Enabling MACsec in Cisco NDFC Release 12.1.3

New and Changed Information

The following table provides an overview of the significant changes up to this current release. The table does not provide an exhaustive list of all changes or of the new features up to this release.

Release Version	Feature	Description
NDFC release 12.1.3	Reorganized content	Content within this document was originally provided in the Cisco NDFC-Fabric Controller Configuration Guide or the Cisco NDFC-SAN Controller Configuration Guide. Beginning with release 12.1.3, this content is now provided solely in this document and is no longer provided in those documents.

MACsec Support in Data Center VXLAN EVPN and BGP Fabrics

MACsec is supported in the Data Center VXLAN EVPN and BGP fabrics on intra-fabric links. You should enable MACsec on the fabric and on each required intra-fabric link to configure MACsec. Unlike CloudSec, auto-configuration of MACsec is not supported.

MACsec is supported on switches with minimum Cisco NX-OS Releases 7.0(3)I7(8) and 9.3(5).

Guidelines

If MACsec cannot be configured on the physical interfaces of the link, an error is displayed when you click Save. MACsec cannot be configured on the device and link due to the following reasons:
- The minimum NX-OS version is not met.
- The interface is not MACsec capable.
MACsec global parameters in the fabric settings can be changed at any time.
MACsec and CloudSec can coexist on a BGW device.
MACsec status of a link with MACsec enabled is displayed on the Links window.
Brownfield migration of devices with MACsec configured is supported using switch and interface freeform configs.

For more information about MACsec configuration, which includes supported platforms and releases, see the Configuring MACsec chapter in Cisco Nexus 9000 Series NX-OS Security Configuration Guide.

The following sections show how to enable and disable MACsec in Nexus Dashboard Fabric Controller.

Enabling MACsec

Navigate to LAN > Fabrics.
Click Actions > Create to create a new fabric or click Actions > Edit Fabric on an existing Easy or eBGP fabric.
Click the Advanced tab and specify the MACsec details.

Enable MACsec - Select the check box to enable MACsec for the fabric.

MACsec Primary Key String - Specify a Cisco Type 7 encrypted octet string that is used for establishing the primary MACsec session. For AES_256_CMAC, the key string length must be 130 and for AES_128_CMAC, the key string length must be 66. If these values are not specified correctly, an error is displayed when you save the fabric.

? The default key lifetime is infinite.

MACsec Primary Cryptographic Algorithm - Choose the cryptographic algorithm used for the primary key string. It can be AES_128_CMAC or AES_256_CMAC. The default value is AES_128_CMAC.

You can configure a fallback key on the device to initiate a backup session if the primary session fails.

MACsec Fallback Key String - Specify a Cisco Type 7 encrypted octet string that is used for establishing a fallback MACsec session. For AES_256_CMAC, the key string length must be 130 and for AES_128_CMAC, the key string length must be 66. If these values are not specified correctly, an error is displayed when you save the fabric.

MACsec Fallback Cryptographic Algorithm - Choose the cryptographic algorithm used for the fallback key string. It can be AES_128_CMAC or AES_256_CMAC. The default value is AES_128_CMAC.

MACsec Cipher Suite - Choose one of the following MACsec cipher suites for the MACsec policy:

GCM-AES-128
GCM-AES-256
GCM-AES-XPN-128
GCM-AES-XPN-256

The default value is GCM-AES-XPN-256.

? The MACsec configuration is not deployed on the switches after the fabric deployment is complete. You need to enable MACsec on intra-fabric links to deploy the MACsec configuration on the switch.

MACsec Status Report Timer - Specifies MACsec operational status periodic report timer in minutes.

Click a fabric to view the Summary in the side kick. Click the side kick to expand. Click Links tab.
Choose an intra-fabric link on which you want to enable MACsec and click Actions > Edit.
In the Link Management - Edit Link window, click Advanced in the Link Profile section, and select the Enable MACsec check box. If MACsec is enabled on the intra fabric link but not in the fabric settings, an error is displayed when you click Save.
When MACsec is configured on the link, the following configurations are generated:
- Create MACsec global policies if this is the first link that enables MACsec.
- Create MACsec interface policies for the link.
From the Fabric Actions drop-down list, select Deploy Config to deploy the MACsec configuration.

Disabling MACsec

To disable MACsec on an intra-fabric link, navigate to the Link Management - Edit Link window, unselect the Enable MACsec check box, click Save. From the Fabric Actions drop-down list, select Deploy Config to disable MACsec configuration. This action performs the following:

Deletes MACsec interface policies from the link.
If this is the last link where MACsec is enabled, MACsec global policies are also deleted from the device.

Only after disabling MACsec on links, navigate to the Fabric Settings and unselect the Enable MACsec check box under the Advanced tab to disable MACsec on the fabric. If there's an intra-fabric link in the fabric with MACsec enabled, an error is displayed when you click Actions > Recalculate Config from the Fabric Actions drop-down list.

Copyright

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED "AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

	Cisco NDFC-Fabric Controller Configuration Guide, Release 12.1.1e This guide provides comprehensive instructions for configuring the Cisco NDFC-Fabric Controller, Release 12.1.1e. It covers various aspects of fabric management, including provisioning, configuration, monitoring, and troubleshooting.
	Cisco Nexus Dashboard Fabric Controller (NDFC) Deployment Guide This guide provides comprehensive instructions for deploying the Cisco Nexus Dashboard Fabric Controller (NDFC), detailing its architecture, networking requirements, and deployment options for various environments.
	Cisco vPC Fabric Peering Configuration Guide - Release 12.1.3 Learn how to configure vPC Fabric Peering on Cisco Nexus switches using Cisco NDFC. This guide covers virtual peer link creation, conversion, QoS settings, and limitations for Release 12.1.3.
	Cisco Nexus 9000 Series NX-OS Release Notes, Release 10.2(2)F This document details the features, issues, and exceptions of Cisco NX-OS Release 10.2(2)F software for Cisco Nexus 9000 Series switches, including new and enhanced software features, unsupported features, and resolved and open issues.
	Cisco Nexus Dashboard Fabric Controller Installation and Upgrade Guide, Release 12.1.2e This guide provides comprehensive instructions for installing and upgrading the Cisco Nexus Dashboard Fabric Controller (NDFC) Release 12.1.2e. It covers system requirements, deployment options, prerequisites, and detailed upgrade paths for managing Cisco data center network infrastructure.
	Verified Scalability Guide for Cisco Nexus Dashboard Fabric Controller, Release 12.2.2 This guide provides verified scalability values for various deployment types for Cisco Nexus Dashboard Fabric Controller, Release 12.2.2. It details system resource requirements and scale limits for different fabric configurations.
	Cisco NDFC-Fabric Controller Configuration Guide, Release 12.1.1e This guide provides comprehensive instructions for configuring the Cisco NDFC-Fabric Controller, Release 12.1.1e. It covers various aspects of fabric management, including provisioning, configuration, monitoring, and troubleshooting for different network environments like VXLAN EVPN, IPFM, and more. Learn about managing switches, interfaces, policies, and virtual infrastructure to optimize your network operations.
	Verified Scalability Guide for Cisco Nexus Dashboard Fabric Controller, Release 12.0.2f Detailed scalability limits and server resource requirements for Cisco Nexus Dashboard Fabric Controller (NDFC) Release 12.0.2f, covering various deployment types for fabric controller, discovery, VXLAN EVPN, and SAN controller.

Enabling MACsec, Release 12.1.3