Encrypt a point to point connection?

[Stephen_Stormon]

We have a point to point connection running between two x460 switches running 16.2.5.4-patch1-12.  We are going through a FISMA readiness audit and are being told that we need to encrypt that P2P connection between those devices.  Is that possible natively or do we need to purchase different equipment and/or newer version of XOS or do we need a 3rd party solution to make that happen?

[Stefan_K_]

afaik, you can only use MACsec in this constellation if the MPLS-Provider supports and configures MACsec on the MPLS-Router and all devices that are used inside the MPLS-Network.

[Miguel-Angel_RO]

Stephen,

The P2P link between the x460 is ok for me but the MLPS link is not a P2P link.

For this kind of topology I recommend to request assistance of Extreme Professional Services.

I don’t know if you can encrypt the traffic between the nodes and still exchange the needed information with you ISP switches for the MPLS forwarding.

I’m not an expert on this matter. Not yet 

Mig

[Stephen_Stormon]

Simplified topology map is below.

[Miguel-Angel_RO]

Stephen,

Drawing a topology map would help to understand.

To be checked is the number of max MACSEC interfaces you can have on your specific switches

From my understanding one CAK per P2P link is needed.

Mig