close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

should-secure

date_range 28-Aug-24

arrow_backward

arrow_forward

Syntax

content_copy zoom_out_map
should-secure;

Hierarchy Level

content_copy zoom_out_map
[edit security macsec connectivity-association connectivity-association-name mka]

Description

Configure the should-secure statement to enable fail open mode for Media Access Control Security (MACsec). Fail open mode ensures that traffic continues to flow if the MACsec Key Agreement (MKA) session is not established.

When should-secure is configured:

If the MKA session is not established, traffic is still allowed in clear text without the MACsec header.
If the MKA session is established successfully, traffic is allowed with MACsec headers.

Fail open mode is recommended for service providers that prioritize network availability. Before you enable fail open mode, consider the sensitivity of the traffic you are attempting to secure with MACsec.

Note:

Setting or unsetting this configuration statement will cause the tunnel to be re-established.

Default

Fail open mode is not enabled by default. You must configure should-secure to enable this feature. When should-secure is not configured:

If the MKA session is not established, all traffic is discarded except Extensible Authentication Protocol over LAN (EAPoL) packets.
If the MKA session is established, traffic is transmitted with MACsec headers.

Required Privilege Level

admin—To view this statement in the configuration.

admin-control—To add this statement to the configuration.

Release Information

Statement introduced in Junos OS Release 17.4.

arrow_backward PREVIOUS shortcuts (Protocols OSPF)

NEXT arrow_forward show

Junos CLI Reference

ON THIS PAGE