MACsec (IEEE 802.1ae) adds a security tag to an Ethernet frame and encrypts the IEEE 802.1Q field, the EtherType and the payload field.

If you want to use VLAN, you need the 802.1Q field to announce the VLAN ID. The EtherType is usually set to 0x8100.

However, both MACsec and VLAN use an unique EtherType. As far as I undertand, the security tag introduced by MACsec uses an own EtherType. Is it possible to use MACsec and VLAN in parallel?

up vote 6 down vote accepted

Welcome to Network Engineering! There is no standard for MACSec and 802.1Q, so manufacturers have come up with their own solutions. Cisco calls it "WAN MACSec," and does it this way:

The WAN MACsec offering is standards based but offers additional capabilities not found in earlier MACsec capabilities. More specifically, MACsec can be leveraged by enterprise customers over public carrier Ethernet offerings, allowing customers to adapt to the public carrier Ethernet service offering and capabilities (or restrictions).

New enhancements for WAN MACsec include:

  1. 802.1Q Tag in the Clear

  2. Standard IEEE 802.1X-rev MACsec Key Agreement

  3. Integrated MACsec authentication adaptability over public Carrier Ethernet transport

  4. 802.1Q Tag in the Clear

This enhancement offers the ability to expose the 802.1Q tag outside the encrypted MACsec header. Exposing this field offers a multitude of design options with MACsec, and in some cases of public Carrier Ethernet transport providers, is necessary for leveraging certain transport services (see use case section).

https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/white-paper-c11-737544.html

  • In other words, the IEEE 802.1Q must not be encrypted to support VLANs? MACsec creates secure channels which may be interpreted as a virtual network, because frames are assigned to SCI. To simulate two VLANs, you could just use two different SCI!? Is this assumption correct? – null Nov 14 at 15:56

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.