Cisco IOS XE 16.12.1: MACsec as a Service Validation Guide PDF (EN)

Solution validation guide for MACsec as a Service August 2019, IOS XE 16.12.1 As enterprise business processes become increasingly digitized, new demands on the enterprise network architecture arise. This presents a need to secure the connection as it traverses geographically diverse insecure public or private network. The challenge lies in maintaining the performance and simplicity of a high-speed network whilst assuring the security and privacy of network traffic, whether voice, data or video.

The nature of this vertical demands for the most comprehensive network security solution, not only encrypt the user data traffic but encrypt any network communication between sites including network control traffic. WAN Media Access Control Security (MACsec) is the innovation from Cisco provides a formidable, line-rate encryption solution to secure WAN connections over Layer 2 Ethernet transport services. When compared to encryption at higher layers, Layer 2 encryption has a number of advantages: Lowest impact on network performance Reduced complexity (bump in the wire) Transparent to media (voice, data, video etc.) Little or no configuration Operates at wire speed up to 100Gbps.

No additional overhead (Layer 3 IPSec typically adds significant overhead – over 40% of available bandwidth for smaller packets) Ethernet virtual circuits (EVCs) define a Layer 2 bridging architecture that supports Ethernet services. An EVC is defined by the Metro-Ethernet Forum (MEF) as an association between two or more user network interfaces that identifies a point-to-point or multipoint-to-multipoint path within the service provider network. An EVC is a conceptual service pipe within the service provider network. Ethernet Virtual Circuits

Стр. 1

(EVCs) allow us to leverage existing 802.1q VLAN tags in a brand new way. Traditionally the VLAN tag defined both classification (which VLAN) and forwarding (which CAM table to do a MAC lookup in). Now, with EVCs we can separate these concepts; the VLAN tag is used for classification and the Service Instance defines the forwarding action. This solution combines the two technologies to permit forwarding across the network Author: Afroz Dalal - Customer delivery Engineer, Hitesh Maisheri - Development Engineer Reviewers: Jason Yang - Technical Marketing Engineer

Стр. 2

Table of Contents 1 SOLUTION OVERVIEW ............................................................................................. 4 2 EOMPLS DEPLOYMENT ........................................................................................... 4 2.1 CONFIGURATIONS ................................................................................................................ 11 2.1.1 Configuration of CE1 ............................................................................................................................... 11 2.1.2 Configuration of CE2 ...............................................................................................................................

12 2.1.3 Configuration of PE1 ............................................................................................................................... 14 2.1.4 Configuration of PE2 ............................................................................................................................... 15 2.2 Verifications ........................................................................................................................ 16 2.2.1 EFP Commands .......................................................................................................................................

23 3 L2TPV3 DEPLOYMENT ........................................................................................... 25 3.1 CONFIGURATIONS ................................................................................................................ 25 3.1.1 Configuration of PE1 ............................................................................................................................... 25 3.1.2 Configuration of PE2 ...............................................................................................................................

26 3.2 Verifications ........................................................................................................................ 27 4 VPLS DEPLOYMENT ............................................................................................... 31 4.1 CONFIGURATIONS ................................................................................................................ 31 4.1.1 Configuration of PE1 ...............................................................................................................................

31 4.1.2 Configuration of PE2 ............................................................................................................................... 33 4.2 Verifications ........................................................................................................................ 35 5 Clear/Debug commands ......................................................................................... 36 MKA sessions on an EFP instance: ............................................................................................ 36 6 PERFORMANCE ......................................................................................................

37 6.1 With MACSEC ...................................................................................................................... 38 6.2 Without MACSEC ................................................................................................................. 38

Стр. 3

2. EOMPLS DEPLOYMENT

1. SOLUTION OVERVIEW EVC uses following main concepts: Ethernet Virtual Circuit (EVC) Ethernet Service Instance, also known as Ethernet Flow Point (EFP) Bridge Domain (BD) For the rest of the document, the term “EVC” refers to Cisco EVC. There have been demands from customers to secure this l2 circuit between the two customer edge devices Macsec provides the solution by providing a secured l2 circuit and enhancing the customer security across the network This is a solution validation guide based on the requirements from customers in Public and private sectors, and normalized as the common solution profile:

- MPLS based core - xconnect between the provider edge (PE) devices ie eompls ,l2tpv3,gre etc - MACSec (preshared key) between the links between the customer edge (CE) devices The solution is built on the following platforms: - CE are mainly ASR1001-X and ASR1009-x (RP2/ESP200/18x1GE EPA) - PE are ASR1001-HX and ASR1001-X - the customers may deploy other ASR 1000 product family and modules which are capable for supporting MACSec as well such as ASR1001-HX ASR1002-HX, EPA-10x10,EPA-2x40,EPA- 1x100 - L2 Encryption between in CEs using MACsec with cipher suite gcm-aes-256 2. EOMPLS DEPLOYMENT The following topology depicts the test bed used to test the requirement

Стр. 4