8

MACsec (IEEE 802.1ae) adds a security tag to an Ethernet frame and encrypts the IEEE 802.1Q field, the EtherType and the payload field.

If you want to use VLAN, you need the 802.1Q field to announce the VLAN ID. The EtherType is usually set to 0x8100.

However, both MACsec and VLAN use an unique EtherType. As far as I undertand, the security tag introduced by MACsec uses an own EtherType. Is it possible to use MACsec and VLAN in parallel?

Improve this question

1 Answer 1

Reset to default
7

Welcome to Network Engineering! There is no standard for MACSec and 802.1Q, so manufacturers have come up with their own solutions. Cisco calls it "WAN MACSec," and does it this way:

The WAN MACsec offering is standards based but offers additional capabilities not found in earlier MACsec capabilities. More specifically, MACsec can be leveraged by enterprise customers over public carrier Ethernet offerings, allowing customers to adapt to the public carrier Ethernet service offering and capabilities (or restrictions).

New enhancements for WAN MACsec include:

  1. 802.1Q Tag in the Clear

  2. Standard IEEE 802.1X-rev MACsec Key Agreement

  3. Integrated MACsec authentication adaptability over public Carrier Ethernet transport

  4. 802.1Q Tag in the Clear

This enhancement offers the ability to expose the 802.1Q tag outside the encrypted MACsec header. Exposing this field offers a multitude of design options with MACsec, and in some cases of public Carrier Ethernet transport providers, is necessary for leveraging certain transport services (see use case section).

https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/white-paper-c11-737544.html

Improve this answer
2
  • In other words, the IEEE 802.1Q must not be encrypted to support VLANs? MACsec creates secure channels which may be interpreted as a virtual network, because frames are assigned to SCI. To simulate two VLANs, you could just use two different SCI!? Is this assumption correct?
    – null
    Nov 14, 2018 at 15:56
  • I was wondering, would you still be able to use another tag within the encrypted payload (as with standard macsec) when using "WAN Macsec"? Or is it Has "WAN Macsec" seen any standardization meaning other vendors might support it?
    – Marki
    Oct 25, 2020 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.