MACSEC Cisco 9K cipher

[sammanai]

Hi,

I seek advice regarding MACSEC Cisco 9K cipher recommendation to be used?

Thanks,

Sam

[MHM Cisco World · Accepted solution]

from cisco doc. 
The default MACsec cipher suite in the MKA policy will always be "GCM-AES-128". If the device supports both "GCM-AES-128" and "GCM-AES-256" ciphers, it is highly recommended to define and use a user defined MKA policy to include both 128 and 256 bits ciphers or only 256 bits cipher, as may be required.

MHM

[M02@rt37 · Accepted solution]

Hello @sammanai 

The default MACsec cipher suite "GCM-AES-128" is a strong choice, you have the option to define a user-defined MKA policy.

If your device supports both "GCM-AES-128" and "GCM-AES-256," and based on Cisco recommendation, you may consider defining a user-defined MKA policy that includes both 128-bit and 256-bit ciphers. This allows you to have flexibility in selecting the appropriate level of encryption based on your specific security requirements.

https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k-r7-5/system-security/configuration/guide/b-system-security-cg-asr9000-75x/implementing-macsec-encryption.html