{ "content": [ { "type": "text", "text": "# ip-macsec (man)\n\n## NAME\n\nip-macsec - MACsec device configuration\n\n## SYNOPSIS\n\nip link add link DEVICE name NAME type macsec [ [ address ] port PORT | sci ]\n[ cipher { default | gcm-aes-128 | gcm-aes-256\"}][\" icvlen ICVLEN ] [ encrypt { on | off } ]\n[ sendsci { on | off } ] [ endstation { on | off } ] [ scb { on | off } ] [ protect { on |\noff } ] [ replay { on | off } ] [ window WINDOW ] [ validate { strict | check | disabled } ]\n[ encodingsa SA ] [ offload { off | phy | mac } ]\nip macsec add DEV tx sa { 0..3 } [ OPTS ] key ID KEY\nip macsec set DEV tx sa { 0..3 } [ OPTS ]\nip macsec del DEV tx sa { 0..3 }\nip macsec add DEV rx SCI [ on | off ]\nip macsec set DEV rx SCI [ on | off ]\nip macsec del DEV rx SCI\nip macsec add DEV rx SCI sa { 0..3 } [ OPTS ] key ID KEY\nip macsec set DEV rx SCI sa { 0..3 } [ OPTS ]\nip macsec del DEV rx SCI sa { 0..3 }\nip macsec offload DEV { off | phy | mac }\nip macsec show [ DEV ]\nOPTS := [ pn { 1..2^32-1 } ] [ on | off ]\nSCI := { sci | port PORT address }\nPORT := { 1..2^16-1 }\n\n## DESCRIPTION\n\nThe ip macsec commands are used to configure transmit secure associations and receive secure\nchannels and their secure associations on a MACsec device created with the ip link add com‐\nmand using the macsec type.\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **DESCRIPTION**\n- **EXAMPLES** (7 subsections)\n- **NOTES**\n- **SEE ALSO**\n- **AUTHOR**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n" } ], "structuredContent": { "command": "ip-macsec", "section": "", "mode": "man", "summary": "ip-macsec - MACsec device configuration", "synopsis": "ip link add link DEVICE name NAME type macsec [ [ address ] port PORT | sci ]\n[ cipher { default | gcm-aes-128 | gcm-aes-256\"}][\" icvlen ICVLEN ] [ encrypt { on | off } ]\n[ sendsci { on | off } ] [ endstation { on | off } ] [ scb { on | off } ] [ protect { on |\noff } ] [ replay { on | off } ] [ window WINDOW ] [ validate { strict | check | disabled } ]\n[ encodingsa SA ] [ offload { off | phy | mac } ]\nip macsec add DEV tx sa { 0..3 } [ OPTS ] key ID KEY\nip macsec set DEV tx sa { 0..3 } [ OPTS ]\nip macsec del DEV tx sa { 0..3 }\nip macsec add DEV rx SCI [ on | off ]\nip macsec set DEV rx SCI [ on | off ]\nip macsec del DEV rx SCI\nip macsec add DEV rx SCI sa { 0..3 } [ OPTS ] key ID KEY\nip macsec set DEV rx SCI sa { 0..3 } [ OPTS ]\nip macsec del DEV rx SCI sa { 0..3 }\nip macsec offload DEV { off | phy | mac }\nip macsec show [ DEV ]\nOPTS := [ pn { 1..2^32-1 } ] [ on | off ]\nSCI := { sci | port PORT address }\nPORT := { 1..2^16-1 }", "tldr_summary": null, "tldr_examples": [], "tldr_source": null, "flags": [], "examples": [ "# ip link add link eth0 macsec0 type macsec port 11 encrypt on", "# ip macsec add macsec0 tx sa 0 pn 1024 on key 01 81818181818181818181818181818181", "# ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0", "# ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0 sa 0 pn 1 on key 00 82828282828282828282828282828282", "# ip macsec show", "# ip macsec offload macsec0 phy", "# ip link add link eth0 macsec0 type macsec port 11 encrypt on offload mac" ], "see_also": [ { "name": "ip-link", "section": "8", "url": "https://www.chedong.com/phpMan.php/man/ip-link/8/json" }, { "name": "wpasupplicant", "section": "8", "url": "https://www.chedong.com/phpMan.php/man/wpasupplicant/8/json" } ], "section_outline": [ { "name": "NAME", "lines": 2, "subsections": [] }, { "name": "SYNOPSIS", "lines": 28, "subsections": [] }, { "name": "DESCRIPTION", "lines": 5, "subsections": [] }, { "name": "EXAMPLES", "lines": 1, "subsections": [ { "name": "Create a MACsec device on link eth0 (offload is disabled by default)", "lines": 2 }, { "name": "Configure a secure association on that device", "lines": 2 }, { "name": "Configure a receive channel", "lines": 2 }, { "name": "Configure a receive association", "lines": 2 }, { "name": "Display MACsec configuration", "lines": 2 }, { "name": "Configure offloading on an interface", "lines": 2 }, { "name": "Configure offloading upon MACsec device creation", "lines": 3 } ] }, { "name": "NOTES", "lines": 9, "subsections": [] }, { "name": "SEE ALSO", "lines": 2, "subsections": [] }, { "name": "AUTHOR", "lines": 5, "subsections": [] } ], "sections": { "NAME": { "content": "ip-macsec - MACsec device configuration\n", "subsections": [] }, "SYNOPSIS": { "content": "ip link add link DEVICE name NAME type macsec [ [ address ] port PORT | sci ]\n[ cipher { default | gcm-aes-128 | gcm-aes-256\"}][\" icvlen ICVLEN ] [ encrypt { on | off } ]\n[ sendsci { on | off } ] [ endstation { on | off } ] [ scb { on | off } ] [ protect { on |\noff } ] [ replay { on | off } ] [ window WINDOW ] [ validate { strict | check | disabled } ]\n[ encodingsa SA ] [ offload { off | phy | mac } ]\n\nip macsec add DEV tx sa { 0..3 } [ OPTS ] key ID KEY\nip macsec set DEV tx sa { 0..3 } [ OPTS ]\nip macsec del DEV tx sa { 0..3 }\n\nip macsec add DEV rx SCI [ on | off ]\nip macsec set DEV rx SCI [ on | off ]\nip macsec del DEV rx SCI\n\nip macsec add DEV rx SCI sa { 0..3 } [ OPTS ] key ID KEY\nip macsec set DEV rx SCI sa { 0..3 } [ OPTS ]\nip macsec del DEV rx SCI sa { 0..3 }\n\nip macsec offload DEV { off | phy | mac }\n\nip macsec show [ DEV ]\n\nOPTS := [ pn { 1..2^32-1 } ] [ on | off ]\nSCI := { sci | port PORT address }\nPORT := { 1..2^16-1 }\n\n\n", "subsections": [] }, "DESCRIPTION": { "content": "The ip macsec commands are used to configure transmit secure associations and receive secure\nchannels and their secure associations on a MACsec device created with the ip link add com‐\nmand using the macsec type.\n\n", "subsections": [] }, "EXAMPLES": { "content": "", "subsections": [ { "name": "Create a MACsec device on link eth0 (offload is disabled by default)", "content": "# ip link add link eth0 macsec0 type macsec port 11 encrypt on\n" }, { "name": "Configure a secure association on that device", "content": "# ip macsec add macsec0 tx sa 0 pn 1024 on key 01 81818181818181818181818181818181\n" }, { "name": "Configure a receive channel", "content": "# ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0\n" }, { "name": "Configure a receive association", "content": "# ip macsec add macsec0 rx port 1234 address c6:19:52:8f:e6:a0 sa 0 pn 1 on key 00 82828282828282828282828282828282\n" }, { "name": "Display MACsec configuration", "content": "# ip macsec show\n" }, { "name": "Configure offloading on an interface", "content": "# ip macsec offload macsec0 phy\n" }, { "name": "Configure offloading upon MACsec device creation", "content": "# ip link add link eth0 macsec0 type macsec port 11 encrypt on offload mac\n\n" } ] }, "NOTES": { "content": "This tool can be used to configure the 802.1AE keys of the interface. Note that 802.1AE uses\nGCM-AES with a initialization vector (IV) derived from the packet number. The same key must\nnot be used with the same IV more than once. Instead, keys must be frequently regenerated and\ndistributed. This tool is thus mostly for debugging and testing, or in combination with a\nuser-space application that reconfigures the keys. It is wrong to just configure the keys\nstatically and assume them to work indefinitely. The suggested and standardized way for key\nmanagement is 802.1X-2010, which is implemented by wpasupplicant.\n\n", "subsections": [] }, "SEE ALSO": { "content": "ip-link(8) wpasupplicant(8)\n", "subsections": [] }, "AUTHOR": { "content": "Sabrina Dubroca \n\n\n\niproute 07 Mar 2016 IP-MACSEC(8)", "subsections": [] } } } }