation
- Loading Firmware on the Device
- How to Enable and Configure Junos OS in FIPS Mode of Operation
- play_arrow Configuring Administrative Credentials and Privileges
- Network Time Protocol
- play_arrow Configuring SSH and Console Connection
- play_arrow Configuring the Remote Syslog Server
- play_arrow Configuring Audit Log Options
- play_arrow Configuring Event Logging
- play_arrow Configuring a Secure Logging Channel
- play_arrow Configuring VPNs
- play_arrow Configuring Security Flow Policies
- play_arrow Configuring Traffic Filtering Rules
- Overview
- Understanding Protocol Support
- Configuring Traffic Filter Rules
- Configuring Default Deny-All and Reject Rules
- Logging the Dropped Packets Using Default Deny-all Option
- Configuring Mandatory Reject Rules for Invalid Fragments and Fragmented IP Packets
- Configuring Default Reject Rules for Source Address Spoofing
- Configuring Default Reject Rules with IP Options
- Configuring Default Reject Rules
- play_arrow Configuring Network Attacks
- Configuring IP Teardrop Attack Screen
- Configuring TCP Land Attack Screen
- Configuring ICMP Fragment Screen
- Configuring Ping-Of-Death Attack Screen
- Configuring tcp-no-flag Attack Screen
- Configuring TCP SYN-FIN Attack Screen
- Configuring TCP fin-no-ack Attack Screen
- Configuring UDP Bomb Attack Screen
- Configuring UDP CHARGEN DoS Attack Screen
- Configuring TCP SYN and RST Attack Screen
- Configuring ICMP Flood Attack Screen
- Configuring TCP SYN Flood Attack Screen
- Configuring TCP Port Scan Attack Screen
- Configuring UDP Port Scan Attack Screen
- Configuring IP Sweep Attack Screen
- play_arrow Configuring the IDP Extended Package
- play_arrow Configuring Cluster Mode
- play_arrow Performing Self-Tests on a Device
- play_arrow Configuration Statements
- checksum-validate
- code
- data-length
- destination-option
- extension-header
- header-type
- home-address
- identification
- icmpv6 (Security IDP Custom Attack)
- ihl (Security IDP Custom Attack)
- option-type
- reserved (Security IDP Custom Attack)
- routing-header
- sequence-number (Security IDP ICMPv6 Headers)
- type (Security IDP ICMPv6 Headers)
list Table of Contents
Configuring MACsec
date_range
01-Dec-23
SUMMARY
Configure MACsec
We can configure MACsec to secure point-to-point Ethernet links connecting SRX380 with MACsec-capable MICs. Each point-to-point Ethernet link that you want to secure using MACsec must be configured independently. We can enable MACsec on device-to-device links using static connectivity association key (CAK) security mode.
On SRX380, MACsec is supported only on the forty-four 10-Gigabit or 1-Gigabit Ethernet ports. In this section, these ports are used for configuring MACSec.
- Configuring MACsec on a Device Running Junos OS
- Configuring Static MACsec with ICMP Traffic
- Configuring MACsec with keychain using ICMP Traffic
- Configuring Static MACsec for Layer 2 Traffic
- Configuring MACsec with keychain for Layer 2 Traffic
Configuring MACsec on a Device Running Junos OS
To configure MACsec on a device running Junos OS:
Configuring Static MACsec with ICMP Traffic
To configure Static MACsec using ICMP traffic between device R0 and device R1:
In R0:
In R1:
Create the preshared key by configuring the connectivity association key name (CKN) and connectivity association key (CAK)
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 pre-shared-key ckn 2345678922334455667788992223334445556667778889992222333344445555 crypto-officer@hostname:fips# set security macsec connectivity-association CA1 pre-shared-key cak 23456789223344556677889922233344 crypto-officer@hostname:fips# set security macsec connectivity-association CA1 offset 30
Set the trace option values.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec traceoptions file MACsec.log crypto-officer@hostname:fips# set security macsec traceoptions file size 4000000000 crypto-officer@hostname:fips# set security macsec traceoptions flag all
Assign the trace to an interface.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec interfaces interface-name traceoptions file mka_xe size 1g crypto-officer@hostname:fips# set security macsec interfaces interface-name traceoptions flag all
Configure the MACsec security mode as static-cak for the connectivity association.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 security-mode static-cak
Set the MKA transmit interval.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 mka transmit-interval 3000
Enable the MKA secure.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 mka should-secure crypto-officer@hostname:fips# set security macsec connectivity-association CA1 include-sci
Assign the connectivity association to an interface.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec interfaces interface-name connectivity-association CA1 crypto-officer@hostname:fips# set interfaces interface-name unit 0 family inet address 10.1.1.2/24
Configuring MACsec with keychain using ICMP Traffic
To configure MACsec with keychain using ICMP traffic between device R0 and device R1:
In R0:
To configure MACsec with keychain for ICMP traffic:
In R1:
Assign a tolerance value to the authentication key chain.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 tolerance 20
Create the secret password to use. It is a string of hexadecimal digits up to 64 characters long. The password can include spaces if the character string is enclosed in quotation marks. The keychain's secret-data is used as a CAK.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 0 key-name 2345678922334455667788992223334445556667778889992222333344445551 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 0 start-time 2018-03-20.20:35 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 1 key-name 2345678922334455667788992223334445556667778889992222333344445552 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 1 start-time 2018-03-20.20:37 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 2 key-name 2345678922334455667788992223334445556667778889992222333344445553 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 2 start-time 2018-03-20.20:39 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 3 key-name 2345678922334455667788992223334445556667778889992222333344445554 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 3 start-time 2018-03-20.20:41 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 4 key-name 2345678922334455667788992223334445556667778889992222333344445555 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 4 start-time 2018-03-20.20:43 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 5 key-name 2345678922334455667788992223334445556667778889992222333344445556 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 5 start-time 2018-03-20.20:45 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 6 key-name 2345678922334455667788992223334445556667778889992222333344445557 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 6 start-time 2018-03-20.20:47 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 7 key-name 2345678922334455667788992223334445556667778889992222333344445558 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 7 start-time 2018-03-20.20:49
Use the
promptcommand to enter a secret key value. For example, the secret key value is 2345678922334455667788992223334123456789223344556677889922233341.content_copy zoom_out_map[edit] crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 0 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 1 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 2 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 3 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 4 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 5 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 6 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 7 secret New cak (secret): Retype new cak (secret):
Associate the preshared keychain name with the connectivity association.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 pre-shared-key-chain macsec-kc1 crypto-officer@hostname:fips# set security macsec connectivity-association CA1 offset 50 crypto-officer@hostname:fips# set security macsec connectivity-association CA1 cipher-suite gcm-aes-256
Set the trace option values.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec traceoptions file MACsec.log crypto-officer@hostname:fips# set security macsec traceoptions file size 4000000000 crypto-officer@hostname:fips# set security macsec traceoptions flag all
Assign the trace to an interface.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec interfaces interface-name traceoptions file mka_xe size 1g crypto-officer@hostname:fips# set security macsec interfaces interface-name traceoptions flag all
Configure the MACsec security mode as static-cak for the connectivity association.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 security-mode static-cak
Set the MKA key server priority.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 mka key-server-priority 1
Set the MKA transmit interval.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 mka transmit-interval 3000
Enable the MKA secure.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 include-sci
Assign the connectivity association to an interface.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec interfaces interface-name connectivity-association CA1 crypto-officer@hostname:fips# set interfaces interface-name unit 0 family inet address 10.1.1.2/24
Configuring Static MACsec for Layer 2 Traffic
To configure static MACsec for Layer 2 traffic between device R0 and device R1:
In R0:
In R1:
Create the secret password to use. It is a string of hexadecimal digits up to 64 characters long. The password can include spaces if the character string is enclosed in quotation marks. The keychain's secret-data is used as a CAK.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 0 secret New cak (secret): Retype new cak (secret):
For example, the secret key value is 2345678922334455667788992223334123456789223344556677889922233341.
Associate the preshared keychain name with the connectivity association.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 pre-shared-key-chain macsec-kc1 crypto-officer@hostname:fips# set security macsec connectivity-association CA1 offset 50 crypto-officer@hostname:fips# set security macsec connectivity-association CA1 cipher-suite gcm-aes-256
Set the trace option values.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec traceoptions file MACsec.log crypto-officer@hostname:fips# set security macsec traceoptions file size 4000000000 crypto-officer@hostname:fips# set security macsec traceoptions flag all
Assign the trace to an interface.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec interfaces interface-name traceoptions file mka_xe size 1g crypto-officer@hostname:fips# set security macsec interfaces interface-name traceoptions flag all
Configure the MACsec security mode as static-cak for the connectivity association.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 security-mode static-cak
Set the MKA key server priority.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 mka key-server-priority 1
Set the MKA transmit interval.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 mka transmit-interval 3000
Enable the MKA secure.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 include-sci
Assign the connectivity association to an interface.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec interfaces interface-name connectivity-association CA1
Configure VLAN tagging.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set interfaces interface-name1 flexible-vlan-tagging crypto-officer@hostname:fips# set interfaces interface-name1 encapsulation flexible-ethernet-services crypto-officer@hostname:fips# set interfaces interface-name1 unit 100 encapsulation vlan-bridge crypto-officer@hostname:fips# set interfaces interface-name1 unit 100 vlan-id 100 crypto-officer@hostname:fips# set interfaces interface-name2 flexible-vlan-tagging crypto-officer@hostname:fips# set interfaces interface-name2 encapsulation flexible-ethernet-services crypto-officer@hostname:fips# set interfaces interface-name2 unit 100 encapsulation vlan-bridge crypto-officer@hostname:fips# set interfaces interface-name2 unit 100 vlan-id 100
Configure bridge domain.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set bridge-domains BD-110 domain-type bridge crypto-officer@hostname:fips# set bridge-domains BD-110 vlan-id 100 crypto-officer@hostname:fips# set bridge-domains BD-110 interface interface-name1 100 crypto-officer@hostname:fips# set bridge-domains BD-110 interface interface-name2 100
Configuring MACsec with keychain for Layer 2 Traffic
To configure MACsec with keychain for ICMP traffic between device R0 and device R1:
In R0:
In R1:
Assign a tolerance value to the authentication key chain.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 tolerance 20
Create the secret password to use. It is a string of hexadecimal digits up to 64 characters long. The password can include spaces if the character string is enclosed in quotation marks. The keychain's secret-data is used as a CAK.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 0 key-name 2345678922334455667788992223334445556667778889992222333344445551 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 0 start-time 2018-03-20.20:35 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 1 key-name 2345678922334455667788992223334445556667778889992222333344445552 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 1 start-time 2018-03-20.20:37 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 2 key-name 2345678922334455667788992223334445556667778889992222333344445553 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 2 start-time 2018-03-20.20:39 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 3 key-name 2345678922334455667788992223334445556667778889992222333344445554 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 3 start-time 2018-03-20.20:41 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 4 key-name 2345678922334455667788992223334445556667778889992222333344445555 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 4 start-time 2018-03-20.20:43 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 5 key-name 2345678922334455667788992223334445556667778889992222333344445556 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 5 start-time 2018-03-20.20:45 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 6 key-name 2345678922334455667788992223334445556667778889992222333344445557 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 6 start-time 2018-03-20.20:47 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 7 key-name 2345678922334455667788992223334445556667778889992222333344445558 crypto-officer@hostname:fips# set security authentication-key-chains key-chain macsec-kc1 key 7 start-time 2018-03-20.20:49
Use the
promptcommand to enter a secret key value. For example, the secret key value is 2345678922334455667788992223334123456789223344556677889922233341.content_copy zoom_out_map[edit] crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 0 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 1 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 2 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 3 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 4 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 5 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 6 secret New cak (secret): Retype new cak (secret): crypto-officer@hostname:fips# prompt security authentication-key-chains key-chain macsec-kc1 key 7 secret New cak (secret): Retype new cak (secret):
Associate the preshared keychain name with the connectivity association.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 pre-shared-key-chain macsec-kc1 crypto-officer@hostname:fips# set security macsec connectivity-association CA1 cipher-suite gcm-aes-256
Set the trace option values.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec traceoptions file MACsec.log crypto-officer@hostname:fips# set security macsec traceoptions file size 4000000000 crypto-officer@hostname:fips# set security macsec traceoptions flag all
Assign the trace to an interface.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec interfaces interface-name traceoptions file mka_xe size 1g crypto-officer@hostname:fips# set security macsec interfaces interface-name traceoptions flag all
Configure the MACsec security mode as static-cak for the connectivity association.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 security-mode static-cak
Set the MKA key server priority.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 mka key-server-priority 1
Set the MKA transmit interval.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 mka transmit-interval 3000
Enable the MKA secure.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec connectivity-association CA1 include-sci
Assign the connectivity association to an interface.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set security macsec interfaces interface-name connectivity-association CA1
Configure VLAN tagging.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set interfaces interface-name1 flexible-vlan-tagging crypto-officer@hostname:fips# set interfaces interface-name1 encapsulation flexible-ethernet-services crypto-officer@hostname:fips# set interfaces interface-name1 unit 100 encapsulation vlan-bridge crypto-officer@hostname:fips# set interfaces interface-name1 unit 100 vlan-id 100 crypto-officer@hostname:fips# set interfaces interface-name2 flexible-vlan-tagging crypto-officer@hostname:fips# set interfaces interface-name2 encapsulation flexible-ethernet-services crypto-officer@hostname:fips# set interfaces interface-name2 unit 100 encapsulation vlan-bridge crypto-officer@hostname:fips# set interfaces interface-name2 unit 100 vlan-id 100
Configure bridge domain.
content_copy zoom_out_map[edit] crypto-officer@hostname:fips# set bridge-domains BD-110 domain-type bridge crypto-officer@hostname:fips# set bridge-domains BD-110 vlan-id 100 crypto-officer@hostname:fips# set bridge-domains BD-110 interface interface-name1 100 crypto-officer@hostname:fips# set bridge-domains BD-110 interface interface-name2 100
