.TH IP\-MACSEC 8 "07 Mar 2016" "iproute" "Linux"

.SH NAME

ip-macsec \- MACsec device configuration

.SH "SYNOPSIS"

.BI "ip link add link " DEVICE " name " NAME " type macsec "

[ [

.BI address " <lladdr>"

]

.BI port " PORT"

|

.BI sci " <u64>"

] [

.BR cipher " { " default " | " gcm-aes-128 " | "gcm-aes-256" } ] ["

.BI icvlen " ICVLEN"

] [

.BR encrypt " { " on " | " off " } ] ["

.BR send_sci " { " on " | " off " } ] ["

.BR end_station " { " on " | " off " } ] ["

.BR scb " { " on " | " off " } ] ["

.BR protect " { " on " | " off " } ] ["

.BR replay " { " on " | " off " } ] ["

.BI window " WINDOW"

] [

.BR validate " { " strict " | " check " | " disabled " } ] ["

.BI encodingsa " SA"

]

.BI "ip macsec add " DEV " tx sa"

.RI "{ " 0..3 " } [ " OPTS " ]"

.BI key " ID KEY"

.br

.BI "ip macsec set " DEV " tx sa"

.RI "{ " 0..3 " } [ " OPTS " ]"

.br

.BI "ip macsec del " DEV " tx sa"

.RI "{ " 0..3 " }"

.BI "ip macsec add " DEV " rx " SCI

.RB [ " on " | " off " ]

.br

.BI "ip macsec set " DEV " rx " SCI

.RB [ " on " | " off " ]

.br

.BI "ip macsec del " DEV " rx " SCI

.BI "ip macsec add " DEV " rx " SCI " sa"

.RI "{ " 0..3 " } [ " OPTS " ]"

.BI key " ID KEY"

.br

.BI "ip macsec set " DEV " rx " SCI " sa"

.RI "{ " 0..3 " } [ " OPTS " ]"

.br

.BI "ip macsec del " DEV " rx " SCI " sa"

.RI "{ " 0..3 " }"

.B ip macsec show

.RI [ " DEV " ]

.IR OPTS " := [ "

.BR pn " { "

.IR 1..2^32-1 " } ] ["

.BR on " | " off " ]"

.br

.IR SCI " := { "

.B sci

.IR <u64> " | "

.BI port

.IR PORT

.BI address " <lladdr> "

}

.br

.IR PORT " := { " 1..2^16-1 " } "

.SH DESCRIPTION

The

.B ip macsec

commands are used to configure transmit secure associations and receive secure channels and their secure associations on a MACsec device created with the

.B ip link add

command using the

.I macsec

type.

.SH EXAMPLES

.PP

.SS Create a MACsec device on link eth0

.nf

# ip link add link eth0 macsec0 type macsec port 11 encrypt on

.PP

.SS Configure a secure association on that device

.nf

# ip macsec add macsec0 tx sa 0 pn 1024 on key 01 81818181818181818181818181818181

.PP

.SS Configure a receive channel

.nf

# ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0

.PP

.SS Configure a receive association

.nf

# ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0 sa 0 pn 1 on key 00 82828282828282828282828282828282

.PP

.SS Display MACsec configuration

.nf

# ip macsec show

.SH SEE ALSO

.br

.BR ip-link (8)

.SH AUTHOR

Sabrina Dubroca <sd@queasysnail.net>