# phpman > man > ip-macsec(8)

[IP-MACSEC(8)](https://www.chedong.com/phpMan.php/man/IP-MACSEC/8/markdown)                                    Linux                                   [IP-MACSEC(8)](https://www.chedong.com/phpMan.php/man/IP-MACSEC/8/markdown)



## NAME
       ip-macsec - MACsec device configuration

## SYNOPSIS
       **ip**  **link** **add** **link** _DEVICE_ **name** _NAME_ **type** **macsec** [ [ **address** _<lladdr>_ ] **port** _PORT_ | **sci** _<u64>_ ]
       [ **cipher** { **default** | **gcm-aes-128** | **gcm-aes-256"**}**]**[" **icvlen** _ICVLEN_ ] [ **encrypt** { **on** | **off** }  ]
       [  **send**___**sci** { **on** | **off** } ] [ **end**___**station** { **on** | **off** } ] [ **scb** { **on** | **off** } ] [ **protect** { **on** |
       **off** } ] [ **replay** { **on** | **off** } ] [ **window** _WINDOW_ ] [ **validate** { **strict** | **check** | **disabled** }  ]
       [ **encodingsa** _SA_ ] [ **offload** { **off** | **phy** | **mac** } ]

       **ip** **macsec** **add** _DEV_ **tx** **sa** { _0..3_ } [ _OPTS_ ] **key** _ID_ _KEY_
       **ip** **macsec** **set** _DEV_ **tx** **sa** { _0..3_ } [ _OPTS_ ]
       **ip** **macsec** **del** _DEV_ **tx** **sa** { _0..3_ }

       **ip** **macsec** **add** _DEV_ **rx** _SCI_ [ **on** | **off** ]
       **ip** **macsec** **set** _DEV_ **rx** _SCI_ [ **on** | **off** ]
       **ip** **macsec** **del** _DEV_ **rx** _SCI_

       **ip** **macsec** **add** _DEV_ **rx** _SCI_ **sa** { _0..3_ } [ _OPTS_ ] **key** _ID_ _KEY_
       **ip** **macsec** **set** _DEV_ **rx** _SCI_ **sa** { _0..3_ } [ _OPTS_ ]
       **ip** **macsec** **del** _DEV_ **rx** _SCI_ **sa** { _0..3_ }

       **ip** **macsec** **offload** _DEV_ { **off** | **phy** | **mac** }

       **ip** **macsec** **show** [ _DEV_ ]

       _OPTS_ := [ **pn** { _1..2^32-1_ } ] [ **on** | **off** ]
       _SCI_ := { **sci** _<u64>_ | **port** _PORT_ **address** _<lladdr>_ }
       _PORT_ := { _1..2^16-1_ }



## DESCRIPTION
       The  **ip** **macsec** commands are used to configure transmit secure associations and receive secure
       channels and their secure associations on a MACsec device created with the **ip** **link**  **add**  com‐
       mand using the _macsec_ type.


## EXAMPLES
### Create a MACsec device on link eth0 (offload is disabled by default)
       # ip link add link eth0 macsec0 type macsec port 11 encrypt on

### Configure a secure association on that device
       # ip macsec add macsec0 tx sa 0 pn 1024 on key 01 81818181818181818181818181818181

### Configure a receive channel
       # ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0

### Configure a receive association
       # ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0 sa 0 pn 1 on key 00 82828282828282828282828282828282

### Display MACsec configuration
       # ip macsec show

### Configure offloading on an interface
       # ip macsec offload macsec0 phy

### Configure offloading upon MACsec device creation
       # ip link add link eth0 macsec0 type macsec port 11 encrypt on offload mac


## NOTES
       This  tool can be used to configure the 802.1AE keys of the interface. Note that 802.1AE uses
       GCM-AES with a initialization vector (IV) derived from the packet number. The same  key  must
       not be used with the same IV more than once. Instead, keys must be frequently regenerated and
       distributed.  This tool is thus mostly for debugging and testing, or in  combination  with  a
       user-space  application  that  reconfigures  the keys. It is wrong to just configure the keys
       statically and assume them to work indefinitely. The suggested and standardized way  for  key
       management is 802.1X-2010, which is implemented by wpa_supplicant.


## SEE ALSO
       [**ip-link**(8)](https://www.chedong.com/phpMan.php/man/ip-link/8/markdown) **wpa**___**[supplicant**(8)](https://www.chedong.com/phpMan.php/man/supplicant/8/markdown)

## AUTHOR
       Sabrina Dubroca <<sd@queasysnail.net>>



iproute                                      07 Mar 2016                                [IP-MACSEC(8)](https://www.chedong.com/phpMan.php/man/IP-MACSEC/8/markdown)