Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara mengubah MACsec untuk perilaku
perilaku fail-open Cloud Interconnect.
Anda dapat memilih untuk mengaktifkan MACsec untuk Cloud Interconnect dengan perilaku
fail-open. Fail-open berarti apabila router edge Google tidak dapat membuat sesi
perjanjian kunci MACsec (MKA) dengan router Anda, koneksi Cloud Interconnect
akan tetap beroperasi dengan traffic yang tidak dienkripsi. Setelan default
akan menghapus semua traffic jika sesi MKA tidak dapat dibuat dengan menggunakan router Anda.
Anda dapat mengubah perilaku failover MACsec hanya dengan menggunakan Google Cloud CLI.
Mengaktifkan perilaku fail-open
Pastikan tidak ada traffic pada koneksi Cloud Interconnect sebelum
mengaktifkan MACsec untuk Cloud Interconnect dengan perilaku fail-open.
Jika perilaku fail-open diaktifkan untuk MACsec untuk Cloud Interconnect,
Anda dapat memilih untuk menonaktifkan perilaku fail-open nantinya. Setelah perilaku fail-open
dinonaktifkan, koneksi akan menghentikan semua traffic jika router edge Google tidak dapat membuat
sesi perjanjian kunci MACsec (MKA) dengan router Anda.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[],[],null,["# Modify fail-open behavior\n\nThis page describes how to modify MACsec for Cloud Interconnect\nfail-open behavior.\n\nYou can choose to enable MACsec for Cloud Interconnect with fail-open\nbehavior. Fail-open means that if Google's edge routers can't establish a MACsec\nkey agreement (MKA) session with your router, then the Cloud Interconnect\nconnection remains operational with unencrypted traffic. The default setting\ndrops all traffic if an MKA session can't be established with your router.\n\nYou can change MACsec fail-over behavior only by using the Google Cloud CLI.\n| **Warning:** To avoid unintentionally passing unencrypted traffic, we recommend that you use the default setting for production traffic, and use fail-open behavior only for testing and troubleshooting.\n\nEnable fail-open behavior\n-------------------------\n\nVerify that there is no traffic on your Cloud Interconnect connection before\nenabling MACsec for Cloud Interconnect with fail-open behavior.\n**Important:** When you enable fail-open behavior on your Cloud Interconnect connection, you must temporarily disable MACsec on your Cloud Interconnect connection. The connection temporarily experiences packet loss as a result. To avoid disruption to your network, verify that there is no traffic on your Cloud Interconnect VLAN attachments before disabling MACsec for Cloud Interconnect. For more information, see [Disable or enable VLAN attachments](/network-connectivity/docs/interconnect/how-to/dedicated/disabling-vlans). \n\n### gcloud\n\nRun the following commands: \n\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --no-enabled \\\n --fail-open\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --enabled\n\nDisable fail-open behavior\n--------------------------\n\nIf you have fail-open behavior enabled for MACsec for Cloud Interconnect,\nyou can choose to later disable fail-open behavior. After fail-open behavior is\ndisabled, if Google's edge routers can't establish a MACsec key agreement (MKA)\nsession with your router, then the connection drops all traffic.\n**Important:** When you disable fail-open behavior on your Cloud Interconnect connection, you must temporarily disable MACsec on your Cloud Interconnect connection. The connection temporarily experiences packet loss as a result. To avoid disruption to your network, verify that there is no traffic on your Cloud Interconnect VLAN attachments before disabling MACsec for Cloud Interconnect. For more information, see [Disable or enable VLAN attachments](/network-connectivity/docs/interconnect/how-to/dedicated/disabling-vlans). \n\n### gcloud\n\nRun the following commands: \n\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --no-enabled \\\n --no-fail-open\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --enabled\n\nWhat's next?\n------------\n\n- [Troubleshoot MACsec](/network-connectivity/docs/interconnect/how-to/macsec/troubleshoot-macsec)"]]
