Media Access Control Security(MACsec IEEE 802.1AE) – static secure association keys
Media Access Control Security (MACsec) is a security standard that allows secure communication on Ethernet links. The standard is called IEEE 802.1AE.
This is point-to-point security between directly connected devices.
MACsec can be enabled either by using static connectivity association key(CAK), either by using static secure association key(SAK).
This post is about the second method of configuring MACsec. The first method, which is more complex will be discussed in detail in a future post.
When MACsec using SAK security mode is enabled, then manually configured security keys are used to secure the point-to-point Ethernet tunnel between the two endpoints. The security key name and its value must be the same on both ends for MACsec to be enabled on the link.
Considering our topology, this is the configuration on EX4550-1:
{master:0}[edit]
lab@EX4550-1# show security
macsec {
connectivity-association CA_1 {
security-mode static-sak;
secure-channel SC_1 {
id {
mac-address 54:e0:32:87:13:1b;
port-id 1;
}
direction inbound;
security-association 0 {
key "$9$xPu7bsUjHkP5ji0BIEyrgoaUk.fTz3/CBIyeKMx7Vbsg4JGUiH.PjiBIcyKvGDjHfTn/CuBI3nSrKMx7ws2goZjiqPfQFn"; ## SECRET-DATA
}
security-association 1 {
key "$9$tTHt0BRrlvXx-wY4JGUkqtu0BSrX7-gaZbw5Qz39CvW8xVwYgojiqTz/A0OEhyrevMLX7-VYg-dfTFnCA8Xx7wYoJGjk.2g"; ## SECRET-DATA
}
}
secure-channel SC_2 {
id {
mac-address 54:e0:32:86:f8:db;
port-id 1;
}
direction outbound;
encryption;
security-association 0 {
key "$9$vR3MxNdbsgaZ-d.P5Qn6vW87wYUjHqfTz3/A0OEhlevWL7sY4oZU-dk.5T3nlKvWNdgoJkmfji1RhceKW8X-dw4oZHkmFn"; ## SECRET-DATA
}
security-association 1 {
key "$9$NjdVsg4JDjkfT6Cp0RENdVw4aGDi.fTUDtuBIcS4aJZk.n/CtpOIEyeKMx7ws2oJUDik.fTZG/CApB1dbw2ZUmfTQn/TQ"; ## SECRET-DATA
}
}
}
interfaces {
xe-0/0/24 {
connectivity-association CA_1;
}
}
}
{master:0}[edit]
lab@EX4550-1#
This is the configuration and what is the purpose of each command:
set security macsec connectivity-association CA_1 security-mode static-sak
– this is creating a connectivity association with static-sak as security mode.
set security macsec connectivity-association CA_1 secure-channel SC_1 id mac-address 54:e0:32:87:13:1b
– secure-channel SC_1 will be used for incoming traffic and MAC 54:e0:32:87:13:1b is on the other end of the link.
set security macsec connectivity-association CA_1 secure-channel SC_1 id port-id 1
– configure the port ID of the secure-channel. This has to match on both receiving and sending secure channel on each side of the link.
set security macsec connectivity-association CA_1 secure-channel SC_1 direction inbound
– configure the secure-channel SC_1 to apply MACsec on incoming traffic.
set security macsec connectivity-association CA_1 secure-channel SC_1 security-association 0 key 0987654321FEDCBA0987654321FEDCBA
set security macsec connectivity-association CA_1 secure-channel SC_1 security-association 1 key FEDCBA0987654321FEDCBA0987654321
– you have to configure at least two 32 hex number keys. They have to match on both sides of the link. Incoming from one side must match with the outgoing of the other side of the link.
set security macsec connectivity-association CA_1 secure-channel SC_2 id mac-address 54:e0:32:86:f8:db
– this is configuring the local MAC which will be used for the outbound secure-channel
set security macsec connectivity-association CA_1 secure-channel SC_2 id port-id 1
– configure the port ID of the secure-channel. This has to match on both receiving and sending secure channel on each side of the link.
set security macsec connectivity-association CA_1 secure-channel SC_2 direction outbound
– configure the secure-channel SC_2 to apply MACsec on outgoing traffic.
set security macsec connectivity-association CA_1 secure-channel SC_2 encryption
-configure the secure-channel SC_2 to encrypt the traffic. By default is not encrypted.
set security macsec connectivity-association CA_1 secure-channel SC_2 security-association 0 key 0123456789ABCDEF0123456789ABCDEF
set security macsec connectivity-association CA_1 secure-channel SC_2 security-association 1 key ABCDEF0123456789ABCDEF0123456789
– you have to configure at least two 32 hex number keys. They have to match on both sides of the link. Incoming from one side must match with the outgoing of the other side of the link.
set security macsec interfaces xe-0/0/24 connectivity-association CA_1
– apply the connectivity association to the interface where you want to enable MACsec.
To check if the traffic is protected by MACsec, we will initiate a ping from EX4550-2 towards EX4550-1.
There is already a preconfigured RVI on each of these two in vlan 1000.
Let’s send 5 ICMP packets from EX4550-2 to EX4550-1 and check the MACsec statistics on EX455-1:
{master:0}[edit]
lab@EX4550-2# run ping 1.1.1.1 count 5
PING 1.1.1.1 (1.1.1.1): 56 data bytes
64 bytes from 1.1.1.1: icmp_seq=0 ttl=64 time=2.240 ms
64 bytes from 1.1.1.1: icmp_seq=1 ttl=64 time=1.451 ms
64 bytes from 1.1.1.1: icmp_seq=2 ttl=64 time=1.480 ms
64 bytes from 1.1.1.1: icmp_seq=3 ttl=64 time=1.533 ms
64 bytes from 1.1.1.1: icmp_seq=4 ttl=64 time=3.927 ms
--- 1.1.1.1 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.451/2.126/3.927/0.947 ms
{master:0}[edit]
lab@EX4550-2#
{master:0}[edit]
lab@EX4550-1# run show interfaces xe-0/0/24 extensive | find MACSec
MACSec statistics:
Output
Secure Channel Transmitted
Protected Packets : 0
Encrypted Packets : 5
Protected Bytes : 0
Encrypted Bytes : 430
Input
Secure Channel Received
Accepted Packets : 5
Validated Bytes : 0
Decrypted Bytes : 430
As you can see, all 5 packets were sent through the MACsec connectivity association configured on xe-0/0/24.
A simple math is saying that a packet is 86B. This information will be useful later.
There are few limitations when using SAK:
– BPDUs are not encrypted
– pause frames are not encrypted
As a troubleshooting method, you have only the MACsec statistics from the interfaces.
In case that the keys are not matching on both ends, then the packets will be dropped.
You will see that the packets will be decrypted, but not accepted. Also, the packets will be treated as errors.
Look what happens when we send two packets and the keys are not matching anymore:
{master:0}[edit] lab@EX4550-2# run ping 1.1.1.1 count 2 PING 1.1.1.1 (1.1.1.1): 56 data bytes --- 1.1.1.1 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss {master:0}[edit] lab@EX4550-2#
{master:0}[edit] lab@EX4550-1# run show interfaces xe-0/0/24 extensive | no-more Physical interface: xe-0/0/24, Enabled, Physical link is Up ---cut here--- Input errors: Errors: 2, Drops: 0, Framing errors: 2, Runts: 0, Policed discards: 0, L3 incompletes: 0, L2 channel errors: 0, L2 mismatch timeouts: 0, FIFO errors: 0, Resource errors: 0 ---cut here--- MACSec statistics: Output Secure Channel Transmitted Protected Packets : 0 Encrypted Packets : 0 Protected Bytes : 0 Encrypted Bytes : 0 Input Secure Channel Received Accepted Packets : 0 Validated Bytes : 0 Decrypted Bytes : 172 ---cut here--- {master:0}[edit] lab@EX4550-1#
As you can see, we have two errors and the Decrypted Bytes counter is showing 172, which 2 times 86B.
There will be another post where I will show you how to configure MACsec using static connectivity association key(CAK).
Paris ARAU
Latest posts by Paris ARAU (see all)
- Junos Fusion – Part IV – Satellite policies and uplink failure detection - 30 July 2018
- Junos Fusion – Part III – Satellite commands and traffic forwarding - 16 July 2018
- Junos Fusion – Part II – Configuration, Administration and Operation - 16 July 2018
- Junos Fusion – Part I – Overview, Components, Ports and Software - 11 July 2018
- Vagrant – Part IV – Network topology using Juniper and Cumulus - 26 April 2018
[…] two older posts, Media Access Control Security(MACsec IEEE 802.1AE) – static secure association keys and Media Access Control Security(MACsec IEEE 802.1AE) – static connectivity association key we […]