Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Nesta página, descrevemos como modificar o MACsec para o comportamento de abertura/falha do Cloud Interconnect.
É possível ativar o MACsec para o Cloud Interconnect com o comportamento fail open. Fail Open significa que, se os roteadores de borda do Google não conseguirem estabelecer uma sessão de acordo de chave MACsec (MKA, na sigla em inglês) com o roteador, a conexão do Cloud Interconnect permanecerá operacional com tráfego não criptografado. A configuração padrão
eliminará todo o tráfego se uma sessão MKA não puder ser estabelecida com seu roteador.
Só é possível alterar o comportamento de failover do MACsec usando a CLI do Google Cloud.
Ativar comportamento de fail open
Verifique se não há tráfego na sua conexão do Cloud Interconnect antes de ativar o MACsec para o Cloud Interconnect com comportamento de fail open.
Se o comportamento de falha de abertura estiver ativado para MACsec para o Cloud Interconnect, você poderá desativá-lo depois. Depois que o comportamento de falha de abertura for desativado, se os roteadores de borda do Google não conseguirem estabelecer uma sessão de acordo de chave MACsec (MKA) com o roteador, a conexão descartará todo o tráfego.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-12 UTC."],[],[],null,["# Modify fail-open behavior\n\nThis page describes how to modify MACsec for Cloud Interconnect\nfail-open behavior.\n\nYou can choose to enable MACsec for Cloud Interconnect with fail-open\nbehavior. Fail-open means that if Google's edge routers can't establish a MACsec\nkey agreement (MKA) session with your router, then the Cloud Interconnect\nconnection remains operational with unencrypted traffic. The default setting\ndrops all traffic if an MKA session can't be established with your router.\n\nYou can change MACsec fail-over behavior only by using the Google Cloud CLI.\n| **Warning:** To avoid unintentionally passing unencrypted traffic, we recommend that you use the default setting for production traffic, and use fail-open behavior only for testing and troubleshooting.\n\nEnable fail-open behavior\n-------------------------\n\nVerify that there is no traffic on your Cloud Interconnect connection before\nenabling MACsec for Cloud Interconnect with fail-open behavior.\n**Important:** When you enable fail-open behavior on your Cloud Interconnect connection, you must temporarily disable MACsec on your Cloud Interconnect connection. The connection temporarily experiences packet loss as a result. To avoid disruption to your network, verify that there is no traffic on your Cloud Interconnect VLAN attachments before disabling MACsec for Cloud Interconnect. For more information, see [Disable or enable VLAN attachments](/network-connectivity/docs/interconnect/how-to/dedicated/disabling-vlans). \n\n### gcloud\n\nRun the following commands: \n\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --no-enabled \\\n --fail-open\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --enabled\n\nDisable fail-open behavior\n--------------------------\n\nIf you have fail-open behavior enabled for MACsec for Cloud Interconnect,\nyou can choose to later disable fail-open behavior. After fail-open behavior is\ndisabled, if Google's edge routers can't establish a MACsec key agreement (MKA)\nsession with your router, then the connection drops all traffic.\n**Important:** When you disable fail-open behavior on your Cloud Interconnect connection, you must temporarily disable MACsec on your Cloud Interconnect connection. The connection temporarily experiences packet loss as a result. To avoid disruption to your network, verify that there is no traffic on your Cloud Interconnect VLAN attachments before disabling MACsec for Cloud Interconnect. For more information, see [Disable or enable VLAN attachments](/network-connectivity/docs/interconnect/how-to/dedicated/disabling-vlans). \n\n### gcloud\n\nRun the following commands: \n\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --no-enabled \\\n --no-fail-open\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --enabled\n\nWhat's next?\n------------\n\n- [Troubleshoot MACsec](/network-connectivity/docs/interconnect/how-to/macsec/troubleshoot-macsec)"]]
