MACsec with SDA roadmap

[kklyubin]

Hi All,

Hope you’re doing well!

Just one small question – if MACsec support is on the roadmap for SD-Access? Or there are no plans to support it at all?

Any input would be very welcome

[jedolphi]

Hello Katerina,

Update: In Cisco SD-Access  2.2.2.x there is some support for MACsec, depending on the specific circumstances. Cisco partners can review this URL for more details: https://www.cisco.com/c/dam/en/us/products/se/2021/6/Business_Unit/What_s_New_in_Cisco_SD-Access_2_2_2_4_-_v1_01__Partner.pdf

Best regards, Jerome

[M@rco]

Any new information? Link is dead by the way.

[Jonathan Cuthbert]

We support MACsec in SD-Access Fabric using templates or manual CLI.

• Switch-to-switch MACsec in SD-Access has been validated using pre-shared key (PSK) key-chains.

• Routing platforms have not been validated for MACsec in an SD-Access Fabric.

• aes-256-cmac has been validated for the MACsec Keychain Cryptographic-Algorithm.

• gcm-aes-256 has been validated for the MKA Policy Cipher-Suite.

• Switch-to-host MACsec in SD-Access has been validated using a dynamically authorization result from ISE wherein the encryption policy is returned with the authorization result.

[fernando-diaz]

Hello Jonathan,

It's a pleasure to greet you.

I want to know in what exact scenario MACSEC switch-to-host works in SD-Access.
I currently have an SD-Access network and the MACSEC switch-to-host generates problems when DHCP negotiation of the host. With MACSEC enabled, the host does not receive an IP address.

 Do you have any Cisco documents showing that MACSEC Switch-to-host is supported in SD-Access networks?

[norberto.padin]

Hello Jonatahan, as of today code, do we support host-to-switch MacSec with SD-Access in the Cat9300?

TIA.

[jedolphi]

Largely not supported unfortunately. Please speak to your sales team about roadmap. See TrustSec section of 17.15 release notes, https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-15/release_notes/ol-17-15-9300.html