Users Guide

Authentication, Authorization, and Accounting 431
Media Access Control Security
NOTE: Only the Dell EMC Networking N32xx supports the Media Access Control Security
feature.
The Media Access Control Security (MACsec) feature provides secure
communications between stations that are attached to the same LAN. It uses
symmetric key cryptography so that communication cannot be monitored or
altered on the wire. Traffic traversing the link is MACsec-secured through the
use of data integrity checks and encryption.
MACsec is standardized in IEEE 802.1AE, which specifies the forwarding
plane for MACsec. The key management and its integration with 802.1x is
standardized in IEEE 802.1X-2010.
The data integrity checks verify the integrity of the data. MACsec appends an
8-byte header called Sectag and a 16-byte tail called ICV to all secured
Ethernet frames. These are checked by the receiving interface to ensure that
the data was not compromised while traversing the link.
MACsec can also be used to encrypt all traffic on the Ethernet link. The
encryption used by MACsec ensures that the data in the Ethernet frame
cannot be viewed by anyone monitoring traffic on the link. MACsec
encryption is optional and user-configurable—you can enable MACsec to
ensure the data integrity checks are performed while still sending
unencrypted data in the clear over the MACsec-secured link, if desired.
Dell MACsec supports confidentiality through encryption, integrity, and
replay protection.
For information about the CLI commands you use to configure MACsec
features, refer to Switch Management Commands in the
Dell EMC
Networking CLI Reference Guide
at www.dell.com/support.