Print
知

某局点S12500R-2L macsec对接华为设备，对端接口无法up

zhiliao_0iJ9S2
12小时前 发表

问题描述

 

现场在接口下配置macsec对接华为设备，对端接口无法UP

xxx current state : UP (ifindex: 34)

Line protocol current state : DOWN

Description:

Route Port,The Maximum Transmit Unit is 1500,The Maximum Frame Length is 9216

Internet Address is 10.1.4.2/30

IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 0418-92b1-f1f2

Port Mode:     COMMON FIBER,     Port Split/Aggregate:               -

Speed:                40000,     Loopback:                        NONE

Duplex:                FULL,     Negotiation:                        -

Input Flow-control: DISABLE,     Output Flow-control:          DISABLE

Mdi:                      -,     Fec:                                -

Last physical up time   : 2026-03-04 02:43:07

Last physical down time : 2026-03-04 02:43:00

Current system time: 2026-03-04 02:48:18

Statistics last cleared:never

    Last 300 seconds input rate: 3 bits/sec, 0 packets/sec

    Last 300 seconds output rate: 397 bits/sec, 0 packets/sec

    Input peak rate 6222 bits/sec, Record time: 2026-03-03 12:11:28

    Output peak rate 6126 bits/sec, Record time: 2026-03-03 10:39:26

    Input :           50978108 bytes,             102601 packets

    Output:           53186809 bytes,             134922 packets

    Input:

      Unicast:                  49618,   Multicast:                   52868

      Broadcast:                  115,   Jumbo:                        8252

      Discard:                      0,   Frames:                         --

      Pause:                        0,   Ignoreds:                        0

 

      Total Error:                  0

      CRC:                          0,   Giants:                          0

      Jabbers:                     --,   Fragments:                       0

      Runts:                        0,   DropEvents:                      0

      Alignments:                   0,   Symbols:                         0

 

    Output:

      Unicast:                  49751,   Multicast:                   85122

      Broadcast:                   49,   Jumbo:                        8258

      Discard:                      0,   Buffers Purged:                  0

      Pause:                        0

 

      Total Error:                  0

 

    Input bandwidth utilization threshold : 90.00%

    Output bandwidth utilization threshold: 90.00%

    Last 300 seconds input utility rate:  0.01%

    Last 300 seconds output utility rate: 0.01%

 

过程分析

 

125R在使用macsec时有如下限制：

对于 KCR 系列单板和 S12500R-48C6D 设备，端口使能 MACSec 功能时，必须配置为 server 模式。

我司GCM-AES-256和GCM-AES-XPN-256加密套件和标准的开源加密套件实现不一致。当对端设备使用GCM-AES-256和GCM-AES-XPN-256的开源加密套件时，我司设备上使用同样的加密套件必须指定standard参数，否则无法与对端设备成功建立MKA会话。

让现场配置macsec cipher-suite gcm-aes-256 standard后，两端接口都不up了。

查看对端相关配置

 

 

interface xxx

undo portswitch

ip address a.b.c.d 255.255.255.252

mac-security-profile ds11

mka cak-mode static ckn a1a1a1a100000000000000000000000000000000000000000000000000000000 cak %+%##!!!!!!!!!"!!!!"!!!!*!!!!7L

TnVOK_g:*1(lVHpjf5&S}"'VZ_n6>w+h9!!!!!2jp5!!!!!!Q!!!!Cp|;:$8z$@<=B]P)>dn0FfzJOO^EHSLn]T&In:33V{*}%2EzPE[v`~.3)pe9%+%#

device transceiver 40GBASE-FIBER

#

return

[xxx] mac-security-profile ds11

[xxx] mac-security-profile name ds11

[xxx-macsec-profile-ds11]disp this

#

mac-security-profile name ds11

macsec cipher-suite gcm-aes-256

#

 

 

查看对端有无相关限制等因素：

mka cryptographic-algorithm { aes-cmac-128 | aes-cmac-256 | sm4-cmac-128 }设备使用MKA密钥生成算法根据CAK和CKN生成KEK、ICK和SAK。缺省情况下，MKA密钥生成算法为AES-CMAC-128。

解决方法

 

这块实现与我们有些差异： GCM-AES-128和GCM-AES-XPN-128加密套件要求所使用的CKN、CAK的长度都必须为32个字符。GCM-AES-256和GCM-AES-XPN-256加密套件要求使用的CKN、CAK的长度都必须为64个字符。

华为侧配置mka cryptographic-algorithm aes-cmac-256后，两端成功协商。