Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Questa pagina descrive come modificare il comportamento di fail-open di MACsec per Cloud Interconnect.
Puoi scegliere di attivare MACsec per Cloud Interconnect con comportamento di fail-open. Con fail-open si intende che se i router di confine di Google non riescono a stabilire una sessione di accordo sulle chiavi MACsec (MKA) con il tuo router, la connessione Cloud Interconnect rimane operativa con il traffico non criptato. L'impostazione predefinita consente di eliminare tutto il traffico se non è possibile stabilire una sessione MKA con il router.
Puoi modificare il comportamento del failover MACsec solo utilizzando Google Cloud CLI.
Attiva il comportamento fail-open
Verifica che non sia presente traffico sulla connessione Cloud Interconnect prima di attivare MACsec per Cloud Interconnect con comportamento fail-open.
Se hai attivato il comportamento di fail-open per MACsec per Cloud Interconnect,
puoi scegliere di disattivarlo in un secondo momento. Dopo aver disattivato il comportamento di fail-open, se i router di confine di Google non riescono a stabilire una sessione di accordo sulle chiavi MACsec (MKA) con il tuo router, la connessione perde tutto il traffico.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-05 UTC."],[],[],null,["# Modify fail-open behavior\n\nThis page describes how to modify MACsec for Cloud Interconnect\nfail-open behavior.\n\nYou can choose to enable MACsec for Cloud Interconnect with fail-open\nbehavior. Fail-open means that if Google's edge routers can't establish a MACsec\nkey agreement (MKA) session with your router, then the Cloud Interconnect\nconnection remains operational with unencrypted traffic. The default setting\ndrops all traffic if an MKA session can't be established with your router.\n\nYou can change MACsec fail-over behavior only by using the Google Cloud CLI.\n| **Warning:** To avoid unintentionally passing unencrypted traffic, we recommend that you use the default setting for production traffic, and use fail-open behavior only for testing and troubleshooting.\n\nEnable fail-open behavior\n-------------------------\n\nVerify that there is no traffic on your Cloud Interconnect connection before\nenabling MACsec for Cloud Interconnect with fail-open behavior.\n**Important:** When you enable fail-open behavior on your Cloud Interconnect connection, you must temporarily disable MACsec on your Cloud Interconnect connection. The connection temporarily experiences packet loss as a result. To avoid disruption to your network, verify that there is no traffic on your Cloud Interconnect VLAN attachments before disabling MACsec for Cloud Interconnect. For more information, see [Disable or enable VLAN attachments](/network-connectivity/docs/interconnect/how-to/dedicated/disabling-vlans). \n\n### gcloud\n\nRun the following commands: \n\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --no-enabled \\\n --fail-open\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --enabled\n\nDisable fail-open behavior\n--------------------------\n\nIf you have fail-open behavior enabled for MACsec for Cloud Interconnect,\nyou can choose to later disable fail-open behavior. After fail-open behavior is\ndisabled, if Google's edge routers can't establish a MACsec key agreement (MKA)\nsession with your router, then the connection drops all traffic.\n**Important:** When you disable fail-open behavior on your Cloud Interconnect connection, you must temporarily disable MACsec on your Cloud Interconnect connection. The connection temporarily experiences packet loss as a result. To avoid disruption to your network, verify that there is no traffic on your Cloud Interconnect VLAN attachments before disabling MACsec for Cloud Interconnect. For more information, see [Disable or enable VLAN attachments](/network-connectivity/docs/interconnect/how-to/dedicated/disabling-vlans). \n\n### gcloud\n\nRun the following commands: \n\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --no-enabled \\\n --no-fail-open\n gcloud compute interconnects macsec update \u003cvar translate=\"no\"\u003eINTERCONNECT_CONNECTION_NAME\u003c/var\u003e \\\n --enabled\n\nWhat's next?\n------------\n\n- [Troubleshoot MACsec](/network-connectivity/docs/interconnect/how-to/macsec/troubleshoot-macsec)"]]
