Dell N3200-ON Networking N-Series Switches User Guide version 6.8.0 - Page 384

Media Access Control Security NOTE: Only the Dell Networking N32xx supports the Media Access Control Security feature. The Media Access Control Security (MACsec) feature provides secure communications between stations that are attached to the same LAN. It uses symmetric key cryptography so that communication cannot be monitored or altered on the wire. Traffic traversing the link is MACsec-secured through the use of data integrity checks and encryption. MACsec is standardized in IEEE 802.1AE, which specifies the forwarding plane for MACsec. The key management and its integration with 802.1x is standardized in IEEE 802.1X-2010. The data integrity checks verify the integrity of the data. MACsec appends an 8-byte header called Sectag and a 16-byte tail called ICV to all secured Ethernet frames. These are checked by the receiving interface to ensure that the data was not compromised while traversing the link. MACsec can also be used to encrypt all traffic on the Ethernet link. The encryption used by MACsec ensures that the data in the Ethernet frame cannot be viewed by anyone monitoring traffic on the link. MACsec encryption is optional and user-configurable-you can enable MACsec to ensure the data integrity checks are performed while still sending unencrypted data in the clear over the MACsec-secured link, if desired. Dell MACsec supports confidentiality through encryption, integrity, and replay protection. For information about the CLI commands you use to configure MACsec features, refer to Switch Management Commands in the Dell Networking CLI Reference Guide at www.dell.com/support. 384 Authentication, Authorization, and Accounting