MACsec: Logical interfaces

You can configure Media Access Control Security (MACsec) at the logical interface level (also called the virtual interface level). This feature allows multiple MACSec Key Agreement (MKA) sessions on a single physical port.

To support VLAN-level MACsec, the MKA protocol packets are sent out with the VLAN tags configured on the logical interface. VLAN tags are transmitted in clear text, which allows intermediate switches that are MACsec-unaware to switch the packets based on the VLAN tags. When you configure MACsec, you must bind the connectivity association to an interface.