SupportConsoleDevelopersStart a trialContact

Chapter 7. Using MACsec to encrypt layer-2 traffic in the same physical network

Configure MACsec to encrypt Layer 2 traffic within the same physical network. This helps secure point-to-point communication between directly connected devices, such as hosts or switches.

7.1. How MACsec increases security
Copy link

Use Media Access Control security (MACsec) to encrypt and authenticate LAN traffic at layer 2. This removes the need to encrypt individual services at layer 7.

MACsec secures point-to-point communication between devices. For example, you can configure MACsec on the two hosts connecting your branch and central offices over a Metro-Ethernet connection to increase security.

MACsec is a layer-2 protocol that encrypts and authenticates all LAN traffic. It uses a pre-shared key to establish connections. To change this key, you must update the NetworkManager configuration on all hosts that use MACsec.

MACsec secures different traffic types over the Ethernet links, including:

  • Dynamic host configuration protocol (DHCP)
  • address resolution protocol (ARP)
  • IPv4 and IPv6 traffic
  • Any traffic over IP such as TCP or UDP

A MACsec connection uses an Ethernet device, such as a network card, Virtual Local Area Network (VLAN), or tunnel device, as a parent. You can either set an IP configuration only on the MACsec device to communicate with other hosts only by using the encrypted connection, or you can also set an IP configuration on the parent device. In this case, you can use the parent device to communicate with other hosts by using an unencrypted connection and the MACsec device for encrypted connections.

MACsec does not require any special hardware. You can use any switch, except if you want to encrypt traffic only between a host and a switch. In this scenario, the switch must also support MACsec.

You can configure MACsec for two common scenarios:

  • Host-to-host
  • Host-to-switch and switch-to-other-hosts
Important

You can use MACsec only between hosts that are in the same physical or virtual LAN.

MACsec provides these benefits:

  • Reduces the workload of managing certificates for each endpoint on each host by encrypting at layer 2 instead of individual services at layer 7.
  • Provides point-to-point security between directly connected network devices such as routers and switches.
  • No changes needed for applications and higher-layer protocols.

You can use the nmcli utility to configure Ethernet interfaces to use MACsec. For example, you can create a MACsec connection between two hosts that are connected over Ethernet.

Procedure

  1. On the first host, create the connectivity association key (CAK) and connectivity-association key name (CKN) for the pre-shared key:

    1. Create a 16-byte hexadecimal CAK: 

      # dd if=/dev/urandom count=16 bs=1 2> /dev/null | hexdump -e '1/2 "%04x"'
50b71a8ef0bd5751ea76de6d6c98c03a

    2. Create a 32-byte hexadecimal CKN: 

      # dd if=/dev/urandom count=32 bs=1 2> /dev/null | hexdump -e '1/2 "%04x"'
f2b4297d39da7330910a74abc0449feb45b5c0b9fc23df1430e1898fcf1c4550

  2. On both hosts, create the MACsec connection using the CAK and CKN from step 1. The values must be the same on every host in the MACsec-protected network: 

    # nmcli connection add type macsec con-name macsec0 ifname macsec0 connection.autoconnect yes macsec.parent enp1s0 macsec.mode psk macsec.mka-cak 50b71a8ef0bd5751ea76de6d6c98c03a macsec.mka-ckn f2b4297d39da7330910a74abc0449feb45b5c0b9fc23df1430e1898fcf1c4550

  3. Configure the IP settings on the MACsec connection.

    1. Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, and DNS server to the macsec0 connection, enter: 

      # nmcli connection modify macsec0 ipv4.method manual ipv4.addresses '192.0.2.1/24' ipv4.gateway '192.0.2.254' ipv4.dns '192.0.2.253'

    2. Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, and DNS server to the macsec0 connection, enter: 

      # nmcli connection modify macsec0 ipv6.method manual ipv6.addresses '2001:db8:1::1/32' ipv6.gateway '2001:db8:1::fffe' ipv6.dns '2001:db8:1::fffd'

  4. Activate the connection: 

    # nmcli connection up macsec0

Verification

  1. Verify that the traffic on the parent interface is encrypted. The output shows encrypted MACsec frames: 

    # tcpdump -nn -i enp1s0

  2. Optional: Display the unencrypted traffic on the MACsec interface: 

    # tcpdump -nn -i macsec0

  3. Display MACsec statistics: 

    # ip macsec show

  4. Display individual counters for each type of protection: integrity-only (encrypt off) and encryption (encrypt on) 

    # ip -s macsec show

You can use the declarative Nmstate API to configure Ethernet interfaces to use MACsec. Nmstate ensures that the result matches the configuration file or rolls back the changes.

Prerequisites

  • A physical or virtual Ethernet Network Interface Controller (NIC) exists in the server configuration.
  • The nmstate package is installed.

Procedure

  1. On the first host, create the connectivity association key (CAK) and connectivity-association key name (CKN) for the pre-shared key:

    1. Create a 16-byte hexadecimal CAK: 

      # dd if=/dev/urandom count=16 bs=1 2> /dev/null | hexdump -e '1/2 "%04x"'
50b71a8ef0bd5751ea76de6d6c98c03a

    2. Create a 32-byte hexadecimal CKN: 

      # dd if=/dev/urandom count=32 bs=1 2> /dev/null | hexdump -e '1/2 "%04x"'
f2b4297d39da7330910a74abc0449feb45b5c0b9fc23df1430e1898fcf1c4550

  2. On both hosts that you want to connect over a MACsec connection, complete the following steps:

    1. Create a YAML file, for example create-macsec-connection.yml, with the following settings: 

      ---
routes:
  config:
  - destination: 0.0.0.0/0
    next-hop-interface: macsec0
    next-hop-address: 192.0.2.2
    table-id: 254
  - destination: 192.0.2.2/32
    next-hop-interface: macsec0
    next-hop-address: 0.0.0.0
    table-id: 254
dns-resolver:
  config:
    search:
    - example.com
    server:
    - 192.0.2.200
    - 2001:db8:1::ffbb
interfaces:
- name: macsec0
  type: macsec
  state: up
  ipv4:
    enabled: true
    address:
    - ip: 192.0.2.1
      prefix-length: 32
  ipv6:
    enabled: true
    address:
    - ip: 2001:db8:1::1
      prefix-length: 64
  macsec:
    encrypt: true
    base-iface: enp0s1
    mka-cak: 50b71a8ef0bd5751ea76de6d6c98c03a
    mka-ckn: f2b4297d39da7330910a74abc0449feb45b5c0b9fc23df1430e1898fcf1c4550
    port: 0
    validation: strict
    send-sci: true

      Use the CAK and CKN generated in step 1 in the mka-cak and mka-ckn parameters. The values must be the same on every host in the MACsec-protected network.

  3. Apply the settings to the system: 

    # nmstatectl apply create-macsec-connection.yml

Verification

  1. Verify the MACsec interface is active and configured correctly: 

    # nmstatectl show macsec0

    The output displays the MACsec interface configuration including the encryption status.

  2. Verify that the traffic on the parent interface is encrypted. The output shows encrypted MACsec frames: 

    # tcpdump -nn -i enp0s1

  3. Optional: Display the unencrypted traffic: 

    # tcpdump -nn -i macsec0

  4. Display MACsec statistics: 

    # ip macsec show

  5. Display individual counters for each type of protection: integrity-only (encrypt off) and encryption (encrypt on) 

    # ip -s macsec show
Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top