Hi, I'm trying to use GCM-AES-256 with Catalyst 9300 and MACSec. Tested with default MKA policy that uses GCM-AES-128 and everything works fine, it gets authenticated with ISE and I can see MKA session secured in switch. When changed encryption algorithm in switch and Secure Client profile to use only GCM-AES-256 it gets authenticated in ISE but then switch shows following errors:
Jul 17 22:47:53.048: %MKA-4-KEEPALIVE_TIMEOUT: (Gi1/0/6 : 24) Peer has stopped sending MKPDUs for RxSCI 4cd7.1734.0477/0000, AuditSessionID 63000B0A00000041C2DD406A, CKN 5398E19B67FA3DBBD94A5D60F75EB021
Jul 17 22:47:53.048: %MKA-4-SESSION_UNSECURED: (Gi1/0/6 : 24) MKA Session was stopped by MKA and not secured for RxSCI 4cd7.1734.0477/0000, AuditSessionID 63000B0A00000041C2DD406A, CKN 5398E19B67FA3DBBD94A5D60F75EB021
Jul 17 22:47:53.052: %SESSION_MGR-5-FAIL: Switch 1 R0/0: sessmgrd: Authorization failed or unapplied for client (4cd7.1734.0477) on Interface GigabitEthernet1/0/6 AuditSessionID 63000B0A00000041C2DD406A. Failure Reason: Linksec Failure.
Jul 17 22:47:53.053: %SESSION_MGR-5-FAIL: Switch 1 R0/0: sessmgrd: Authorization failed or unapplied for client (4cd7.1734.0477) on Interface GigabitEthernet1/0/6 AuditSessionID 63000B0A00000041C2DD406A. Failure Reason: Linksec Failure.
After that error messages, PC tries to authenticate with MAB, next method available. We tested with two differents PCs and Windows versions, 10 and 11, and we got same result.
Switch IOS-XE version is 17.12.03. There is MKA configuration for switch-to-switch MACSec, but it use different MKA Policy.
Double checked switch and it has Network Advantage licensing to enable GCM-AES-256.
What could be the issue?
Configuration in port and MKA policy
interface GigabitEthernet1/0/6
description ***************PRUEBAS GJ DOMINIO***********
switchport access vlan 113
switchport mode access
switchport voice vlan 303
device-tracking attach-policy MERAKI_POLICY
ip arp inspection limit rate 20
macsec
authentication event fail action next-method
authentication event server dead action authorize vlan 113
authentication event server dead action authorize voice
authentication event no-response action authorize vlan 113
authentication event server alive action reinitialize
authentication event linksec fail action next-method
authentication open
authentication linksec policy must-secure
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication violation restrict
mab
snmp trap mac-notification change added
snmp trap mac-notification change removed
dot1x pae authenticator
dot1x timeout tx-period 10
mka policy mka-256-macsec
spanning-tree portfast
spanning-tree bpduguard enable
end
CATSW-C9300-TEST#show run | sec mka
key chain mka-keys macsec
mka policy MKA-POLICY
key-server priority 30
macsec-cipher-suite gcm-aes-256
sak-rekey interval 65535
mka policy mka-256-macsec !This is the MKA policy for MACSec switch-to-host
macsec-cipher-suite gcm-aes-256
