Question

A data center engineer is configuring hop-by-hop link encryption between two Nexus 9000 switches connected by a dark-fiber DCI link. The switches must authenticate each other and derive session keys automatically using a pre-shared key, without relying on 802.1X or an external policy server. Which key agreement protocol should the engineer configure for the MACsec session?

Accepted Answer

MACsec Key Agreement (MKA) using a pre-shared connectivity association key (CAK/CKN)

Answer

Security Association Protocol (SAP) with a manually configured IPsec transform set

Answer

IKEv2 with certificate-based mutual authentication

Answer

GDOI group key distribution from a key server on the DCI path