A method comprising: establishing, by a network controller, a first media access control security, MACsec, flow between a first network device and a second network device, wherein the network controller sets forwarding rules for the first MACsec flow on a number of switches between the first and second network devices; provisioning, with the network controller, the first network device with a set of MACsec keys for the first MACsec flow, wherein the first network device comprises a first endpoint of the first MACsec flow; provisioning, with the network controller, the second network device with the set of MACsec keys for the first MACsec flow, wherein the second network device comprises a second endpoint of the first MACsec flow; not provisioning the number of switches between the first and second network devices with the set of MACsec keys; instructing, by the network controller, the first network device to encrypt traffic of the first MACsec flow using a particular MACsec key from the set of MACsec keys; and instructing, by the network controller, the second network device to decrypt the MACsec flow using the particular MACsec key from the set of MACsec keys, encrypting a MACsec flow with the first network device using the particular MACsec key from the set of MACsec keys; and decrypting the MACsec flow with the second network device using the particular MACsec key from the set of MACsec keys, wherein the network controller is to instruct use of a different MACsec key from the set of MACsec keys (i) after a period of time (ii) after a number of packets have been encrypted/decrypted; or (iii) according to a bandwidth of a link between the first network device and the second network device. establishing, by a network controller, a first media access control security, MACsec, flow between a first network device and a second network device, wherein the network controller sets forwarding rules for the first MACsec flow on a number of switches between the first and second network devices; provisioning, with the network controller, the first network device with a set of MACsec keys for the first MACsec flow, wherein the first network device comprises a first endpoint of the first MACsec flow; provisioning, with the network controller, the second network device with the set of MACsec keys for the first MACsec flow, wherein the second network device comprises a second endpoint of the first MACsec flow; not provisioning the number of switches between the first and second network devices with the set of MACsec keys; instructing, by the network controller, the first network device to encrypt traffic of the first MACsec flow using a particular MACsec key from the set of MACsec keys; and instructing, by the network controller, the second network device to decrypt the MACsec flow using the particular MACsec key from the set of MACsec keys, encrypting a MACsec flow with the first network device using the particular MACsec key from the set of MACsec keys; and decrypting the MACsec flow with the second network device using the particular MACsec key from the set of MACsec keys, wherein the network controller is to instruct use of a different MACsec key from the set of MACsec keys (i) after a period of time (ii) after a number of packets have been encrypted/decrypted; or (iii) according to a bandwidth of a link between the first network device and the second network device.