topic Re: Encrypt a point to point connection? in ExtremeSwitching (EXOS/Switch Engine)

Encrypt a point to point connection?

Stephen_Stormon — Tue, 29 Sep 2020 02:11:42 GMT

We have a point to point connection running between two x460 switches running 16.2.5.4-patch1-12. We are going through a FISMA readiness audit and are being told that we need to encrypt that P2P connection between those devices. Is that possible natively or do we need to purchase different equipment and/or newer version of XOS or do we need a 3rd party solution to make that happen?

Re: Encrypt a point to point connection?

Miguel-Angel_RO — Tue, 29 Sep 2020 02:16:52 GMT

Stephen,

MACSEC is an option.

Have a look here:

https://gtacknowledge.extremenetworks.com/articles/Q_A/Is-MACSec-802-1AE-feature-supported-in-EXOS

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-configure-the-LRM-MACsec-adapter-on-a-capable-EXOS-switch-for-basic-secure-operation

To be checked:

OS version to be upgraded to 30.1 or higher
MACsec feature pack license is required
HW version to be checked

Mig

Re: Encrypt a point to point connection?

Stephen_Stormon — Tue, 29 Sep 2020 03:00:29 GMT

We also have a MPLS network connecting those two locations and two other sites. Could the same method be used to secure communications between all 4 sites? If so, would then create two connectivity associations with two different CAKs or do we need to use the same CAK for all associations?

Re: Encrypt a point to point connection?

Miguel-Angel_RO — Tue, 29 Sep 2020 03:07:02 GMT

Stephen,

Drawing a topology map would help to understand.

To be checked is the number of max MACSEC interfaces you can have on your specific switches

From my understanding one CAK per P2P link is needed.

Mig

Re: Encrypt a point to point connection?

Stephen_Stormon — Tue, 29 Sep 2020 03:33:20 GMT

Simplified topology map is below.

Re: Encrypt a point to point connection?

Miguel-Angel_RO — Tue, 29 Sep 2020 03:40:14 GMT

Stephen,

The P2P link between the x460 is ok for me but the MLPS link is not a P2P link.

For this kind of topology I recommend to request assistance of Extreme Professional Services.

I don’t know if you can encrypt the traffic between the nodes and still exchange the needed information with you ISP switches for the MPLS forwarding.

I’m not an expert on this matter. Not yet

Mig

Re: Encrypt a point to point connection?

Stefan_K_ — Tue, 29 Sep 2020 15:38:20 GMT

afaik, you can only use MACsec in this constellation if the MPLS-Provider supports and configures MACsec on the MPLS-Router and all devices that are used inside the MPLS-Network.