Docs

Direct Connect

Dedicated Line

Managing encryption mode

Media Access Control Security (MACsec) is a Layer 2 encryption protocol based on IEEE 802.1AE. It encrypts Ethernet frames, verifies integrity, and authenticates devices. It protects data confidentiality, integrity, and authenticity on physical links. When creating a Direct Connect Connection, you must request a MACsec-capable port. This topic describes how to switch encryption modes and manage MACsec keys.

Capabilities

Only MACsec-capable DC Connections support encryption mode switching. Three modes are available:

No encryption (default): No encryption is applied.

Conditional encryption: Only checks whether packets are MACsec-encrypted. Packets failing the check are not dropped. Events are logged.

Mandatory encryption: Verifies encrypted data frames. Packets failing the check are dropped. Events are logged.

Shared Lines do not allow tenants to change encryption modes or manage MACsec keys.

Different port specifications support the following cipher suites:

Line type	Port speed	Supported cipher suites
Dedicated Line Shared Line	40 Gbps	GCM-AES-XPN-256 GCM-AES-256 (contact your account manager to request)
Dedicated Line Shared Line		100 Gbps	GCM-AES-XPN-256

Instructions

When a DC Connection is associated with a Virtual Interface, the following limits apply:

Switching from mandatory encryption to another mode is not supported.

Deleting a MACsec key in mandatory encryption mode is not supported.

To change the encryption mode or delete a key, delete the Virtual Interface first.

Changing the encryption mode or MACsec key triggers renegotiation. This may cause Direct Connect traffic anomalies or interruptions. Proceed with caution.

Switch encryption mode

Before you begin

Before switching from No encryption to Conditional encryption or Mandatory encryption, configure a MACsec key first.

Procedure

In the top menu bar, select the target project and region.

In the DC Connection list, click the name of the target DC Connection.

On the Overview tab, click the icon next to Encryption mode.

Select No encryption, Conditional encryption, or Mandatory encryption.

Click Buy now to complete the action.

Manage MACsec key

Before you begin

If you choose to use an existing key from VolcanoEngine Key Management Service (KMS), create a key ring and generate a key first.

Procedure

In the top menu bar, select the target project and region.

In the DC Connection list, click the name of the target DC Connection.

Click the MACsec tab to manage MACsec keys based on your scenario.

Configure MACsec key

Delete MACsec key

Click Associate MACsec key.

Configure the MACsec key based on the table below.

Parameter	Description	Example
Service name	Select the method to generate the MACsec key, including Upload CKN/CAK key pair or Existing key from KMS.	Upload CKN/CAK key pair
Credential selection	This parameter is required when the service name is set to Existing key from KMS. Select a key generated in the KMS.	KMS_key
Credential name	This parameter is required when the service name is set to Upload CKN/CAK key pair. Select a name for the MACsec key.	MACsec key 01
Key name	Enter the CKN of the CKN/CAK key pair.	01349DE***
Key	Enter the CAK of the CKN/CAK key pair.	5521TN4***

Click OK to complete the action.

Last updated: 2026.08.24 11:30:51