My company has its branch sites connected to HQ using Ubiquiti airFiber24 HD.
The company wants to acquire a leased line fiber connection to branch sites.
We want to run our own encryption on top of provider's connection to ensure confidentiality. The requirement is that we need to have our layer 2 traffic e.g. VLANs and DHCP traffic also pass through to the branch site.
The provider has underlay (MP-BGP with MPLS on top of it) and the overlay network (OSPF, IS-IS, and BGP).
What type of encryption can we run on top of providers network for such requirement? Is MACSec a viable solution?