Modify fail-open behavior

This page describes how to modify MACsec for Cloud Interconnect fail-open behavior.

You can choose to enable MACsec for Cloud Interconnect with fail-open behavior. Fail-open means that if Google's edge routers can't establish a MACsec key agreement (MKA) session with your router, then the Cloud Interconnect connection remains operational with unencrypted traffic. The default setting drops all traffic if an MKA session can't be established with your router.

You can change MACsec fail-over behavior only by using the Google Cloud CLI.

Warning: To avoid unintentionally passing unencrypted traffic, we recommend that you use the default setting for production traffic, and use fail-open behavior only for testing and troubleshooting.

Enable fail-open behavior

Verify that there is no traffic on your Cloud Interconnect connection before enabling MACsec for Cloud Interconnect with fail-open behavior.

Important: When you enable fail-open behavior on your Cloud Interconnect connection, you must temporarily disable MACsec on your Cloud Interconnect connection. The connection temporarily experiences packet loss as a result. To avoid disruption to your network, verify that there is no traffic on your Cloud Interconnect VLAN attachments before disabling MACsec for Cloud Interconnect. For more information, see Disable or enable VLAN attachments.

gcloud

Run the following commands:

gcloud compute interconnects macsec update INTERCONNECT_CONNECTION_NAME \
    --no-enabled \
    --fail-open
gcloud compute interconnects macsec update INTERCONNECT_CONNECTION_NAME \
    --enabled

Disable fail-open behavior

If you have fail-open behavior enabled for MACsec for Cloud Interconnect, you can choose to later disable fail-open behavior. After fail-open behavior is disabled, if Google's edge routers can't establish a MACsec key agreement (MKA) session with your router, then the connection drops all traffic.

Important: When you disable fail-open behavior on your Cloud Interconnect connection, you must temporarily disable MACsec on your Cloud Interconnect connection. The connection temporarily experiences packet loss as a result. To avoid disruption to your network, verify that there is no traffic on your Cloud Interconnect VLAN attachments before disabling MACsec for Cloud Interconnect. For more information, see Disable or enable VLAN attachments.

gcloud

Run the following commands:

gcloud compute interconnects macsec update INTERCONNECT_CONNECTION_NAME \
    --no-enabled \
    --no-fail-open
gcloud compute interconnects macsec update INTERCONNECT_CONNECTION_NAME \
    --enabled

What's next?

• Troubleshoot MACsec