Solution validation guide for MACsec as a Service August 2019, IOS XE 16.12.1 As enterprise business processes become increasingly digitized, new demands on the enterprise network architecture arise. This presents a need to secure the connection as it traverses geographically diverse insecure public or private network. The challenge lies in maintaining the performance and simplicity of a high-speed network whilst assuring the security and privacy of network traffic, whether voice, data or video.
The nature of this vertical demands for the most comprehensive network security solution, not only encrypt the user data traffic but encrypt any network communication between sites including network control traffic. WAN Media Access Control Security (MACsec) is the innovation from Cisco provides a formidable, line-rate encryption solution to secure WAN connections over Layer 2 Ethernet transport services. When compared to encryption at higher layers, Layer 2 encryption has a number of advantages: Lowest impact on network performance Reduced complexity (bump in the wire) Transparent to media (voice, data, video etc.) Little or no configuration Operates at wire speed up to 100Gbps.
No additional overhead (Layer 3 IPSec typically adds significant overhead – over 40% of available bandwidth for smaller packets) Ethernet virtual circuits (EVCs) define a Layer 2 bridging architecture that supports Ethernet services. An EVC is defined by the Metro-Ethernet Forum (MEF) as an association between two or more user network interfaces that identifies a point-to-point or multipoint-to-multipoint path within the service provider network. An EVC is a conceptual service pipe within the service provider network. Ethernet Virtual Circuits