For a corporate network, is there a way to possibly encrypt all network traffic on the local network?

I would like to ensure that there is nothing left for chance to be packet sniffed. Not even e-mails or machine to machine communications with chat devices.

  • 1
    This is all end-station behavior, it's off-topic here and is better-suited for the IT Security site
    – This
    Jul 11 '13 at 18:52
  • 1
    ...or is that actually the answer; "No, there's currently no hardware/technology that will encrypt starting at the switch ports. You have to do that at the workstations/software level." Jul 11 '13 at 19:05
  • 1
    I concur with @MikePennington. To further this though, I'm not sure this is wholly possible. You'd have to create a secure connection to every server/service if you don't want any packets sniffed (though they will still be sniffed, as sniffing a packet is just seeing the packet on the wire, not necessarily the data)
    – emynd
    Jul 11 '13 at 20:36
  • Question is too broad. Perhaps an encrypted GRE tunnel is what the OP seeks that doesn't involve the end-stations. I'm downvoting the question for now. Jul 12 '13 at 5:15
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Jan 5 at 23:27

Some vendors support IEEE 802.1ae/MACsec for encryption layer two between the access switch and its endpoints. I'm afraid I can't be any more help as I have no experience with it (and frankly it sounds like a nightmare to administer).

  • 5
    I would like to ensure that there is nothing left for chance to be packet sniffed. Not even e-mails or machine to machine communications with chat devices.... macsec is a single-hop protocol, which means each switchport encrypts / decrypts the traffic as it is forwarded through the switch... I have never run macsec, but I can only imagine that this leaves it vulnerable to sniffing by the people who own the infrastructure... it also means he has to share CA trust with those same folks... even if he has his own NIC, I'm not sure macsec helps
    – This
    Jul 11 '13 at 20:26

There's definitely not a single way to provide end-to-end encryption as you've asked, but packet sniffing as you wish to protect against can really only performed at few places in a typical corporate environment. 1 - physical network taps between devices 2 - span/monitor ports on devices 3 - attacks that force traffic to go where it is not intended.

For #1 - as @Jeremy Stretch mentioned IEEE 802.1ae/MACsec can be used hop-by-hop between devices, so a tap will only see encrypted data. While the data is "clear" within the switches (See #2), this is often needed to apply the desired QoS, security and other controls before forwarding to the next hop. However, it's fairly new and requires compatible endpoints and switches.

For #2 - Your physical and network security policy should limit access to the network devices to prevent an attacker from gaining access. Using a VPN client on each desktop and concentrators near the servers can provide another level of protection from third parties in the middle. Port-forwarding/tunneling over SSH between endpoints is another option, as well as IPSec everywhere like @fredpbaker mentioned gets you a bit closer but it's tough to implement.

For #3 - most enterprise network devices have tools to mitigate MITM/ARP attacks, rouge DHCP servers, spanning tree attacks and others meant to redirect traffic to where an attacker can listen in.

In the end you can use one, or all of these techniques to better protect data in-flight. Only a combination of these and a robust security policy to protect data-at-rest, the endpoints, physical security, and lots of time and money can really meet the goal you outlined!


If you are a full on windows shop you can run IPSEC between almost all the computers, this is done in group policy, but the planning is complex because you cant encrypt util you have logged on (DHCP cannot be encrypted). Not for the faint of heart and no one really is all Microsoft.


According to Cisco at CLUS13, this can be done with OnePK.

You'd offload all traffic to an encryption device (of your own design or some 3rd party), and then have your encryption device send everything back to your device and process traffic as normal.

There wasn't much elaboration on this, but it's probably happening only with L3 traffic and is probably a lot more trouble than it's worth unless you've got some very obscure security requirements.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.