Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Nesta página, descrevemos como ativar o MACsec para o Cloud Interconnect.
Depois de gerar chaves pré-compartilhadas e configurar o roteador local para usá-las, será necessário ativar o MACsec para o Cloud Interconnect. Depois que o MAC para o Cloud Interconnect estiver ativado, verifique se a configuração do Cloud Interconnect está configurada corretamente e está usando o MACsec para ajudar a proteger seus dados.
Antes de começar
Se você não concluiu a configuração, configure o MACsec antes de ativar o MACsec para o Cloud Interconnect.
Ativar MACsec para Cloud Interconnect
Selecione uma das seguintes opções:
Console
No console do Google Cloud, acesse a guia Conexões
físicas do Cloud Interconnect.
A seção Link circuit info mostra as seguintes informações:
ID do circuito do Google: o nome do circuito de link.
Estado do link: o estado físico do link do membro do LACP exibe uma verificação
e ativacheck_circle para indicar que o link do membro do LACP está para cima.
Nome da chave MACsec: exibe uma verificação de check_circle e o
nome da chave MACsec para indicar que o MACsec está ativo no link.
Potência óptica de recebimento: uma Verificação de check_circle indica uma
conexão aceitável. O nível de luz óptica que a interface
física detecta no transmissor remoto é exibido em
dBm.
Transmissão óptica de potência: uma verificação de check_circle indica
uma conexão aceitável e o nível de luz óptica que a interface
física está transmitindo ao receptor remoto exibidos em dBm.
ID de demarcador do Google: o ID exclusivo atribuído pelo Google para o circuito de
link.
Clique na guia MACsec. A página MACsec do MACsec exibe um dos seguintes itens para sua configuração do MACsec:
Ativado, falha ao abrir: a criptografia MACsec está ativada no link. Se a criptografia MACsec não for estabelecida entre as duas extremidades, o
link funcionará sem criptografia.
Ativado, falha fechado: a criptografia MACsec está ativada no
link. Se a criptografia MACsec não for estabelecida entre as duas extremidades,
o link falhará.
Os itens a seguir especificam a configuração MACsec da conexão do Cloud Interconnect:
availableFeatures: recurso MACsec na
conexão do Cloud Interconnect. Esse parâmetro é mostrado apenas para
conexões de 10 GB do Cloud Interconnect, porque todas as
conexões de 100 GB do Cloud Interconnect são compatíveis com MACsec
por padrão.
macsec.failOpen: o comportamento da conexão se o Cloud Interconnect
não conseguir estabelecer uma sessão MKA com o roteador. O valor é um dos seguintes:
false: se uma sessão MKA não puder ser estabelecida, o Cloud Interconnect descartará todo o tráfego.
true: se uma sessão MKA não puder ser estabelecida, o Cloud Interconnect transmitirá o tráfego não criptografado.
macsec.preSharedKeys.name: a lista de todas as chaves pré-compartilhadas
configuradas para o Cloud Interconnect neste link.
macsec.preSharedKeys.startTime: o horário de início em que a chave pré-compartilhada atual é considerada válida. Todas as chaves têm validade infinita.
macsecEnabled: status MACsec para o Cloud Interconnect neste link. O valor é um dos seguintes:
false: o MACsec para o Cloud Interconnect está desativado.
true: o MACsec para o Cloud Interconnect está ativado.
Esse comando não exibe o status operacional MACsec.
Ativar o MACsec no roteador local
Consulte a documentação do fornecedor do roteador para ativar o MACsec no roteador local.
Remover a conexão do Cloud Interconnect
Se você tiver drenado sua conexão do Cloud Interconnect anteriormente, ative os anexos da VLAN.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-04-21 UTC."],[],[],null,["# Enable MACsec\n\nThis page describes how to enable MACsec for Cloud Interconnect.\n\nAfter you generate pre-shared keys and configure your on-premises router to use\nthem, you need to enable MACsec for Cloud Interconnect. After\nMACsec for Cloud Interconnect is enabled, you verify that your\nCloud Interconnect configuration is correctly configured and is using\nMACsec\nto help protect your data.\n\nBefore you begin\n----------------\n\nIf you haven't completed set up, then\n[set up MACsec](/network-connectivity/docs/interconnect/how-to/macsec/set-up-macsec)\nbefore enabling MACsec for Cloud Interconnect.\n| **Important:** When you enable MACsec on your Cloud Interconnect connection, the connection temporarily experiences packet loss. To avoid disruption to your connectivity, verify that there is no traffic on your Cloud Interconnect VLAN attachments before enabling MACsec for Cloud Interconnect. For more information, see [Disable VLAN\n| attachments](/network-connectivity/docs/interconnect/how-to/dedicated/disabling-vlans).\n\nEnable MACsec for Cloud Interconnect\n------------------------------------\n\nSelect one of the following options: \n\n### Console\n\n1. In the Google Cloud console, go to the Cloud Interconnect **Physical\n connections** tab.\n\n [Go to Physical connections](https://console.cloud.google.com/hybrid/interconnects/list?tab=interconnects)\n2. Select the connection that you want to modify.\n\n3. On the **MACsec** tab, click **Enable**.\n\n A confirmation window is displayed. Read the message, and then click\n **Confirm** to confirm that you want to enable MACsec, or **Cancel** to\n cancel.\n\n### gcloud\n\nTo enable MACsec for Cloud Interconnect with default settings, run the\nfollowing command: \n\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --enabled\n\nReplace \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e with the name of your\nCloud Interconnect connection.\n\nVerify MACsec configuration\n---------------------------\n\nSelect one of the following options: \n\n### Console\n\n1. In the Google Cloud console, go to the Cloud Interconnect **Physical\n connections** tab.\n\n [Go to Physical connections](https://console.cloud.google.com/hybrid/interconnects/list?tab=interconnects)\n2. Select the connection that you want to view.\n\n3. The **Link circuit info** section displays the following information:\n\n - **Google circuit ID:** the name of the link circuit.\n\n - **Link state:** the LACP member link's physical state displays a check_circle\n **Check** and **Active** to indicate that the LACP member link is up.\n\n - **MACsec key name** : displays a check_circle **Check** and the name of the\n MACsec key name to indicate that MACsec is active on the link.\n\n - **Receiving optical power:** a check_circle **Check** indicates an\n acceptable connection. The optical light level that the physical\n interface detects from the remote transmitter is displayed in\n [dBm](https://en.wikipedia.org/wiki/DBm).\n\n - **Transmitting optical power:** a check_circle **Check** indicates\n an acceptable connection and the optical light level that the physical\n interface is transmitting to the remote receiver is displayed in dBm.\n\n - **Google demarc ID:** the Google-assigned unique ID for the link\n circuit.\n\n4. Click the **MACsec** tab. The **MACsec** **configuration** displays one\n of the following for your MACsec configuration:\n\n - **Enabled, fail open:** MACsec encryption is enabled on the\n link. If MACsec encryption isn't established between both ends, then\n the link operates without encryption.\n\n - **Enabled, fail closed:** MACsec encryption is enabled on the\n link. If MACsec encryption isn't established between both ends, then\n the link fails.\n\n### gcloud\n\nRun the following command: \n\n gcloud compute interconnects describe \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e\n\nThe output is similar to the following 10 GB Cloud Interconnect\nexample; look for `availableFeatures` set to `IF_MACSEC` and the `macsec`\nsection: \n\n adminEnabled: true\n availableFeatures:\n - IF_MACSEC\n circuitInfos:\n - customerDemarcId: fake-peer-demarc-0\n googleCircuitId: LOOP-0\n googleDemarcId: fake-local-demarc-0\n creationTimestamp: '2021-10-05T03:39:33.888-07:00'\n customerName: Fake Company\n description: something important\n googleReferenceId: '123456789'\n id: '12345678987654321'\n interconnectAttachments:\n - https://www.googleapis.com/compute/v1/projects/my-project1/regions/us-central1/interconnectAttachments/interconnect-123456-987654321-0\n interconnectType: IT_PRIVATE\n kind: compute#interconnect\n labelFingerprint: 12H17262736_\n linkType: LINK_TYPE_ETHERNET_10G_LR\n location: https://www.googleapis.com/compute/v1/projects/my-project1/global/interconnectLocations/cbf-zone2-65012\n macsec:\n failOpen: false\n preSharedKeys:\n - name: key1\n startTime: 2023-07-01T21:00:01.000Z\n macsecEnabled: true\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/span\u003e\u003c/var\u003e\n operationalStatus: OS_ACTIVE\n provisionedLinkCount: 1\n requestedFeatures:\n - IF_MACSEC\n requestedLinkCount: 1\n selfLink: https://www.googleapis.com/compute/v1/projects/my-project1/global/interconnects/\u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e\n selfLinkWithId: https://www.googleapis.com/compute/v1/projects/my-project1/global/interconnects/12345678987654321\n state: ACTIVE\n\nThe following items specify the Cloud Interconnect connection's\nMACsec configuration:\n\n- **`availableFeatures`:** MACsec capability on the\n Cloud Interconnect connection. This parameter is shown only for\n 10 GB Cloud Interconnect connections, because all\n 100 GB Cloud Interconnect connections are MACsec capable\n by default.\n\n- **`macsec.failOpen`:** the connection's behavior if\n Cloud Interconnect can't establish an MKA session with your\n router. The value is either of the following:\n\n - **`false`:** if an MKA session can't be established, then\n Cloud Interconnect drops all traffic.\n\n - **`true`:** if an MKA session can't be established, then\n Cloud Interconnect passes unencrypted traffic.\n\n- **`macsec.preSharedKeys.name`:** the list of all pre-shared keys\n configured for Cloud Interconnect on this link.\n\n- **`macsec.preSharedKeys.startTime`:** the start time that the current\n pre-shared key is considered valid. All keys have infinite validity.\n\n- **`macsecEnabled`:** MACsec status for Cloud Interconnect on this\n link. The value is either of the following:\n\n - **`false`:** MACsec for Cloud Interconnect is off.\n - **`true`:** MACsec for Cloud Interconnect is on.\n\nThis command doesn't display MACsec operational status.\n\nEnable MACsec on your on-premises router\n----------------------------------------\n\nRefer to your router vendor's documentation to enable MACsec on your on-premises\nrouter.\n\nUndrain your Cloud Interconnect connection\n------------------------------------------\n\nIf you previously drained your Cloud Interconnect connection, [enable\nVLAN attachments](/network-connectivity/docs/interconnect/how-to/dedicated/enable-vlan-attachments).\n\nWhat's next?\n------------\n\n- [Troubleshoot MACsec](/network-connectivity/docs/interconnect/how-to/macsec/troubleshoot-macsec)\n- [View MACsec status](/network-connectivity/docs/interconnect/how-to/macsec/view-macsec-status)\n- [Disable MACsec](/network-connectivity/docs/interconnect/how-to/macsec/disable-macsec)\n- [Get MACsec keys](/network-connectivity/docs/interconnect/how-to/macsec/get-macsec-keys)\n- [Rotate MACsec keys](/network-connectivity/docs/interconnect/how-to/macsec/rotate-macsec-keys)"]]
