I am currently working a project dealing with network security, and my question is that what is a feasible way to protect traffic on a switch-to-switch link in a LAN, not end-host-to-end-host encryption. I am only interested in a way to encrypt traffic between two network switches. I am aware that MACsec protocol and its variant Cisco TrustSec can be used for this purpose, but Macsec is used for host-to-switch encryption, and TrustSec is only supported by a few Cisco switch models. I need a more widely acceptable solution.

Apart from that what would really be great is that if the solution can be configured onto the switches using SNMP so that the whole process can be programmatically executed.

I would really appreciate some help finding such a solution.

  • 4
    Asking about "the best" is not really supported here because that leads to primarily opinion-based answers, which are off-topic. For example, I believe the best way to secure switch-to-switch communications is at the physical layer: locks on data closets, sealed conduit, etc. You can try to rephrase your question with help from What types of questions should I avoid asking?. – Ron Maupin Aug 7 '17 at 0:49
  • Okay i have changed "the best" to a more appropriate word. Now can you please help me with this. – Syed Emad Aug 7 '17 at 0:55
  • This is also going to depend completely on the switches that you have. Different switch models and vendors support different services, and securing connections between different switch models may not be compatible. For example, if you have unmanaged layer-2 switches, there is absolutely nothing you can do regarding this. You need to edit your question to detail which switches you are using. – Ron Maupin Aug 7 '17 at 1:02
  • I am most probably going to use a cisco managed switch and I am leaning towards using cisco Trustsec as it does what i want but the pending question is that is it possible to automate the process. can trustsec be configured using snmp – Syed Emad Aug 7 '17 at 1:08
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Sep 6 '17 at 14:34

As of today, your broad solution doesn't exist.

In general, switches are transparent devices. Any current solution is going to be vendor-specific, assuming a switch is even configurable (not all are).

I fear you are going to be disappointing in your search. Even if 802.1AE was extended to switch-to-switch connections tomorrow, none of the existing switches will use it until (and if) the vendor updates the code, and you install the updated code.

You are going to need to do this in a patchwork. As you have discovered, Cisco has a solution, but it only works with some switches, running the correct code. You will find the same situation with other vendors, and it is unlikely that these solutions inter-operate.

Edit for your comment:

There are many solutions for automating Cisco network device configurations. Perform a search for NMS (Network Management System). Unfortunately, product or resource recommendations are explicitly off-topic here, as they are on most SE sites, except Software Recommendations and Hardware Recommendations.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.