topic Re: Macsec on mirror port in Network Security

Macsec on mirror port

LionKin1984 — Wed, 03 Mar 2021 11:12:06 GMT

hello

Can macsec be applied to span/mirror port on the switches?

Thanks

Re: Macsec on mirror port

Sheraz.Salim — Wed, 03 Mar 2021 14:34:58 GMT

You can use a netflow to see the traffic for macsec tags.

if you use a span/mirror to capture the packet but if the lin is encrypted (if you configured the encryption). you wont be ableto see it as they are encrypted. just like IPsec.

you question is specific Can macsec be applied to span/mirror port on the switches,

I am not sure to this one let see what others have to say on this.

Re: Macsec on mirror port

balaji.bandi — Wed, 03 Mar 2021 14:31:22 GMT

Can macsec be applied to span/mirror port on the switches?

Cisco TrustSec and Cisco SAP are meant only for switch-to-switch links and are not supported on switch ports connected to end hosts, such as PCs or IP phones.

Between MACsec-capable devices, packets are encrypted on egress from the sending device, decrypted on ingress to the receiving device, and in the clear within the devices.

Re: Macsec on mirror port

LionKin1984 — Thu, 04 Mar 2021 12:29:50 GMT

hello, thanks for your replies, there is a typo in my original question, the question should be:

is it possible to apply macsec to RSPAN ports on the cisco switches?

the topology is:

there are two switches, SW1 and SW2, the traffic on SW1 needs to be forwarded to the wireshark device that is connected to SW2, i have configured the RSPAN on both switches and i can now see the traffic on the wireshark, so my question now is can the mirrored traffic between SW1 and SW2 be encrypted with macsec?

thanks