Associates a MACsec key with a dedicated Express Connect circuit port. MACsec uses dedicated encryption chips (such as NICs or switches) to implement low-latency encryption and decryption, directly encrypting physical links (such as optical fibers or Ethernet) to cover all traffic from the sender to the receiver.
Operation description
To use this feature, the following conditions must be met:
-
The device on which the Express Connect circuit resides supports the MACsec feature.
-
The Express Connect circuit payment must be completed.
-
Only dedicated Express Connect circuits are supported.
Other notes:
-
A maximum of three CKN and CAK pairs can be configured.
-
Associating a key that is currently in the Disassociated state disassociates the previously active key.
-
Associating a key that is currently in the AssociatedFailed state triggers the device to renegotiate the session.
Try it now
Test
RAM authorization
Request parameters
|
Parameter |
Type |
Required |
Description |
Example |
| RegionId |
string |
Yes |
The region ID of the Express Connect circuit. You can call the DescribeRegions operation to query region IDs. |
cn-hangzhou |
| PhysicalConnectionId |
string |
Yes |
The ID of the Express Connect circuit. The Express Connect circuit must be a dedicated circuit that has completed payment, supports MACsec, and is in the Enabled state. You can call DescribePhysicalConnections to query the current status and device capabilities. |
pc-bp1hp0wr072f6**** |
| CipherSuite |
string |
Yes |
The encryption algorithm type. Valid values:
|
GCM-AES-128 |
| Ckn |
string |
Yes |
The key name. Only hexadecimal characters are supported. Lowercase characters are automatically transformed to uppercase. When the encryption algorithm type is GCM-AES-128 or GCM-AES-XPN-128, the length must be 32 hexadecimal characters. When the encryption algorithm type is GCM-AES-256 or GCM-AES-XPN-256, the length must be 64 hexadecimal characters. |
0123456789ABCDEF0123456789ABCDEF |
| Cak |
string |
Yes |
The passphrase. Only hexadecimal characters are supported. Lowercase characters are automatically transformed to uppercase. When the encryption algorithm type is GCM-AES-128 or GCM-AES-XPN-128, the length must be 32 hexadecimal characters. When the encryption algorithm type is GCM-AES-256 or GCM-AES-XPN-256, the length must be 64 hexadecimal characters. |
0123456789ABCDEF0123456789ABCDEF |
Response elements
|
Element |
Type |
Description |
Example |
|
object |
|||
| RequestId |
string |
The request ID. |
D32B3C26-6C6C-4988-93E9-D2A6444CE6AE |
Examples
Success response
JSON format
{
"RequestId": "D32B3C26-6C6C-4988-93E9-D2A6444CE6AE"
}Error codes
|
HTTP status code |
Error code |
Error message |
Description |
|---|---|---|---|
| 400 | IllegalParam.%s | The param of %s is illegal. | The parameter is invalid. |
| 400 | ResourceNotFound.PhysicalConnectionId | The specified resource of [%s] is not found. | The Express Connect circuit does not exist. |
| 400 | IncorrectStatus.PhysicalConnection | The status of %s [%s] is incorrect. | The status of the physical connection does not support this operation. |
| 400 | UnsupportedFeature.Macsec | The feature of Macsec is not supported. | The current physical connection does not support the MACSec feature. |
| 400 | IncorrectStatus.PconnMacsec | The status of %s [%s] is incorrect. | The operation is not allowed because the MACSec key is in an unstable state. |
| 400 | QuotaExceeded.PconnMacsec | The quota of PconnMacsec is exceeded, usage 3/3. | A physical connection supports binding up to three sets of MACSec keys. |
| 400 | UnsupportedFeature.Macsec.CipherSuite | The feature of Macsec.CipherSuite is not supported. | The current physical connection supports MACSec, but does not support the selected encryption algorithm. |
See Error Codes for a complete list.
Release notes
See Release Notes for a complete list.