- MACsec is an IEEE standard for securing
our wired networks.
MACsec is specifically outlined
by the IEEE 802.1AE standard.
This is a Layer 2 protocol used to provide data integrity
and confidentiality over ethernet connections,
and it is an extension to the 802.1X standard.
Let's think about the way wireless networks operate
with Wi-Fi protection mechanisms such as WPA and WPA2.
Both of these protocols offer AES encryption for wireless
communication which provides integrity and confidentiality
for our wireless traffic, alongside 802.1X authentication.
MACsec, short for MAC Security, is essentially the wired
equivalent to this type of protection.
Now this problem could also have been solved by using IPsec.
But think about the implications for that.
We would have to use IPsec between every single end point
and infrastructure device in our network.
We've talked in previous videos about how our modern
networks require things like next generation firewalls,
in order to give us deep traffic inspection capabilities
for quality of service and for advanced malware protection.
So IPsec everywhere isn't really a viable option for that.
And that's the reason that MACsec was born.
It provides that much needed Layer 2 encryption
using 128-bit AES.
Also notable is the fact that MACsec
uses a hop-by-hop encryption method.
That is to say that traffic is only
encrypted between two MACsec capable peers.
When the traffic is processed internally within a switch,
that is providing the MACsec service,
that traffic is unencrypted and that is going to allow
the switch to look at the traffic at a deeper level.
So it will be able to see things like TrustSec SGT's,
the Security Group Tag, and the QoS role
so that traffic can be properly forwarded and QoS enforced.
The way that MACsec is processed within a switch is by using
the ASIC - the application-specific integrated circuit.
This is a circuit separate from the main switched CPU
that is used to make switching decisions
quickly and efficiently.
The switch ASIC is used to perform the encryption
and the decryption, saving CPU power that would be leveraged
if you were using IPsec encryption.
So MACsec is easier to process by a switch.
MACsec adds an 802.1AE header to an ethernet frame
which is a 16-byte MACsec security tag.
An additional integrity check value of 16 bytes
is also added, called an ICV.
Again, since this a hop-by-hop encryption method,
that means that every device in the traffic flow
must support MACsec in order to provide
end-to-end security features.
At the time of this recording,
there are two keying mechanisms available for MACsec,
which both use 128-bit AES-GCM symmetric encryption.
Those are the Security Association Protocol or SAP,
and the MACsec Key Agreement Protocol or MKA.
Both of these provide line-rate encryption and
decryption for ethernet interfaces up to 10 gig.
The difference is that SAP is a CISCO-proprietary keying
protocol used between Cisco switches, while MKA is an
open industry standard used between switches and also
between endpoints and switches.
A couple of related terms that you want to know are
downlink MACsec and uplink MACsec.
Downlink MACsec refers to the encrypted link
between an endpoint and a switch.
This uses the MKA protocol since the encryption
is happening between an endpoint and a switch.
This requires obviously a MACsec capable switch
and a special supplicant software on the client,
just like 802.1X requires special supplicant software
on the endpoint.
One common example of that type of software would be the
Cisco anyconnect client.
When we enable MACsec on a Cisco switch, we can set
the switch to force encryption or to make that optional.
So if you have some non MACsec-capable clients,
you might want to leave that option open.
You might not want to force that.
Once again, the Cisco identities services engine is
very commonly used to implement MACsec and to enforce
these types of authorization options,
just as we examined with TrustSec.
Uplink MACsec refers to the encrypted links
between the switches.
The default MACsec keying mechanism that's used
between Cisco switches is the proprietary SAP,
the Security Association Protocol.
But that can certainly be configured to use the
open industry standard, MKA, if you desire.
Uplink MACsec can be configured for dynamic negotiation
between switches or for manual configuration.
MACsec is very commonly layered with TrustSec.
MACsec provides integrity and encryption,
while TrustSec brings the authentication piece,
in order to provide a complete security suite
for our wired traffic.
So that's a look at the basics of MACsec,
which is a solution for encrypting wired network traffic.