Cisco ASR-1001HX and MACsec support on port-channel

[Netgizmo86]

Hi ,

  Is MACsec encryption supported either on port-channel or on member 10Gbps ports in a port-channel on a Cisco ASR1001-HX ?

I am slightly confused looking at the documentation

MACsec and MKA Configuration Guide - WAN MACSEC and MKA Support Enhancements [Cisco ASR 1000 Series Aggregation Services Routers] - Cisco

Thank you

[Flavio Miranda · Accepted solution]

It is not supported on channel and not in interface part of the channel:

MACsec configuration on Ether Channel (Link bundling) is not supported.

Any interface configured with MACsec cannot be part of Ether Channel.

[balaji.bandi]

As per i know when we tested using Cat 9500 below was achieved. :

MACsec configuration is not supported on EtherChannel ports. Instead, MACsec configuration can be applied on the individual member ports of an EtherChannel. To remove MACsec configuration, you must first unbundle the member ports from the EtherChannel, and then remove it from the individual member ports.

[Netgizmo86]

Thanks Balaji , agreed for 9000. However my question specific to ASR1001 as  I think that is the limitation we have on ASR1000 platform. 

[balaji.bandi · Accepted solution]

Looks like Router works in different way i guess here : i rad the document again for ASR

looks like the Limitations :

• MACsec configuration on Ether Channel (Link bundling) is not supported.

• Any interface configured with MACsec cannot be part of Ether Channel.