MACSec

2 min read 11 Sep 2026

inter-site links between nodes within the sites are encrypted at Layer 2 using MACsec (IEEE 802.1AE)

MACsec on the NCS 540 (IOS XR 7.9.x / 25.2.x) requires the k9sec crypto RPM, which is not installed by default. The package must be installed once per node before any MACsec configuration is applied.
MACsec is included as part of the software package on the NCS-57C3-MOD-SYS.
The encryption and decryption are performed by the PHY component. As a result, packet captures will always show packets without encryption.

install package add source file:/harddisk:/NCS540l-k9sec-rpms.25.2.2.tar
install apply
install commit
install apply reload

macsec-policy mp1
delay-protection

key chain psk1
macsec
key 01
key-string password 040B5B575E731E1D5A4D5142475D5A537D737C716A14033125352025727C7D75725E5349470B0A04000601015E0D50500F0F5C4A5F257A29242C02686A2C3C2331 cryptographic-algorithm aes-256-cmac
lifetime 00:00:00 january 01 2020 infinite
!
!
!
interface Bundle-EtherX
mtu 9248
!
interface HundredGigEx/x/x/x
macsec psk-keychain psk1 policy mp1
!

router isis S2
hello-padding disable

RP/0/RP0/CPU0:R1#show macsec mka summary
Fri May 22 13:53:09.448 CEST

 TF0/0/0/3        Secured  GCM-AES-XPN-256        psk1         PRIMARY      01

Total MACSec Sessions : 1
Secured Sessions : 1
Pending Sessions : 0
Suspended Sessions : 0
Active Sessions : 0

Wireshark:

root@localhost:~# tcpdump -i enp0s20f0u9 -nn 'ether proto 0x88e5 or icmp or icmp6'
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on enp0s20f0u9, link-type EN10MB (Ethernet), snapshot length 262144 bytes
13:47:02.035321 IP6 fe80::f203:bcff:feb7:1c81 > ff02::1: ICMP6, router advertisement, length 32
13:47:07.960402 60:a9:54:13:72:16 > f0:03:bc:b7:1c:17 802.1AE MACsec, an 0, pn 35, flags ECI, sci 60a9541372160001,
0x0000: 2647 20fb 374c 93b0 0264 4ff3 3c60 8aff &G..7L...dO.<`..
0x0010: 032a 27a7 f658 10ac e811 0786 a6f3 fde6 .*'..X..........
0x0020: ef7f 8f54 4140 0884 3b79 5f89 1969 1b3b ...TA@..;y_..i.;
0x0030: 6c9c fa1e ef10 ddb3 018a ca1a 6c64 434b l...........ldCK
0x0040: 60b9 dca7 ad6d 086e 740b c190 d6e1 ac3b `....m.nt......;
0x0050: 03ac 7489 c3f2 d6c8 6fd8 18fe 39ba 22b3 ..t.....o...9.".
0x0060: 5f73 b9e4 5fd8 b1ef 703f 706f 84ad bb4d s.....p?po...M
0x0070: 4d9f 4107 be1b M.A...
13:47:07.960988 f0:03:bc:b7:1c:17 > 60:a9:54:13:72:16 802.1AE MACsec, an 0, pn 35, flags ECI, sci f003bcb71c170001,
0x0000: 888f d43c b278 94e7 7017 56ae 98b2 bc13 ...<.x..p.V.....
0x0010: b3f9 f460 2d97 b42f c13b e43b 11f9 70e4 ...`-../.;.;..p.
0x0020: a2eb 4fc5 7517 3445 910e bedd b6e1 0550 ..O.u.4E.......P
0x0030: 8e37 fbe7 8338 8a93 9765 5984 858b cc03 .7...8...eY.....
0x0040: a9df eb7e 2faf ebf4 97f7 bb5b d142 68f6 ...~/......[.Bh.
0x0050: a35d ffc5 d87f 65c4 1442 5c98 ea09 41d4 .]....e..B...A.
0x0060: a605 cb30 99aa 7d8a 49ae 7f4b 52aa 89e8 ...0..}.I..KR...
0x0070: 0c06 92fa eb98 ......
13:47:07.961921 60:a9:54:13:72:16 > f0:03:bc:b7:1c:17 802.1AE MACsec, an 0, pn 36, flags ECI, sci 60a9541372160001,

RP/0/RP0/CPU0:rr1#show macsec mka session interface TwentyFiveGigE0/0/0/4 detail | include Delay
Fri May 22 13:52:03.994 CEST
Delay Protection : TRUE
RP/0/RP0/CPU0:rr1#

RP/0/RP0/CPU0:dce2#show macsec mka session interface TwentyFiveGigE0/0/0/5 detail | include Delay
Fri May 22 13:57:19.096 CEST
Delay Protection : TRUE
RP/0/RP0/CPU0:dce2#

What delay protection does in MACsec

Delay protection ensures that frames are not just authentic and in-order, but also arrive within an acceptable time window.

Without it:

A packet can be captured
Held for a period
Re-injected later
Still pass integrity checks

With delay protection:

Frames that arrive too late (outside the configured window) are dropped

Think of it as:

Replay protection → blocks duplicate sequence numbers
Delay protection → blocks packets that are valid but suspiciously late