MACsec, defined in 802.1AE, provides MAC-layer encryption over wired networks by using out- of-band methods for encryption keying. The MACsec Key Agreement (MKA) Protocol provides the required session keys and manages the required encryption keys. MKA and MACsec are implemented after successful authentication using the 802.1x Extensible Authentication Protocol (EAP-TLS) or Pre Shared Key (PSK) framework. Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16- 9/configuration_guide/sec/b_169_sec_9300_cg/macsec_encryption.html