5 ms·
When macsec exists?
by Hikikomori 1y ago
When macsec exists?
- bc569a80a344f9c 1y agoNo kidding. Just to elaborate for others, MACSec is a standard (802.1ae) and runs at line rate. Something like a Juniper PTX10008 can run it at 400Gbps, and it’s just a feature you turn on for the port you’d be using for the link you want to protect anyway (PTXs are routers/switches, not security devices). If I need to provide encryption on a DCI, I’m at least somewhat likely to have gear that can just do this with vendor support instead of needing to slap together some Linux based solution. Unless, I suppose, there’s various layer 2 domains you’re stitching together with multiple L2 hops and you don’t control the ones in the middle. In which case I’d just get a different link where that isn’t true.
- tecleandor 1y agoI have at least one switch that's MACSec compatible at line speed but I haven't had time to take a look. I guess this is confined to LAN and cannot do a MACSec link through the internet, isn't it?
- bc569a80a344f9c 1y agoIt’s port to port. It protects a link.
- tecleandor 1y agoThanks!
- ur-whale 1y ago> When macsec exists? When you say "exists" ... is there an OpenSource high-quality implementation ?
- Hikikomori 1y agohttps://man7.org/linux/man-pages/man8/ip-macsec.8.html https://man7.org/linux/man-pages/man8/ip-macsec.8.html Generally its used when you have links going between two of your sites, so you typically only need it on your switch or router that terminate that link.
- c0l0 1y agoYeah that would have been great, but it's not available on our existing core switches (Dell PowerSwitch S5200 series).
- justsomehnguy 1y agohttps://news.ycombinator.com/item?id=41531699 https://news.ycombinator.com/item?id=41531699 'Testing MACsec' paragraph, especially around >> Last but not least, ... so that half of the traffic ... was being sent fully unencrypted ...