Skip to content

Commit f82835e

Browse files
PterosaurPterosaur
authored
[doc]: Add MACsec CLI doc (sonic-net#2334)
What I did Add usage and example of MACsec CLI into doc. How I did it Add usage and example of MACsec CLI into doc. Signed-off-by: Ze Gan <[email protected]>
1 parent 666bdc0 commit f82835e

File tree

1 file changed

+253
-0
lines changed

1 file changed

+253
-0
lines changed

‎doc/Command-Reference.md

+253
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,11 @@
186186
* [ZTP Configuration And Show Commands](#ztp-configuration-and-show-commands)
187187
* [ ZTP show commands](#ztp-show-commands)
188188
* [ZTP configuration commands](#ztp-configuration-commands)
189+
* [MACsec Commands](#macsec-commands)
190+
* [MACsec config command](#macsec-config-command)
191+
* [MACsec show command](#macsec-show-command)
192+
* [MACsec clear command](#macsec-clear-command)
193+
189194

190195
## Document History
191196

@@ -11022,3 +11027,251 @@ Running command: ztp run -y
1102211027
```
1102311028
1102411029
Go Back To [Beginning of the document](#SONiC-COMMAND-LINE-INTERFACE-GUIDE) or [Beginning of this section](#ztp-configuration-and-show-commands)
11030+
11031+
# MACsec Commands
11032+
11033+
This sub-section explains the list of the configuration options available for MACsec. MACsec feature is as a plugin to SONiC, So please install MACsec package before using MACsec commands.
11034+
11035+
## MACsec config command
11036+
11037+
- Add MACsec profile
11038+
```
11039+
admin@sonic:~$ sudo config macsec profile add --help
11040+
Usage: config macsec profile add [OPTIONS] <profile_name>
11041+
11042+
Add MACsec profile
11043+
11044+
Options:
11045+
--priority <priority> For Key server election. In 0-255 range with
11046+
0 being the highest priority. [default:
11047+
255]
11048+
--cipher_suite <cipher_suite> The cipher suite for MACsec. [default: GCM-
11049+
AES-128]
11050+
--primary_cak <primary_cak> Primary Connectivity Association Key.
11051+
[required]
11052+
--primary_ckn <primary_cak> Primary CAK Name. [required]
11053+
--policy <policy> MACsec policy. INTEGRITY_ONLY: All traffic,
11054+
except EAPOL, will be converted to MACsec
11055+
packets without encryption. SECURITY: All
11056+
traffic, except EAPOL, will be encrypted by
11057+
SecY. [default: security]
11058+
--enable_replay_protect / --disable_replay_protect
11059+
Whether enable replay protect. [default:
11060+
False]
11061+
--replay_window <enable_replay_protect>
11062+
Replay window size that is the number of
11063+
packets that could be out of order. This
11064+
field works only if ENABLE_REPLAY_PROTECT is
11065+
true. [default: 0]
11066+
--send_sci / --no_send_sci Send SCI in SecTAG field of MACsec header.
11067+
[default: True]
11068+
--rekey_period <rekey_period> The period of proactively refresh (Unit
11069+
second). [default: 0]
11070+
-?, -h, --help Show this message and exit.
11071+
```
11072+
11073+
- Delete MACsec profile
11074+
```
11075+
admin@sonic:~$ sudo config macsec profile del --help
11076+
Usage: config macsec profile del [OPTIONS] <profile_name>
11077+
11078+
Delete MACsec profile
11079+
11080+
Options:
11081+
-?, -h, --help Show this message and exit.
11082+
```
11083+
11084+
- Enable MACsec on the port
11085+
```
11086+
admin@sonic:~$ sudo config macsec port add --help
11087+
Usage: config macsec port add [OPTIONS] <port_name> <profile_name>
11088+
11089+
Add MACsec port
11090+
11091+
Options:
11092+
-?, -h, --help Show this message and exit.
11093+
```
11094+
11095+
11096+
- Disable MACsec on the port
11097+
```
11098+
admin@sonic:~$ sudo config macsec port del --help
11099+
Usage: config macsec port del [OPTIONS] <port_name>
11100+
11101+
Delete MACsec port
11102+
11103+
Options:
11104+
-?, -h, --help Show this message and exit.
11105+
11106+
```
11107+
11108+
11109+
## MACsec show command
11110+
11111+
- Show MACsec
11112+
11113+
```
11114+
admin@vlab-02:~$ show macsec --help
11115+
Usage: show macsec [OPTIONS] [INTERFACE_NAME]
11116+
11117+
Options:
11118+
-d, --display [all] Show internal interfaces [default: all]
11119+
-n, --namespace [] Namespace name or all
11120+
-h, -?, --help Show this message and exit.
11121+
11122+
```
11123+
11124+
```
11125+
admin@vlab-02:~$ show macsec
11126+
MACsec port(Ethernet0)
11127+
--------------------- -----------
11128+
cipher_suite GCM-AES-256
11129+
enable true
11130+
enable_encrypt true
11131+
enable_protect true
11132+
enable_replay_protect false
11133+
replay_window 0
11134+
send_sci true
11135+
--------------------- -----------
11136+
MACsec Egress SC (5254008f4f1c0001)
11137+
----------- -
11138+
encoding_an 2
11139+
----------- -
11140+
MACsec Egress SA (1)
11141+
------------------------------------- ----------------------------------------------------------------
11142+
auth_key 849B69D363E2B0AA154BEBBD7C1D9487
11143+
next_pn 1
11144+
sak AE8C9BB36EA44B60375E84BC8E778596289E79240FDFA6D7BA33D3518E705A5E
11145+
salt 000000000000000000000000
11146+
ssci 0
11147+
SAI_MACSEC_SA_ATTR_CURRENT_XPN 179
11148+
SAI_MACSEC_SA_STAT_OCTETS_ENCRYPTED 0
11149+
SAI_MACSEC_SA_STAT_OCTETS_PROTECTED 0
11150+
SAI_MACSEC_SA_STAT_OUT_PKTS_ENCRYPTED 0
11151+
SAI_MACSEC_SA_STAT_OUT_PKTS_PROTECTED 0
11152+
------------------------------------- ----------------------------------------------------------------
11153+
MACsec Egress SA (2)
11154+
------------------------------------- ----------------------------------------------------------------
11155+
auth_key 5A8B8912139551D3678B43DD0F10FFA5
11156+
next_pn 1
11157+
sak 7F2651140F12C434F782EF9AD7791EE2CFE2BF315A568A48785E35FC803C9DB6
11158+
salt 000000000000000000000000
11159+
ssci 0
11160+
SAI_MACSEC_SA_ATTR_CURRENT_XPN 87185
11161+
SAI_MACSEC_SA_STAT_OCTETS_ENCRYPTED 0
11162+
SAI_MACSEC_SA_STAT_OCTETS_PROTECTED 0
11163+
SAI_MACSEC_SA_STAT_OUT_PKTS_ENCRYPTED 0
11164+
SAI_MACSEC_SA_STAT_OUT_PKTS_PROTECTED 0
11165+
------------------------------------- ----------------------------------------------------------------
11166+
MACsec Ingress SC (525400edac5b0001)
11167+
MACsec Ingress SA (1)
11168+
--------------------------------------- ----------------------------------------------------------------
11169+
active true
11170+
auth_key 849B69D363E2B0AA154BEBBD7C1D9487
11171+
lowest_acceptable_pn 1
11172+
sak AE8C9BB36EA44B60375E84BC8E778596289E79240FDFA6D7BA33D3518E705A5E
11173+
salt 000000000000000000000000
11174+
ssci 0
11175+
SAI_MACSEC_SA_ATTR_CURRENT_XPN 103
11176+
SAI_MACSEC_SA_STAT_IN_PKTS_DELAYED 0
11177+
SAI_MACSEC_SA_STAT_IN_PKTS_INVALID 0
11178+
SAI_MACSEC_SA_STAT_IN_PKTS_LATE 0
11179+
SAI_MACSEC_SA_STAT_IN_PKTS_NOT_USING_SA 0
11180+
SAI_MACSEC_SA_STAT_IN_PKTS_NOT_VALID 0
11181+
SAI_MACSEC_SA_STAT_IN_PKTS_OK 0
11182+
SAI_MACSEC_SA_STAT_IN_PKTS_UNCHECKED 0
11183+
SAI_MACSEC_SA_STAT_IN_PKTS_UNUSED_SA 0
11184+
SAI_MACSEC_SA_STAT_OCTETS_ENCRYPTED 0
11185+
SAI_MACSEC_SA_STAT_OCTETS_PROTECTED 0
11186+
--------------------------------------- ----------------------------------------------------------------
11187+
MACsec Ingress SA (2)
11188+
--------------------------------------- ----------------------------------------------------------------
11189+
active true
11190+
auth_key 5A8B8912139551D3678B43DD0F10FFA5
11191+
lowest_acceptable_pn 1
11192+
sak 7F2651140F12C434F782EF9AD7791EE2CFE2BF315A568A48785E35FC803C9DB6
11193+
salt 000000000000000000000000
11194+
ssci 0
11195+
SAI_MACSEC_SA_ATTR_CURRENT_XPN 91824
11196+
SAI_MACSEC_SA_STAT_IN_PKTS_DELAYED 0
11197+
SAI_MACSEC_SA_STAT_IN_PKTS_INVALID 0
11198+
SAI_MACSEC_SA_STAT_IN_PKTS_LATE 0
11199+
SAI_MACSEC_SA_STAT_IN_PKTS_NOT_USING_SA 0
11200+
SAI_MACSEC_SA_STAT_IN_PKTS_NOT_VALID 0
11201+
SAI_MACSEC_SA_STAT_IN_PKTS_OK 0
11202+
SAI_MACSEC_SA_STAT_IN_PKTS_UNCHECKED 0
11203+
SAI_MACSEC_SA_STAT_IN_PKTS_UNUSED_SA 0
11204+
SAI_MACSEC_SA_STAT_OCTETS_ENCRYPTED 0
11205+
SAI_MACSEC_SA_STAT_OCTETS_PROTECTED 0
11206+
--------------------------------------- ----------------------------------------------------------------
11207+
MACsec port(Ethernet1)
11208+
--------------------- -----------
11209+
cipher_suite GCM-AES-256
11210+
enable true
11211+
enable_encrypt true
11212+
enable_protect true
11213+
enable_replay_protect false
11214+
replay_window 0
11215+
send_sci true
11216+
--------------------- -----------
11217+
MACsec Egress SC (5254008f4f1c0001)
11218+
----------- -
11219+
encoding_an 1
11220+
----------- -
11221+
MACsec Egress SA (1)
11222+
------------------------------------- ----------------------------------------------------------------
11223+
auth_key 35FC8F2C81BCA28A95845A4D2A1EE6EF
11224+
next_pn 1
11225+
sak 1EC8572B75A840BA6B3833DC550C620D2C65BBDDAD372D27A1DFEB0CD786671B
11226+
salt 000000000000000000000000
11227+
ssci 0
11228+
SAI_MACSEC_SA_ATTR_CURRENT_XPN 4809
11229+
SAI_MACSEC_SA_STAT_OCTETS_ENCRYPTED 0
11230+
SAI_MACSEC_SA_STAT_OCTETS_PROTECTED 0
11231+
SAI_MACSEC_SA_STAT_OUT_PKTS_ENCRYPTED 0
11232+
SAI_MACSEC_SA_STAT_OUT_PKTS_PROTECTED 0
11233+
------------------------------------- ----------------------------------------------------------------
11234+
MACsec Ingress SC (525400edac5b0001)
11235+
MACsec Ingress SA (1)
11236+
--------------------------------------- ----------------------------------------------------------------
11237+
active true
11238+
auth_key 35FC8F2C81BCA28A95845A4D2A1EE6EF
11239+
lowest_acceptable_pn 1
11240+
sak 1EC8572B75A840BA6B3833DC550C620D2C65BBDDAD372D27A1DFEB0CD786671B
11241+
salt 000000000000000000000000
11242+
ssci 0
11243+
SAI_MACSEC_SA_ATTR_CURRENT_XPN 5033
11244+
SAI_MACSEC_SA_STAT_IN_PKTS_DELAYED 0
11245+
SAI_MACSEC_SA_STAT_IN_PKTS_INVALID 0
11246+
SAI_MACSEC_SA_STAT_IN_PKTS_LATE 0
11247+
SAI_MACSEC_SA_STAT_IN_PKTS_NOT_USING_SA 0
11248+
SAI_MACSEC_SA_STAT_IN_PKTS_NOT_VALID 0
11249+
SAI_MACSEC_SA_STAT_IN_PKTS_OK 0
11250+
SAI_MACSEC_SA_STAT_IN_PKTS_UNCHECKED 0
11251+
SAI_MACSEC_SA_STAT_IN_PKTS_UNUSED_SA 0
11252+
SAI_MACSEC_SA_STAT_OCTETS_ENCRYPTED 0
11253+
SAI_MACSEC_SA_STAT_OCTETS_PROTECTED 0
11254+
--------------------------------------- ----------------------------------------------------------------
11255+
```
11256+
11257+
## MACsec clear command
11258+
11259+
Clear MACsec counters which is to reset all MACsec counters to ZERO.
11260+
11261+
```
11262+
admin@sonic:~$ sonic-clear macsec --help
11263+
Usage: sonic-clear macsec [OPTIONS]
11264+
11265+
Clear MACsec counts. This clear command will generated a cache for next
11266+
show commands which will base on this cache as the zero baseline to show
11267+
the increment of counters.
11268+
11269+
Options:
11270+
--clean-cache BOOLEAN If the option of clean cache is true, next show
11271+
commands will show the raw counters which based on
11272+
the service booted instead of the last clear command.
11273+
-h, -?, --help Show this message and exit.
11274+
```
11275+
11276+
11277+

0 commit comments

Comments
 (0)