MPLS L3VPNs provide scalable, multi-tenant connectivity, but they lack native encryption. While IPsec is commonly used, MACsec (802.1AE) offers a high-performance alternative for securing MPLS L3VPN traffic at line rate (1G–100G+) without IPsec’s bottlenecks.
Here’s the standard approach to deploying MACsec over MPLS L3VPN:
1. Understand Where MACsec Fits in MPLS L3VPN
MPLS L3VPN operates at Layer 3, while MACsec works at Layer 2 (Ethernet). This means:
- MACsec encrypts Ethernet frames between devices (PE-PE or PE-CE links).
- MPLS labels remain intact since encryption happens below the MPLS layer.
Key Benefits of MACsec over MPLS L3VPN
✅ Line-rate encryption (no performance penalty at 100G+)
✅ No impact on MPLS labels (unlike IPsec, which requires MPLS-over-GRE)
✅ Simpler than IPsec (no tunnel configurations)
2. Deployment Models for MACsec in MPLS L3VPN
Option 1: MACsec on PE-CE Links (Recommended for Enterprise/SP Edge)
- Encrypts traffic between CE and PE routers (customer edge to provider edge).
- Best for:
- Securing customer backhaul over Carrier Ethernet (E-LINE/E-LAN).
- Preventing eavesdropping on last-mile connections.
Configuration Steps:
- Enable MACsec on PE and CE interfaces (e.g., 1G/10G Ethernet).
- Use MKA (MACsec Key Agreement) with:
- Pre-shared keys (PSK) for static setups.
- 802.1X/EAP for dynamic key management.
- Ensure VLAN tags (if used) are preserved (802.1Q-in-clear mode).
Option 2: MACsec on PE-PE Links (Core Encryption)
- Encrypts traffic between Provider Edge (PE) routers in the MPLS core.
- Best for:
- Securing inter-data-center links (DCI over MPLS).
- Preventing ISP backbone interception.
Configuration Steps:
- Enable MACsec on all PE-PE interfaces (e.g., 100G DWDM links).
- Use AES-GCM-256 for high-security compliance.
- Ensure MPLS labels are unaffected (MACsec encrypts only at Layer 2).
3. Key Considerations for MACsec over MPLS L3VPN
A. MPLS Label Handling
- MACsec does not touch MPLS labels (encrypts only Ethernet payload).
- No need for MPLS-over-GRE/IPsec (unlike traditional IPsec solutions).
B. QoS and VLAN Tagging
- If using 802.1Q VLANs, enable “tag-in-clear” mode to preserve QoS markings.
- MPLS EXP bits (for QoS) remain visible since MACsec doesn’t encrypt MPLS headers.
C. Key Management
- Static PSK: Simple but less scalable.
- 802.1X/EAP: Better for large-scale deployments.
- MACsec Key Agreement (MKA): Ensures secure key exchange.
D. Hardware Compatibility
- Check if routers/switches support MACsec in hardware (e.g., Cisco ASR 9000, Nexus 9000).
- Some service provider devices may not support MACsec (verify before deployment).
4. Comparison: MACsec vs. IPsec for MPLS L3VPN
| Feature | MACsec (802.1AE) | IPsec |
|---|---|---|
| Encryption Layer | Layer 2 (Ethernet) | Layer 3 (IP) |
| Performance | Line-rate (100G+) | Limited by crypto engine (~40-75 Gbps) |
| MPLS Support | Native (no changes needed) | Requires MPLS-over-GRE/IPsec |
| Latency | Ultra-low (PHY-level encryption) | Higher (IPsec processing) |
| Deployment Complexity | Simple (per-port) | Complex (tunnels, IKE, policies) |
| Best Use Case | PE-CE or PE-PE links | Internet-based MPLS VPNs |
5. Real-World Deployment Example
Scenario: Securing a Financial Institution’s MPLS L3VPN
- Requirement: Encrypt 10G PE-CE links between branches and the MPLS core.
- Solution:
- Enable MACsec on all CE and PE routers.
- Use AES-256-GCM + MKA with PSK.
- Preserve 802.1Q tags for QoS (voice/video traffic).
- Monitor MACsec sessions via SNMP/netflow.
Result:
✔ 10G encryption with zero performance loss.
✔ No impact on MPLS VPN routing.
✔ Compliant with financial security regulations.
6. Limitations & When to Avoid MACsec
- ❌ Not for Internet-based MPLS VPNs (use IPsec instead).
- ❌ Limited to Ethernet links (won’t work over non-Ethernet transports like OTN).
- ❌ Requires MACsec-capable hardware (older switches may not support it).
Conclusion: Is MACsec the Right Choice for Your MPLS L3VPN?
Yes, if:
- You need 100G+ encryption without performance loss.
- Your MPLS runs over Ethernet (PE-CE or PE-PE links).
- You want to avoid MPLS-over-GRE/IPsec complexity.
No, if:
- Your MPLS VPN traverses the Internet (use IPsec).
- Your hardware doesn’t support MACsec.
Final Recommendation
For high-speed, low-latency MPLS L3VPN security, MACsec is the best choice. For Internet-based VPNs, stick with IPsec.
Need help implementing MACsec? Consult our network security team for a tailored solution.
Further Reading: