이 페이지에서는 MACsec for Cloud Interconnect를 사용 설정하는 방법을 설명합니다.
사전 공유 키를 생성하고 온프레미스 라우터가 사전 공유 키를 사용하도록 구성한 후에는 MACsec for Cloud Interconnect를 사용 설정해야 합니다. MACsec for Cloud Interconnect가 사용 설정되면 Cloud Interconnect 구성이 올바르게 구성되고 MACsec를 사용하여 데이터를 보호하는지 확인합니다.
시작하기 전에
설정을 완료하지 않은 경우 MACsec for Cloud Interconnect를 사용 설정하기 전에 MACsec를 설정합니다.
MACsec for Cloud Interconnect 사용 설정
다음 옵션 중 하나를 선택합니다.
콘솔
Google Cloud 콘솔에서 Cloud Interconnect 실제 연결 탭으로 이동합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["# Enable MACsec\n\nThis page describes how to enable MACsec for Cloud Interconnect.\n\nAfter you generate pre-shared keys and configure your on-premises router to use\nthem, you need to enable MACsec for Cloud Interconnect. After\nMACsec for Cloud Interconnect is enabled, you verify that your\nCloud Interconnect configuration is correctly configured and is using\nMACsec\nto help protect your data.\n\nBefore you begin\n----------------\n\nIf you haven't completed set up, then\n[set up MACsec](/network-connectivity/docs/interconnect/how-to/macsec/set-up-macsec)\nbefore enabling MACsec for Cloud Interconnect.\n| **Important:** When you enable MACsec on your Cloud Interconnect connection, the connection temporarily experiences packet loss. To avoid disruption to your connectivity, verify that there is no traffic on your Cloud Interconnect VLAN attachments before enabling MACsec for Cloud Interconnect. For more information, see [Disable VLAN\n| attachments](/network-connectivity/docs/interconnect/how-to/dedicated/disabling-vlans).\n\nEnable MACsec for Cloud Interconnect\n------------------------------------\n\nSelect one of the following options: \n\n### Console\n\n1. In the Google Cloud console, go to the Cloud Interconnect **Physical\n connections** tab.\n\n [Go to Physical connections](https://console.cloud.google.com/hybrid/interconnects/list?tab=interconnects)\n2. Select the connection that you want to modify.\n\n3. On the **MACsec** tab, click **Enable**.\n\n A confirmation window is displayed. Read the message, and then click\n **Confirm** to confirm that you want to enable MACsec, or **Cancel** to\n cancel.\n\n### gcloud\n\nTo enable MACsec for Cloud Interconnect with default settings, run the\nfollowing command: \n\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --enabled\n\nReplace \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e with the name of your\nCloud Interconnect connection.\n\nVerify MACsec configuration\n---------------------------\n\nSelect one of the following options: \n\n### Console\n\n1. In the Google Cloud console, go to the Cloud Interconnect **Physical\n connections** tab.\n\n [Go to Physical connections](https://console.cloud.google.com/hybrid/interconnects/list?tab=interconnects)\n2. Select the connection that you want to view.\n\n3. The **Link circuit info** section displays the following information:\n\n - **Google circuit ID:** the name of the link circuit.\n\n - **Link state:** the LACP member link's physical state displays a check_circle\n **Check** and **Active** to indicate that the LACP member link is up.\n\n - **MACsec key name** : displays a check_circle **Check** and the name of the\n MACsec key name to indicate that MACsec is active on the link.\n\n - **Receiving optical power:** a check_circle **Check** indicates an\n acceptable connection. The optical light level that the physical\n interface detects from the remote transmitter is displayed in\n [dBm](https://en.wikipedia.org/wiki/DBm).\n\n - **Transmitting optical power:** a check_circle **Check** indicates\n an acceptable connection and the optical light level that the physical\n interface is transmitting to the remote receiver is displayed in dBm.\n\n - **Google demarc ID:** the Google-assigned unique ID for the link\n circuit.\n\n4. Click the **MACsec** tab. The **MACsec** **configuration** displays one\n of the following for your MACsec configuration:\n\n - **Enabled, fail open:** MACsec encryption is enabled on the\n link. If MACsec encryption isn't established between both ends, then\n the link operates without encryption.\n\n - **Enabled, fail closed:** MACsec encryption is enabled on the\n link. If MACsec encryption isn't established between both ends, then\n the link fails.\n\n### gcloud\n\nRun the following command: \n\n gcloud compute interconnects describe \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e\n\nThe output is similar to the following 10 GB Cloud Interconnect\nexample; look for `availableFeatures` set to `IF_MACSEC` and the `macsec`\nsection: \n\n adminEnabled: true\n availableFeatures:\n - IF_MACSEC\n circuitInfos:\n - customerDemarcId: fake-peer-demarc-0\n googleCircuitId: LOOP-0\n googleDemarcId: fake-local-demarc-0\n creationTimestamp: '2021-10-05T03:39:33.888-07:00'\n customerName: Fake Company\n description: something important\n googleReferenceId: '123456789'\n id: '12345678987654321'\n interconnectAttachments:\n - https://www.googleapis.com/compute/v1/projects/my-project1/regions/us-central1/interconnectAttachments/interconnect-123456-987654321-0\n interconnectType: IT_PRIVATE\n kind: compute#interconnect\n labelFingerprint: 12H17262736_\n linkType: LINK_TYPE_ETHERNET_10G_LR\n location: https://www.googleapis.com/compute/v1/projects/my-project1/global/interconnectLocations/cbf-zone2-65012\n macsec:\n failOpen: false\n preSharedKeys:\n - name: key1\n startTime: 2023-07-01T21:00:01.000Z\n macsecEnabled: true\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/span\u003e\u003c/var\u003e\n operationalStatus: OS_ACTIVE\n provisionedLinkCount: 1\n requestedFeatures:\n - IF_MACSEC\n requestedLinkCount: 1\n selfLink: https://www.googleapis.com/compute/v1/projects/my-project1/global/interconnects/\u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e\n selfLinkWithId: https://www.googleapis.com/compute/v1/projects/my-project1/global/interconnects/12345678987654321\n state: ACTIVE\n\nThe following items specify the Cloud Interconnect connection's\nMACsec configuration:\n\n- **`availableFeatures`:** MACsec capability on the\n Cloud Interconnect connection. This parameter is shown only for\n 10 GB Cloud Interconnect connections, because all\n 100 GB Cloud Interconnect connections are MACsec capable\n by default.\n\n- **`macsec.failOpen`:** the connection's behavior if\n Cloud Interconnect can't establish an MKA session with your\n router. The value is either of the following:\n\n - **`false`:** if an MKA session can't be established, then\n Cloud Interconnect drops all traffic.\n\n - **`true`:** if an MKA session can't be established, then\n Cloud Interconnect passes unencrypted traffic.\n\n- **`macsec.preSharedKeys.name`:** the list of all pre-shared keys\n configured for Cloud Interconnect on this link.\n\n- **`macsec.preSharedKeys.startTime`:** the start time that the current\n pre-shared key is considered valid. All keys have infinite validity.\n\n- **`macsecEnabled`:** MACsec status for Cloud Interconnect on this\n link. The value is either of the following:\n\n - **`false`:** MACsec for Cloud Interconnect is off.\n - **`true`:** MACsec for Cloud Interconnect is on.\n\nThis command doesn't display MACsec operational status.\n\nEnable MACsec on your on-premises router\n----------------------------------------\n\nRefer to your router vendor's documentation to enable MACsec on your on-premises\nrouter.\n\nUndrain your Cloud Interconnect connection\n------------------------------------------\n\nIf you previously drained your Cloud Interconnect connection, [enable\nVLAN attachments](/network-connectivity/docs/interconnect/how-to/dedicated/enable-vlan-attachments).\n\nWhat's next?\n------------\n\n- [Troubleshoot MACsec](/network-connectivity/docs/interconnect/how-to/macsec/troubleshoot-macsec)\n- [View MACsec status](/network-connectivity/docs/interconnect/how-to/macsec/view-macsec-status)\n- [Disable MACsec](/network-connectivity/docs/interconnect/how-to/macsec/disable-macsec)\n- [Get MACsec keys](/network-connectivity/docs/interconnect/how-to/macsec/get-macsec-keys)\n- [Rotate MACsec keys](/network-connectivity/docs/interconnect/how-to/macsec/rotate-macsec-keys)"]]
