How to Configure Layer 2 MACsec Encryption in Linux Using ip link

Securing enterprise network traffic between servers, top-of-rack switches, and data centre facilities typically relies on higher-layer cryptographic protocols such as IPsec or WireGuard/OpenVPN. While layer 3 encryption provides broad network routing flexibility, it incurs packet encapsulation overhead, increases CPU usage, and cannot protect unroutable layer 2 frames (such as ARP, DHCP, CDP/LLDP, or raw Ethernet payloads). In environments where physical tap eavesdropping, rogue switch ports, or cloud provider interconnects present security concerns, securing data directly at the data link layer is essential.

The IEEE 802.1AE standard—commonly known as MACsec (Media Access Control Security)—delivers connectionless data confidentiality, integrity, and replay protection directly on Ethernet links using line-rate AES-GCM cryptography. In modern Linux kernels, the iproute2 suite provides native support for creating and configuring MACsec virtual interfaces via ip link. Configuring MACsec allows systems administrators to establish encrypted point-to-point Ethernet tunnels between Linux hosts without external cryptographic daemons.

Understanding IEEE 802.1AE MACsec Architecture

MACsec operates by intercepting Ethernet frames between the physical network interface controller (NIC) and the operating system networking stack. When enabled, MACsec appends a Security Tag (SecTag) immediately following the source and destination MAC addresses:

• Secure Channel Identifier (SCI): A 64-bit unique identifier consisting of the transmitting host’s MAC address combined with a 16-bit Port Identifier (typically port 1).
• Packet Number (PN): A 32-bit (or 64-bit with Extended Packet Numbering) incrementing counter that guarantees replay attack prevention.
• Integrity Check Value (ICV): A 128-bit cryptographic message authentication code computed across the entire Ethernet frame using AES-GCM.
• Payload Encryption: The original layer 3 payload (IPv4/IPv6 packets) is fully encrypted using AES-GCM-128 or AES-GCM-256 before transmission onto the physical wire.

Prerequisites and Kernel Module Loading

MACsec support requires Linux kernel 4.6 or newer with the macsec kernel module compiled. Ensure the module is loaded into the running kernel:

sudo modprobe macsec

Verify that the module loaded successfully:

lsmod | grep macsec

To ensure the module loads automatically on system boot:

echo "macsec" | sudo tee -a /etc/modules-load.d/macsec.conf

Defining MACsec Keys and Identifiers

Establishing a manual point-to-point MACsec tunnel between two servers (Host A and Host B) connected via Ethernet (e.g., interface eth0) requires coordinating shared symmetric keys and channel identifiers:

Configuration Parameters

• Host A MAC Address: 52:54:00:11:22:33
• Host B MAC Address: 52:54:00:44:55:66
• Host A SCI: 5254001122330001
• Host B SCI: 5254004455660001
• Shared Connectivity Association Key (CAK): A 128-bit hexadecimal key, for example: 0123456789abcdef0123456789abcdef

Creating the MACsec Virtual Device on Host A

On Host A, create the virtual macsec0 device layered directly on top of physical interface eth0:

sudo ip link add link eth0 macsec0 type macsec port 1 encrypt on

Next, configure the transmit security association (TX SA) using Association Number (AN) 0:

sudo ip macsec add macsec0 tx sa 0 pn 1 on key 00 0123456789abcdef0123456789abcdef

Configure the receive channel (RX channel) to decrypt incoming traffic originating from Host B’s SCI:

sudo ip macsec add macsec0 rx port 1 address 52:54:00:44:55:66
sudo ip macsec add macsec0 rx 5254004455660001 sa 0 pn 1 on key 00 0123456789abcdef0123456789abcdef

Assign a private IP address to the MACsec virtual interface and bring both the underlying link and the virtual device up:

sudo ip link set eth0 up
sudo ip addr add 10.50.0.1/30 dev macsec0
sudo ip link set macsec0 up

Creating the Reciprocal MACsec Device on Host B

On Host B, mirror the configuration, swapping the local and remote MAC addresses:

# Create the virtual device
sudo ip link add link eth0 macsec0 type macsec port 1 encrypt on

# Configure TX SA (transmitting as Host B)
sudo ip macsec add macsec0 tx sa 0 pn 1 on key 00 0123456789abcdef0123456789abcdef

# Configure RX SA (receiving from Host A)
sudo ip macsec add macsec0 rx port 1 address 52:54:00:11:22:33
sudo ip macsec add macsec0 rx 5254001122330001 sa 0 pn 1 on key 00 0123456789abcdef0123456789abcdef

# Assign IP and activate
sudo ip link set eth0 up
sudo ip addr add 10.50.0.2/30 dev macsec0
sudo ip link set macsec0 up

Verifying MACsec Cryptographic Status and Statistics

To inspect active MACsec security associations, packet numbers, and encryption state on either host, use ip macsec show:

ip macsec show

The terminal outputs the operational status of the security channel:

12: macsec0: parent eth0 protect on validate strict encr on
    cipher GCM-AES-128
    TX: sci 5254001122330001
        sa 0: pn 24 on
    RX: sci 5254004455660001
        sa 0: pn 24 on

Test end-to-end connectivity across the encrypted tunnel:

ping -c 4 10.50.0.2

If you inspect physical interface eth0 using tcpdump -i eth0 -e, packets appear with 802.1AE Ethernet frame headers (EtherType 0x88e5) and encrypted payloads, confirming that all physical layer 2 frames are encrypted in transit.

Deleting MACsec Interfaces

To remove the encrypted tunnel and tear down the virtual device:

sudo ip link delete macsec0

Deploying MACsec via ip link gives Linux servers high-performance, wire-speed layer 2 encryption that protects Ethernet infrastructure against local network eavesdropping and tampering.