My company has its branch sites connected to HQ using Ubiquiti airFiber24 HD.

The company wants to acquire a leased line fiber connection to branch sites.

We want to run our own encryption on top of provider's connection to ensure confidentiality. The requirement is that we need to have our layer 2 traffic e.g. VLANs and DHCP traffic also pass through to the branch site.

The provider has underlay (MP-BGP with MPLS on top of it) and the overlay network (OSPF, IS-IS, and BGP).

What type of encryption can we run on top of providers network for such requirement? Is MACSec a viable solution?

  • 2
    "The requirement is that we need to have our layer 2 traffic e.g. VLANs and DHCP traffic also pass through to the branch site." While passing traffic like DHCP is no problem, there is no real reason to extend layer-2 across a WAN. You are extending all the layer-2 problems, and perhaps making convergence impossible. A broadcast storm could bring down your entire network. We live in a layer-3 world, and there is no real reason that things need to be on the same layer-2 LAN anymore. It is simply a bad idea.
    – Ron Maupin
    Commented Jul 24, 2021 at 14:14
  • It's a bit off-topic (linux), but here's a document from Redhat showing how to manually configure macsec between two hosts on a LAN. As pointed out below, note how macsec0's mtu is 1468 (1500-32) [ developers.redhat.com/blog/2016/10/14/… ] It's a bad way to get there, being totally manual, but it's a fair example.
    – Ricky
    Commented Jul 25, 2021 at 5:57
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Commented Dec 23, 2021 at 21:04

2 Answers 2


MACsec is an option if your vendor is supplying layer-2 transport and your switches support enough MACsec configuration flexibility to be compatible with your transport provider's network.

Normally, the provider's network would eat the PDUs necessary for MACsec key exchange. You can re-configure your devices to use a different destination address for the PDUs, allowing associations to form over the provider network, if your equipment supports it.

Juniper has a great tech library article on this: https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/topic-map/understanding_media_access_control_security_wan.html

  • MACsec was designed to be a link-layer mechanism. Getting that to work further than the end of the cable is an ugly hack. (and many things don't support macsec.) L3+ can be handled by any tunneling method. Getting that at L2 (for VLANs) will be tough. The .mil used to do that with hardware encryption devices. (they were universally despised, even by their maker.)
    – Ricky
    Commented Jul 25, 2021 at 1:39
  • 1
    cisco.com/c/dam/en/us/td/docs/solutions/Enterprise/Security/… For a Cisco take on it.
    – Ricky
    Commented Jul 25, 2021 at 1:56
  • Also important to consider... MACsec adds 32bytes to the frame. P-t-p it doesn't matter as both ends expect it. But across a network, that takes additional setup ("jumbo frames"), unless you intend to reduce the MTU of your entire network.
    – Ricky
    Commented Jul 25, 2021 at 2:04

I would try to get a Layer 2 connection directly from the provider and then run IPSec over it. If this isn't possible or not enough Layer 2 for you, I would try to use L2TP encapsulated in IPSec and then the MPLS based network from the provider.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.