close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

macsec

date_range 20-May-24

arrow_backward

arrow_forward

Syntax

macsec {
    connectivity-association connectivity-association-name {
        exclude-protocol protocol-name;
        include-sci;
        mka {
            must-secure;
            key-server-priority priority-number;
            transmit-interval interval;
        }
        no-encryption;
        offset (0|30|50);
        pre-shared-key {
            cak hexadecimal-number;
            ckn hexadecimal-number;
        }
        replay-protect{
            replay-window-size number-of-packets;
        }
        secure-channel secure-channel-name {
            direction (inbound | outbound);
            encryption (MACsec);
            id {
                mac-address mac-address;
                port-id port-id-number;
            }
            offset (0|30|50);
            security-association security-association-number {
                key key-string;
            }
        }
        security-mode security-mode;
    }
    interfaces interface-name {
        connectivity-association connectivity-association-name;
    }
}

Syntax (SRX Series Firewalls)

macsec {
    cluster-control-port <idx> {
        connectivity-association connectivity-association-name;
    }
    cluster-data-port interface-name {
        connectivity-association connectivity-association-name;
    }
    connectivity-associationconnectivity-association-name {
        exclude-protocol protocol-name;
        include-sci;
        mka {
            key-server-priority priority-number;
            must-secure;
            transmit-interval milliseconds;
        }
        no-encryption;
        offset (0|30|50);
        pre-shared-key {
            cak hexadecimal-number;
            ckn hexadecimal-number;
        }
        replay-protect {
            replay-window-size number-of-packets;
        }
        security-mode security-mode;
    }
    traceoptions (Chassis Cluster){
        file {
            filename;
            files number;
            match regular-expression;
            (world-readable | no-world-readable);
            size maximum-file-size;
        }
        flag flag;
    }
}

Hierarchy Level

content_copy zoom_out_map
[edit security]

Description

Configure Media Access Control Security (MACsec). Media Access Control Security(MACsec) is supported on control and fabric ports of SRX340, SRX345, and SRX4600 devices in chassis cluster mode to secure point-to-point Ethernet links between the peer devices in a cluster. Each point-to-point Ethernet link must be configured independently to secure using MACsec. You can enable MACsec encryption on device-to-device links using static connectivity association key (CAK) security mode.

Options

cluster-control-port <idx>	Specify chassis cluster control interface on which MACsec is enabled. Values: 0.
cluster-data-port `interface-name`	Specify chassis cluster fabric interface on which MACsec is enabled.
connectivity-association	Create or configure a MACsec connectivity association.
traceoptions	Define MACsec configuration tracing operations.

The remaining statements are explained separately. See CLI Explorer.

Required Privilege Level

admin—To view this statement in the configuration.

admin-control—To add this statement to the configuration.

Release Information

Statement introduced in Junos OS Release 13.2X50-D15.

Statement introduced in SRX Series Firewalls in Junos OS Release 15.1X49-D60.

arrow_backward PREVIOUS mac-vrf

NEXT arrow_forward macsec (MX Series)

Junos CLI Reference

ON THIS PAGE

macsec

Syntax

Syntax (SRX Series Firewalls)

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Junos CLI Reference

ON THIS PAGE

macsec

Syntax

Syntax (SRX Series Firewalls)

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Related Documentation

Stay in touch