Configure a MACsec connection by using nmcli

You can use the nmcli utility to configure Ethernet interfaces to use MACsec. For example, you can create a MACsec connection between two hosts that are connected over Ethernet.

Procedure

  1. On the first host, create the connectivity association key (CAK) and connectivity-association key name (CKN) for the pre-shared key:
    1. Create a 16-byte hexadecimal CAK: 
      # dd if=/dev/urandom count=16 bs=1 2> /dev/null | hexdump -e '1/2 "%04x"'
       
      50b71a8ef0bd5751ea76de6d6c98c03a
    2. Create a 32-byte hexadecimal CKN: 
      # dd if=/dev/urandom count=32 bs=1 2> /dev/null | hexdump -e '1/2 "%04x"'
       
      f2b4297d39da7330910a74abc0449feb45b5c0b9fc23df1430e1898fcf1c4550
  2. On both hosts, create the MACsec connection using the CAK and CKN from step 1. The values must be the same on every host in the MACsec-protected network: 
    # nmcli connection add type macsec con-name macsec0 ifname macsec0 connection.autoconnect yes macsec.parent enp1s0 macsec.mode psk macsec.mka-cak 50b71a8ef0bd5751ea76de6d6c98c03a macsec.mka-ckn f2b4297d39da7330910a74abc0449feb45b5c0b9fc23df1430e1898fcf1c4550
  3. Configure the IP settings on the MACsec connection.
    1. Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, and DNS server to the macsec0 connection, enter: 
      # nmcli connection modify macsec0 ipv4.method manual ipv4.addresses '192.0.2.1/24' ipv4.gateway '192.0.2.254' ipv4.dns '192.0.2.253'
    2. Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, and DNS server to the macsec0 connection, enter: 
      # nmcli connection modify macsec0 ipv6.method manual ipv6.addresses '2001:db8:1::1/32'  ipv6.gateway '2001:db8:1::fffe' ipv6.dns '2001:db8:1::fffd'
  4. Activate the connection: 
    # nmcli connection up macsec0

Results

  1. Verify that the traffic on the parent interface is encrypted. The output shows encrypted MACsec frames: 
    # tcpdump -nn -i enp1s0
  2. Optional: Display the unencrypted traffic on the MACsec interface: 
    # tcpdump -nn -i macsec0
  3. Display MACsec statistics: 
    # ip macsec show
  4. Display individual counters for each type of protection: integrity-only (encrypt off) and encryption (encrypt on) 
    # ip -s macsec show