Switch to switch encryption over a leased fiber line info needed (MACsec)

pcweber · ‎09-01-2017

We have a security requirement to encrypt the data flow to our DR location and the storage vendor does not do so in the replication traffic process. I have been asked to look into encrypting the traffic at the switch level. I have read that MACsec can do so. I have a few questions.

1. Do I have to place the 2 switches at the extreme edge where the connection is at each side?

2. If the answer to question #1 is no, can the MACsec switches be deeper in the network on each side behind multiple standard Layer II switches that do not support MACsec and the encrypted traffic will be passed?

3. If I have to place them at the edge and it encrypts all traffic, does adding this encryption cause any noticeable decrease in data throughput for replication? We have a 1GB link and other folks replicating data have a clear sense of replication performance now.

Reza Sharifi · ‎09-01-2017

For questions 1 and 2, you don't have to put it at the edge. You can put it deeper in the network but every device has support encryption.

For question 3, you would have to test it to see the impact. Throughput, latency, high CPU, may not be a concern when using larger chassis based switches but you may see more impact on smaller switches.

The other option would be to build an IPsec tunnel between two end points but that is mainly a function of routers and not so much switches.

HTH

pcweber · ‎09-01-2017

Yea, it may be simpler just to use a couple routers at the edge and setup IPSec tunnel.

Reza Sharifi · ‎09-01-2017

Yes, that is a lot simpler than running MACsec on every device.

HTH

pcweber · ‎09-01-2017

Is L2TP another way to do this?

pcweber · ‎11-01-2017

So then can I place a router on each edge to create an IPSEC tunnel and extend 802.1q VLAN over Layer 2 end to end? Everything I google responds with Ipsec over Layer 3. This is a Layer 2 extension of our network to a DR facility over VPLS and the same VLANs/ networks are at DR. If so, can someone suggest a link to doing so or the basic terms to research?