r/networking • u/Famous_Artist8113 • 22d ago

Design Macsec passtrough

Hi

I have situation where macsec is configured beetwen two huwaei ce device
Now we want to add nexus nxos in beetwen

Does nxos transparentlty forward macsec frame or like ios it depends on ios version

Also what version os nxos is suitable ?

9 Upvotes

92% Upvoted

4 comments sorted by

6

u/Ascension_84 22d ago

Macsec is typically hop-by-hop. I don’t think nexus supports some kind of pass through.

3

u/x_radeon CCNP 22d ago

It probably would pass it through as long as the macsec devices are configured with a specific mac address for the destination. By default macsec uses the link local multicast address for it's destination mac, which means the very next physical hop is the device that should ingest the frame. So unless you're configuring something like psudeowire or are using OTN gear that will always ignore this stuff, your device will probably pick up the frame instead of passing it along.

2

u/feumum 22d ago

It depens. On cisco gear you sometimes can change the multicast mac used for key exchange so it passes through. Not sure if there is something similar on huawei

1

u/kaity-quq 18d ago

Macsec is on layer 2. IPsec looks more fit to this scenario if the ce device not support L2 passthrough or tunneling.