1. SOLUTION OVERVIEW EVC uses following main concepts: Ethernet Virtual Circuit (EVC) Ethernet Service Instance, also known as Ethernet Flow Point (EFP) Bridge Domain (BD) For the rest of the document, the term “EVC” refers to Cisco EVC. There have been demands from customers to secure this l2 circuit between the two customer edge devices Macsec provides the solution by providing a secured l2 circuit and enhancing the customer security across the network This is a solution validation guide based on the requirements from customers in Public and private sectors, and normalized as the common solution profile:
- MPLS based core - xconnect between the provider edge (PE) devices ie eompls ,l2tpv3,gre etc - MACSec (preshared key) between the links between the customer edge (CE) devices The solution is built on the following platforms: - CE are mainly ASR1001-X and ASR1009-x (RP2/ESP200/18x1GE EPA) - PE are ASR1001-HX and ASR1001-X - the customers may deploy other ASR 1000 product family and modules which are capable for supporting MACSec as well such as ASR1001-HX ASR1002-HX, EPA-10x10,EPA-2x40,EPA- 1x100 - L2 Encryption between in CEs using MACsec with cipher suite gcm-aes-256 2. EOMPLS DEPLOYMENT The following topology depicts the test bed used to test the requirement