topic RE: MACsec? in ExtremeSwitching (Other)

MACsec?

Christoph — Mon, 24 Feb 2014 21:36:00 GMT

Hello,

are there any plans to implement IEEE 802.1AE on Enterasys / Extreme switches and APs in future?
I think especially for inter switch links it would be a great security benefit.

Kind regards
Christoph

RE: MACsec?

Paul_Russo — Mon, 24 Feb 2014 22:50:00 GMT

Hello Christoph

As of right now 802.1AE is not supported on any of the equipment. The S series switches are capable of supporting 802.1AE but it has not been added to the SW as of yet. I believe the other half of MACsec (802.1X-2010) is still under development

If that changes we will let you know

Thanks
P

RE: MACsec?

JohanHendrikx — Mon, 24 Feb 2014 22:50:00 GMT

Paul, are there any changes about 802.1AE on Extreme devices?

RE: MACsec?

Tamera_Rousseau — Tue, 25 Feb 2014 22:54:00 GMT

I will go ahead and change this to an idea so we can track with product management. thank you Christoph!

RE: MACsec?

MartinS1 — Fri, 02 Oct 2015 11:03:00 GMT

Hi there,

Seems like MACsec is now implemented in S- and 71- Series, since FW Version 8.41.

Does anyone have some experience already?

Thanks,
Martin

RE: MACsec?

Mike_D — Tue, 06 Oct 2015 21:41:00 GMT

Hello Martin,

nothing by way of operational network experience to offer but I'll kick in some trivia to give the thread a fresh timestamp. I expect this will be a popular topic before long. As new features go, this one is pretty cool.

* hardware required: 7100-Series or S-Series s180-class
* MACsec implementation is standards based - 8.02.1ae-2006 and 802.1x-1020
* limited testing verifies interop with Juniper MACsec
* MACsec licenses are applied per module.
eval license available here:
https://extranet.extremenetworks.com/mysupport/licensing/Pages/default.aspx
extranet account required - immediate request/license turnaround
* MACsec can be supported on every port in an S-Series chassis.
* current implementation is switch to switch.
* easily implemented - the example minimum config below can be mirrored on both sides
1) set macsec port mka enable tg.1.1
2) set macsec pre-shared-key port tg.1.1 ckn foo cak passphrase bar

* MACsec is supported on 1Gb/s and 10Gb/s ports and will run on fiber, copper, DAC etc.
* 40Gb/s when run in 10G/s mode only. No virtual port support, physical ports only

Regards,
Mike

RE: MACsec?

MartinS1 — Tue, 06 Oct 2015 21:41:00 GMT

Hi Michael,

thanks for your reply!

We've now tested Macsec with two new SSA-180... Works really good so far!

Unfortunately it's not working if we change the 10G SFPs with 1G SFPs.
Can you confirm this?

Would have been great for some cases where we just have a 1G-EtherConnect between to sites.

Regards,
Martin

RE: MACsec?

Stephane_Grosj1 — Tue, 06 Oct 2015 21:41:00 GMT

Hi,

Can you please detail what's happening when changing to a 1G SFP instead of a 10G SFP. Afaik, 1G is supported.

RE: MACsec?

MartinS1 — Tue, 06 Oct 2015 21:41:00 GMT

Hi Stephane,

we first set up the 10G MACSec with the commands from above.
after this we:
- disabled Port (in our case tg.1.2 on both SSAs)
- replaced 10G-SFP+ with 1G-SFP
- enabled Ports tg.1.2

Port ist administratively "up" but remains operational "down" 😞

After this we:
- disabled MACSec on Ports tg.1.2
-> Ports got operationally "up"
- enabled MACSec
-> Ports got operationally "down"

That's all!

Did we anything wrong?... or at least something right!?

Regards,
Martin

RE: MACsec?

Eisi1 — Tue, 06 Oct 2015 21:41:00 GMT

Hi Michael,

I want to test MACSec with a eval license, but when I follow the link you provided there is no option for MACSec eval license. How can I get one?

Regards,

Uwe

RE: MACsec?

MartinS1 — Thu, 29 Oct 2015 17:39:00 GMT

Hi there,

according to a GTAC Service Request I initiated there is no support for 1G SFPs on 10G-Ports running MACSec on a S180 SSA (SSA-G8018-0652).

Nevertheless we successfully configured MACSec on two SSA-180 between the ports tg.1.2 with a 1G SFP!!!! 😄
Now with the latest firmware 8.42.

Regards,
Martin