I have some questions regarding MACsec IEEE 802.1 AE-2018 and PNAC IEEE 802.1X-2010.

As I have heard there is no swich-to-switch protection with 802.1X-2010 by this standard I want to know where is it mentioned in the standard. A pagenumber or some further explanation would be very helpful!

Is it possible according the standard to have swich-to-switch protection with preshared keys and MKA?


Possible? Yes - all you need is a switch that supports being in the MACsec client role. But likely, you won't find any.

Why is that so? MACsec is used to authenticate an otherwise untrusted client (node) and to encrypt its traffic. Switches are usually located in a locked space with their interlinks equally secured. There's very little need for MACsec here.

Also, authentication and encryption increase deployment cost (for configuration and troubleshooting) and overall latency which are both explicitly undesirable on interlinks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.