12-06-2017 03:01 PM - edited 03-12-2019 04:48 AM
Hello everyone,
I am presented with the possibility of putting together a lab to evaluate this platform.
Initially I'll be working with two WS-C3850-24XS-S, each with a C3850-NM-2-40G. Wires, SFPs, OS version, proper feature set, etc. already taken care of.
As odd as it may seem, I couldn't yet find a paper as to what to expect in terms of macsec performance, and whether the two 40gig ports will work in a macsec etherchannel.
The documentation is scarce at best.
I've found this config, which I've tried, and it seems fine this far, but. Is it stable? Is it supported? Within the port-channel there is little you can do related to cts.
!
interface Port-channel10
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface Forty...x/1
switchport trunk encapsulation dot1q
switchport mode trunk
cts manual
no propagate sgt
sap pmk AAABBB mode-list gcm-encrypt
channel-group 10 mode on
!
interface Forty...x/2
switchport trunk encapsulation dot1q
switchport mode trunk
cts manual
no propagate sgt
sap pmk AAABBB mode-list gcm-encrypt
channel-group 10 mode on
!
As I wondered before, if anyone can comment on how much encryption power I can get from macsec I'd be grateful. Very!
Actually, any input will be greatly appreciated.
Regards,
Peter
Solved! Go to Solution.
12-07-2017 12:39 AM
I configured a few years back MACsec on a port-channel on a couple of 3560X, using a similar config I found at https://www.petenetlive.com/KB/Article/0001000 and I did not have any problems with it.
I believe the Nexus devices can have the MACSec config on the port-channel interface.
Performance with MACSec should be close to the link speed. Here is a doc on that:
12-14-2017 02:36 PM
12-07-2017 12:39 AM
I configured a few years back MACsec on a port-channel on a couple of 3560X, using a similar config I found at https://www.petenetlive.com/KB/Article/0001000 and I did not have any problems with it.
I believe the Nexus devices can have the MACSec config on the port-channel interface.
Performance with MACSec should be close to the link speed. Here is a doc on that:
12-14-2017 02:36 PM
Thanks for your input! I really appreciate it.
Guido
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide