Use Media Access Control security (MACsec) to encrypt and authenticate LAN traffic at layer 2. This removes the need to encrypt individual services at layer 7.

MACsec secures point-to-point communication between devices. For example, you can configure MACsec on the two hosts connecting your branch and central offices over a Metro-Ethernet connection to increase security.

MACsec is a layer-2 protocol that encrypts and authenticates all LAN traffic. It uses a pre-shared key to establish connections. To change this key, you must update the NetworkManager configuration on all hosts that use MACsec.

MACsec secures different traffic types over the Ethernet links, including:

• Dynamic host configuration protocol (DHCP)
• address resolution protocol (ARP)
• IPv4 and IPv6 traffic
• Any traffic over IP such as TCP or UDP

A MACsec connection uses an Ethernet device, such as a network card, Virtual Local Area Network (VLAN), or tunnel device, as a parent. You can either set an IP configuration only on the MACsec device to communicate with other hosts only by using the encrypted connection, or you can also set an IP configuration on the parent device. In this case, you can use the parent device to communicate with other hosts by using an unencrypted connection and the MACsec device for encrypted connections.

MACsec does not require any special hardware. You can use any switch, except if you want to encrypt traffic only between a host and a switch. In this scenario, the switch must also support MACsec.

You can configure MACsec for two common scenarios:

• Host-to-host
• Host-to-switch and switch-to-other-hosts

MACsec provides these benefits:

• Reduces the workload of managing certificates for each endpoint on each host by encrypting at layer 2 instead of individual services at layer 7.
• Provides point-to-point security between directly connected network devices such as routers and switches.
• No changes needed for applications and higher-layer protocols.