Disable MACsec

This page describes how to disable MACsec for Cloud Interconnect.

You can disable MACsec, which can be useful when troubleshooting your connection.

Disable MACsec for Cloud Interconnect

Select one of the following options:

Console

  1. In the Google Cloud console, go to the Cloud Interconnect Physical connections tab.

    Go to Physical connections

  2. Select the connection that you want to modify.

  3. On the MACsec tab, click Disable.

    In the confirmation dialog, read the message, and then click Confirm to confirm that you want to disable MACsec, or Cancel to cancel.

gcloud

To disable MACsec for Cloud Interconnect, run the following command:

gcloud compute interconnects macsec update INTERCONNECT_CONNECTION_NAME \
    --no-enabled

Replace INTERCONNECT_CONNECTION_NAME with the name of your Cloud Interconnect connection.

Verify MACsec configuration

Select one of the following options:

Console

  1. In the Google Cloud console, go to the Cloud Interconnect Physical connections tab.

    Go to Physical connections

  2. Select the connection that you want to view.

  3. The Link circuit info section displays the following information:

    • Google circuit ID: the name of the link circuit.

    • Link state: the LACP member link's physical state displays a Check and Active to indicate that the LACP member link is up.

    • MACsec key name: the field is empty when MACsec is disabled.

    • Receiving optical power: a check indicates an acceptable connection. The optical light level that the physical interface detects from the remote transmitter is displayed in dBm.

    • Transmitting optical power: a check indicates an acceptable connection and the optical light level that the physical interface is transmitting to the remote receiver is displayed in dBm.

  4. MACsec configuration displays Disabled to indicate that MACsec encryption is disabled on the link.

gcloud

To verify your Cloud Interconnect MACsec configuration, run the following command:

gcloud compute interconnects describe INTERCONNECT_CONNECTION_NAME

The output is similar to the following:

adminEnabled: true
availableFeatures:
- IF_MACSEC
circuitInfos:
- customerDemarcId: fake-peer-demarc-0
  googleCircuitId: LOOP-0
  googleDemarcId: fake-local-demarc-0
creationTimestamp: '2021-10-05T03:39:33.888-07:00'
customerName: Fake Company
description: something important
googleReferenceId: '123456789'
id: '12345678987654321'
interconnectAttachments:
- https://www.googleapis.com/compute/v1/projects/my-project1/regions/us-central1/interconnectAttachments/interconnect-123456-987654321-0
interconnectType: IT_PRIVATE
kind: compute#interconnect
labelFingerprint: 12H17262736_
linkType: LINK_TYPE_ETHERNET_10G_LR
location: https://www.googleapis.com/compute/v1/projects/my-project1/global/interconnectLocations/cbf-zone2-65012
macsec:
  failOpen: false
  preSharedKeys:
  - name: key1
    startTime: 2023-07-01T21:00:01.000Z
macsecEnabled: false
name: INTERCONNECT_CONNECTION_NAME
operationalStatus: OS_ACTIVE
provisionedLinkCount: 1
requestedFeatures:
- IF_MACSEC
requestedLinkCount: 1
selfLink: https://www.googleapis.com/compute/v1/projects/my-project1/global/interconnects/INTERCONNECT_CONNECTION_NAME
selfLinkWithId: https://www.googleapis.com/compute/v1/projects/my-project1/global/interconnects/12345678987654321
state: ACTIVE

The following items specify the MACsec connections's configuration:

  • macsec.failOpen: the connection's behavior if Cloud Interconnect can't establish an MKA session with your router. The value is either of the following:

    • false: if an MKA session can't be established, then Cloud Interconnect drops all traffic.

    • true: if an MKA session can't be established, then Cloud Interconnect passes unencrypted traffic.

  • macsec.preSharedKeys.name: the list of all pre-shared keys configured for Cloud Interconnect on this link.

  • macsec.preSharedKeys.startTime: when the current pre-shared key became valid. All keys have infinite validity.

  • macsecEnabled: MACsec status for Cloud Interconnect on this link. The value is either of the following:

    • false: MACsec for Cloud Interconnect is off.

    • true: MACsec for Cloud Interconnect is on.

This command doesn't display MACsec operational status.

What's next?