Licensing Requirements and Limitations for MACsec
Involved Network Elements
Other network elements need to support MACsec.
Licensing Requirements
MACsec is controlled by the license. By default, MACsec is disabled on a newly purchased switch. To use MACsec, apply for and purchase the license from the equipment supplier.
Version Requirements
Product |
Software Version |
|---|---|
CE12800 |
V200R005C00 |
For details about the mapping between software versions and switch models, see the Hardware Query Tool.
Software version evolution: V100R001C00 -> V100R002C00 -> V100R003C00 -> V100R003C10 -> V100R005C00 -> V100R005C10 -> V100R006C00 -> V200R001C00 -> V200R002C50 -> V200R003C00 -> V200R005C00 -> V200R005C10 -> V200R019C00 -> V200R019C10
Feature Limitations
The CE-L16CQ-FD and CE-L08CF-FG1 support MACsec.
- Only point-to-point MACsec is supported.
Only 100GE physical interfaces support MACsec in Layer 2 or Layer 3 mode. MACsec can also be supported when 100GE interfaces are split or 100GE interfaces are negotiated to 40GE interfaces.
- Only 100GE physical interfaces support MACsec in Layer 2 or Layer 3 mode. MACsec can be supported when 100GE interfaces are split or 100GE interfaces are negotiated to 40GE interfaces.
The switch and client cannot be interconnected through MACsec.
- MACsec can encrypt both Layer 2 and Layer 3 packets. If intermediate devices do not support MACsec, they only perform Layer 2 forwarding.
- MACsec and 802.1x cannot be configured together on the same interface.
- MACsec and PFC cannot be configured together on the same interface.
- After a MACsec connection is established, the server can switch the encryption algorithm, and the client also switches the encryption algorithm accordingly. However, when a Huawei device functions as a server and a non-Huawei device that does not support encryption algorithm switching functions as a client, MACsec negotiation is interrupted if the server switches the encryption algorithm.