Ethernet Security – Running MACsec and VLAN in Parallel

ethernetmacSecurity

MACsec (IEEE 802.1ae) adds a security tag to an Ethernet frame and encrypts the IEEE 802.1Q field, the EtherType and the payload field.

If you want to use VLAN, you need the 802.1Q field to announce the VLAN ID. The EtherType is usually set to 0x8100.

However, both MACsec and VLAN use an unique EtherType. As far as I undertand, the security tag introduced by MACsec uses an own EtherType. Is it possible to use MACsec and VLAN in parallel?

Best Answer

Welcome to Network Engineering! There is no standard for MACSec and 802.1Q, so manufacturers have come up with their own solutions. Cisco calls it "WAN MACSec," and does it this way:

The WAN MACsec offering is standards based but offers additional capabilities not found in earlier MACsec capabilities. More specifically, MACsec can be leveraged by enterprise customers over public carrier Ethernet offerings, allowing customers to adapt to the public carrier Ethernet service offering and capabilities (or restrictions).

New enhancements for WAN MACsec include:

  1. 802.1Q Tag in the Clear

  2. Standard IEEE 802.1X-rev MACsec Key Agreement

  3. Integrated MACsec authentication adaptability over public Carrier Ethernet transport

  4. 802.1Q Tag in the Clear

This enhancement offers the ability to expose the 802.1Q tag outside the encrypted MACsec header. Exposing this field offers a multitude of design options with MACsec, and in some cases of public Carrier Ethernet transport providers, is necessary for leveraging certain transport services (see use case section).

https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/white-paper-c11-737544.html

Related Topic