MacSec on 8300 TX Interface

[DaveBeattie]

I am looking to run "switch-to-switch" MacSec on a 8300-2N2S-4T2X. The hand off is 1GE-TX. I realise that the onboard TX interfaces do not support MacSec, but could I use a TX SPF (GLC-TE or SFP-10G-T-X) in one of the onboard 10G interfaces to make this work? The opposite end of the link will be an identical 8300-2N2S-4T2X router.

[balaji.bandi]

MKA is supported on switch-to-host facing links. Host-facing links typically use flexible authentication ordering for handling heterogeneous devices with or without IEEE 802.1x, and can optionally use MKA-based MACsec encryption.

check the limitation here :

https://www.cisco.com/c/en/us/td/docs/routers/ir8340/software/configuration/b_ir8340_cg_17-8/m-macsec-encryption.html

[DaveBeattie]

Hi BB

Thanks for the response, but I am using a 8300-2N2S-4T2X router not a 8340 and I am looking to do switch-to-switch MacSec, not switch-to-host.

[balaji.bandi · Accepted solution]

apologies that was wrong URL :

check below FAQ :

https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8300-series-edge-platforms/cat-8300-series-edge-qa.html

https://www.youtube.com/watch?v=zahI4F8IYOk

[DaveBeattie]

Thanks for the updated links. I have read through the notes again and followed the video. There does not seem to be any stated reason that I can't use a TX optic in the 8300-2N2S-4T2X router onboard 10G interfaces, so I am going to go ahead with my purchases on that basis.