Media Access Control Security(MACsec IEEE 802.1AE) – static connectivity association key
This is continuation of the first post regarding MACsec configuration.
This new post will be about MACsec using static connectivity association key(CAK) security mode.
When this mode is used, two keys are used to secure the point-to-point Ethernet link:
– one connectivity association key is used to secure the control plane
– one secure association key which is randomly generated is used to secure the data plane
These two keys are exchanged by the two end points regularly.
When MACsec with CAK is enabled, a pre-shared key is exchanged between the two switches . This pre-shared key contains a CKN(connectivity key name) and a CAK(connectivity association key)/ These two are user configured values and must be identical on both sides of the Ethernet link.
If the pre-shared keys are verified and found identical, then MKA(MACsec Key Agreement) protocol is enabled. MKA will select one of the two switches are key server. This key server will create a randomized security key which will be shared with the other switch. The key server will create and share periodically a randomized key as long as MACsec is configured on the Ethernet link between the two switches.
Like in MACsec using SAK security mode, two secure channels will be configured. But they are automatically configured and the user doesn’t have to configure any of their parameters. By default, encryption is enabled.
This is my topology for configuring MACsec using CAK security mode:
This is the minimum configuration along with few optional features:
{master:0}[edit]
lab@EX4550-1# show security
macsec {
connectivity-association CA_1 {
security-mode static-cak;
mka {
transmit-interval 10000;
key-server-priority 10;
}
pre-shared-key {
ckn 1e1e1e1e2f2f2f2f;
cak "$9$jqq5QF39pO1ZU9ApuEhbsYg4Zik.f5FiH.5Tz6/Ap0OhSleW"; ## SECRET-DATA
}
exclude-protocol lldp;
}
interfaces {
xe-0/0/24 {
connectivity-association CA_1;
}
}
}
{master:0}[edit]
lab@EX4550-1#
Let’s discuss each command:
{master:0}[edit] lab@EX4550-1# show security | display set set security macsec connectivity-association CA_1 security-mode static-cak
– This is defining a connectivity association and CAK as security mode.
set security macsec connectivity-association CA_1 mka transmit-interval 10000
– This is the interval at which MKA PDUs are sent. The default is 2000ms.
set security macsec connectivity-association CA_1 mka key-server-priority 10
– Specifies the key server priority. The lower numerically value has a better priority. The default value is 16.
set security macsec connectivity-association CA_1 pre-shared-key ckn 1e1e1e1e2f2f2f2f
– Specifies the connectivity association key name. This is shown in clear text in the configuration. This has to match with what is configured on the other end. The maximum size of the key is 64 digits.
set security macsec connectivity-association CA_1 pre-shared-key cak "$9$jqq5QF39pO1ZU9ApuEhbsYg4Zik.f5FiH.5Tz6/Ap0OhSleW"
– Specifies the connectivity association key and the value is encrypted when the configuration is displayed. This has to match with what is configured on the other end. The maximum size of the key is 32 digits.
set security macsec connectivity-association CA_1 exclude-protocol lldp
– LLDP traffic is excluded from being secured with MACsec. This is optional.
set security macsec interfaces xe-0/0/24 connectivity-association CA_1
– The connectivity association is linked to the interface.
There are another two optional features that you could use:
– offset – the parameter can take three values: 0, 30, 50. This specifies what part of the packet will be encrypted. By default, the value is 0, which means all packet is encrypted. If you configure a value of 30, then the IPv4 header and TCP/UDP header are unecrypted, while the rest of the packet it is. If 50 is used, then the IPv6 header and TCP/UDP header are unecrypted, while the rest of the packet it is. You might need to leave the first 30 to 50 octets as unencrypted, when you need to do load balancing.
– replay-protect – every packet sent over a MACsec enabled link, has an ID. If you enable replay protection, then each ID of the packets is checked. Based on the replay window size, you can specify what could be the maximum ID of the next packet. For instance, if you received ID 100 and configured a window size of 10, then the maximum ID that you can receive in the next packet, cannot exceed 110. Otherwise it is dropped.
– include-sci – this is to be used only when one side of the MACsec secured link is EX4300.
After the proper configuration was put on both EXs, I sent 5 ICMP packets from EX4550-1 to EX4550-2:
{master:0}[edit]
lab@EX4550-1# run ping 1.1.1.2 count 5
PING 1.1.1.2 (1.1.1.2): 56 data bytes
64 bytes from 1.1.1.2: icmp_seq=0 ttl=64 time=1.817 ms
64 bytes from 1.1.1.2: icmp_seq=1 ttl=64 time=1.371 ms
64 bytes from 1.1.1.2: icmp_seq=2 ttl=64 time=1.483 ms
64 bytes from 1.1.1.2: icmp_seq=3 ttl=64 time=1.374 ms
64 bytes from 1.1.1.2: icmp_seq=4 ttl=64 time=1.400 ms
--- 1.1.1.2 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.371/1.489/1.817/0.169 ms
{master:0}[edit]
lab@EX4550-1#
‘show security macsec statistics’ command is showing that only 5 packets were secured, transmitted and accepted:
{master:0}[edit]
lab@EX4550-1# run show security macsec statistics
Interface name: xe-0/0/24
Secure Channel transmitted
Encrypted packets: 5
Encrypted bytes: 430
Protected packets: 0
Protected bytes: 0
Secure Association transmitted
Encrypted packets: 5
Protected packets: 0
Secure Channel received
Accepted packets: 5
Validated bytes: 0
Decrypted bytes: 430
Secure Association received
Accepted packets: 5
Validated bytes: 0
Decrypted bytes: 430
{master:0}[edit]
lab@EX4550-1#
Also, ‘show interfaces extensive’ is showing the same thing:
{master:0}[edit]
lab@EX4550-1# run show interfaces xe-0/0/24 extensive | no-more
Physical interface: xe-0/0/24, Enabled, Physical link is Up
---cut here---
MACSec statistics:
Output
Secure Channel Transmitted
Protected Packets : 0
Encrypted Packets : 5
Protected Bytes : 0
Encrypted Bytes : 430
Input
Secure Channel Received
Accepted Packets : 5
Validated Bytes : 0
Decrypted Bytes : 430
---cut here---
As mentioned before, the secure channels(for both incoming/outgoing) are automatically created.
As you can see, there is no offset configured, no replay protect and the encryption is on.
The secure channels are in use and both have a lifetime so far of 20 seconds.
{master:0}[edit]
lab@EX4550-1# run show security macsec connections
Interface name: xe-0/0/24
CA name: CA_1
Cipher suite: GCM-AES-128 Encryption: on
Key server offset: 0 Include SCI: no
Replay protect: off Replay window: 0
Outbound secure channels
SC Id: 54:E0:32:86:F8:DB/1
Outgoing packet number: 6
Secure associations
AN: 0 Status: inuse Create time: 00:00:20
Inbound secure channels
SC Id: 54:E0:32:87:13:1B/1
Secure associations
AN: 0 Status: inuse Create time: 00:00:20
{master:0}[edit]
lab@EX4550-1#
Let’s check the MKA parameters:
{master:0}[edit]
lab@EX4550-1# run show security mka sessions
Interface name: xe-0/0/24
Member identifier: 1CC2F2CF9CEC0978BB75B467
CAK name: 1E1E1E1E2F2F2F2F
Transmit interval: 10000(ms)
Outbound SCI: 54:E0:32:86:F8:DB/1
Message number: 5 Key number: 1
Key server: yes Key server priority: 10
Latest SAK AN: 0 Latest SAK KI: 1CC2F2CF9CEC0978BB75B467/1
Previous SAK AN: 0 Previous SAK KI: 000000000000000000000000/0
Peer list
1. Member identifier: 3874720D3ED55FF1A0319F73 (live)
Message number: 6 Hold time: 76500 (ms)
SCI: 54:E0:32:87:13:1B/1
Lowest acceptable PN: 5
{master:0}[edit]
lab@EX4550-1#
EX4550-1 is the key server with the priority of 10. The CKN is 1E1E1E1E2F2F2F2F and the transmit interval is 10000 ms.
The peer is identified by SCI(which is the MAC) of 54:E0:32:87:13:1B.
‘show security mka statistics’ command is providing information about MKA packets/errors. So far there were only 4 packets sent and received:
{master:0}[edit]
lab@EX4550-1# run show security mka statistics
Interface name: xe-0/0/24
Received packets: 4
Transmitted packets: 4
Version mismatch packets: 0
CAK mismatch packets: 0
ICV mismatch packets: 0
Duplicate message identifier packets: 0
Duplicate message number packets: 0
Duplicate address packets: 0
Invalid destination address packets: 0
Formatting error packets: 0
Old Replayed message number packets: 0
{master:0}[edit]
lab@EX4550-1#
Because LLDP is excepted from MACsec, these packets are not showing in ‘show security macsec statistics’. Only the previously 5 ICMP packets:
{master:0}[edit]
lab@EX4550-1# run show lldp statistics
Interface Parent Interface Received Unknown TLVs With Errors Discarded TLVs Transmitted Untransmitted
xe-0/0/24.0 - 7 0 0 0 8 0
{master:0}[edit]
lab@EX4550-1# run show security macsec statistics
Interface name: xe-0/0/24
Secure Channel transmitted
Encrypted packets: 5
Encrypted bytes: 430
Protected packets: 0
Protected bytes: 0
Secure Association transmitted
Encrypted packets: 5
Protected packets: 0
Secure Channel received
Accepted packets: 5
Validated bytes: 0
Decrypted bytes: 430
Secure Association received
Accepted packets: 5
Validated bytes: 0
Decrypted bytes: 430
{master:0}[edit]
lab@EX4550-1#
Let’s delete the configuration part that exclude LLDP not being secured by MACsec and confirm that the MACsec counters are increasing whenever a LLDP packet is received or sent:
{master:0}[edit]
lab@EX4550-1# run show lldp statistics
Interface Parent Interface Received Unknown TLVs With Errors Discarded TLVs Transmitted Untransmitted
xe-0/0/24.0 - 4 0 0 0 5 0
{master:0}[edit]
lab@EX4550-1# run show security macsec statistics
Interface name: xe-0/0/24
Secure Channel transmitted
Encrypted packets: 5
Encrypted bytes: 1533
Protected packets: 0
Protected bytes: 0
Secure Association transmitted
Encrypted packets: 5
Protected packets: 0
Secure Channel received
Accepted packets: 4
Validated bytes: 0
Decrypted bytes: 1244
Secure Association received
Accepted packets: 4
Validated bytes: 0
Decrypted bytes: 1244
{master:0}[edit]
lab@EX4550-1#
There are few considerations when MACsec using CAK secure mode is used:
– make sure you configure the same CAK and CKN on both sides
– if you alter the MKA transmit interval, then do it on both sides
– if you exclude any protocol(LLDP, CDP or LACP), then do it on both sides in order to have that protocol working
Paris ARAU
Latest posts by Paris ARAU (see all)
- Junos Fusion – Part IV – Satellite policies and uplink failure detection - 30 July 2018
- Junos Fusion – Part III – Satellite commands and traffic forwarding - 16 July 2018
- Junos Fusion – Part II – Configuration, Administration and Operation - 16 July 2018
- Junos Fusion – Part I – Overview, Components, Ports and Software - 11 July 2018
- Vagrant – Part IV – Network topology using Juniper and Cumulus - 26 April 2018
Comments
So empty here ... leave a comment!