3

In general, Ethernet supports both multicast and broadcast. However, once you start encrypting the payload, you need a key management. I am wondering if IEEE 802.1AE supports multicast and broadcast? In that case how does MACsec handle the key management?

This webpage states that "MACsec provides point-to-point security". Does this mean only unicast is supported?

Improve this question

1 Answer 1

Reset to default
6

MACsec provides security on the point-to-point link level. MACsec and 802.1X sit (more or less) in between the physical layer (L1) and the data link layer (L2). The key management is between the layer-1 (point-to-point) link partners, usually a host and its uplink switch port, not between (possibly more distant) layer-2 nodes.

MACsec doesn't impact layer-2 functionality which broadcast & multicast are part of - these still work, of course.

Improve this answer
2
  • In other words, multicast and broadcast are still possible. Okay, each link is secured. If a switch receives a MACsec secured multicast Ethernet frame, does it replicate it for all node in the group? I suppose each node has its own link to the switch and therefore uses an individual key.
    – null
    Commented Nov 19, 2018 at 14:53
  • 2
    Yes. Multicast forwarding takes place regardless of port security. And yes, each link is individually encrypted between switch and host.
    – Zac67 ♦
    Commented Nov 19, 2018 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.