Chapter 12. Using MACsec to encrypt layer-2 traffic in the same physical network You can use MACsec to secure the communication between two devices (point-to-point). For example, your branch office is connected over a Metro-Ethernet connection with the central office, you can configure MACsec on the two hosts that connect the offices to increase the security. 12.1. How MACsec increases security Media Access Control security (MACsec) is a layer-2 protocol that secures different traffic types over the Ethernet links, including: Dynamic host configuration protocol (DHCP) address resolution protocol (ARP) IPv4 and IPv6 traffic Any traffic over IP such as TCP or UDP MACsec encrypts and authenticates all traffic in LANs, by default with the GCM-AES-128 algorithm, and uses a pre-shared key to establish the connection between the participant hosts. To change the pre-shared key, you must update the NM configuration on all network hosts that use MACsec. A MACsec connection uses an Ethernet device, such as an Ethernet network card, VLAN, or tunnel device, as a parent. You can either set an IP configuration only on the MACsec device to communicate with other hosts only by using the encrypted connection, or you can also set an IP configuration on the parent device. In the latter case, you can use the parent device to communicate with other hosts using an unencrypted connection and the MACsec device for encrypted connections. MACsec does not require any special hardware. For example, you can use any switch, except if you want to encrypt traffic only between a host and a switch. In this scenario, the switch must also support MACsec. In other words, you can configure MACsec for two common scenarios: Host-to-host Host-to-switch and switch-to-other-hosts Important You can use MACsec only between hosts being in the same physical or virtual LAN. Additional resources MACsec: a different solution to encrypt network traffic 12.2. Configuring a MACsec connection by using nmcli You can use the nmcli utility to configure Ethernet interfaces to use MACsec. For example, you can create a MACsec connection between two hosts that are connected over Ethernet. Procedure On the first host on which you configure MACsec: Create the connectivity association key (CAK) and connectivity-association key name (CKN) for the pre-shared key: Create a 16-byte hexadecimal CAK: Create a 32-byte hexadecimal CKN: On both hosts you want to connect over a MACsec connection: Create the MACsec connection: Use the CAK and CKN generated in the step in the macsec.mka-cak and macsec.mka-ckn parameters. The values must be the same on every host in the MACsec-protected network. Configure the IP settings on the MACsec connection. Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, and DNS server to the macsec0 connection, enter: Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, and DNS server to the macsec0 connection, enter: Activate the connection: Verification Verify that the traffic is encrypted: Optional: Display the unencrypted traffic: Display MACsec statistics: Display individual counters for each type of protection: integrity-only (encrypt off) and encryption (encrypt on) Additional resources MACsec: a different solution to encrypt network traffic

Commands:
dd if=/dev/urandom count=16 bs=1 2> /dev/null | hexdump -e '1/2 "%04x"' 50b71a8ef0bd5751ea76de6d6c98c03a
dd if=/dev/urandom count=32 bs=1 2> /dev/null | hexdump -e '1/2 "%04x"' f2b4297d39da7330910a74abc0449feb45b5c0b9fc23df1430e1898fcf1c4550
nmcli connection add type macsec con-name macsec0 ifname macsec0 connection.autoconnect yes macsec.parent enp1s0 macsec.mode psk macsec.mka-cak 50b71a8ef0bd5751ea76de6d6c98c03a macsec.mka-ckn f2b4297d39da7330910a74abc0449feb45b5c0b9fc23df1430e1898fcf1c4550
nmcli connection modify macsec0 ipv4.method manual ipv4.addresses '192.0.2.1/24' ipv4.gateway '192.0.2.254' ipv4.dns '192.0.2.253'
nmcli connection modify macsec0 ipv6.method manual ipv6.addresses '2001:db8:1::1/32' ipv6.gateway '2001:db8:1::fffe' ipv6.dns '2001:db8:1::fffd'
nmcli connection up macsec0
tcpdump -nn -i enp1s0
tcpdump -nn -i macsec0
ip macsec show
ip -s macsec show