Home · Documentation · Technology · MACsec

MACsec: Layer-2 Encryption for Transport Networks

IEEE 802.1AE MACsec gives you wire-speed encryption for every Ethernet frame between two routers: no IPsec tunnel overhead, no MTU penalty beyond the SecTAG, no software bottleneck. OcNOS implements MACsec with 256-bit AES-GCM, EAPoL-MKA key management, and hitless rekey on validated 100G and 400G platforms.

Encrypted Hop Between Two OcNOS Routers

A point-to-point MACsec link between two PE routers. Each frame is wrapped with a SecTAG, an ICV, and a packet number; the AES-GCM 256 cipher runs in the ASIC at line rate, with EAPoL-MKA negotiating SAKs in the control plane.

Why MACsec for transport networks

Operators carrying multi-tenant traffic over leased fibre, dark wave, or shared metro infrastructure increasingly need encryption at every hop, not just at the IP layer. MACsec wraps every Ethernet frame in a SecTAG and an integrity check value (ICV), with the cipher running on the ASIC at line rate. There is no MTU penalty beyond the ~32 bytes of MACsec overhead, no software bottleneck, and no per-flow tunnel state: just an encrypted hop.

The OcNOS MACsec implementation

Cipher Suites

AES-GCM 128 / 256

Both GCM-AES-128 and GCM-AES-256 cipher suites are supported, with extended packet numbering (XPN) for high-bandwidth links to avoid premature SA rollover.

Key Management

EAPoL-MKA + PSK

Pre-shared CAK with EAPoL-MKA negotiation of SAKs. CKN/CAK pairs roll on a configurable schedule with no operator intervention required.

Hitless Rekey

Zero-loss rotation

SAK rotation happens in-band without packet loss using overlapping receive associations. Rekey on time, packet-count, or operator-trigger.

Validated Platforms

100G / 400G line rate

Validated MACsec on UfiSpace and Edgecore platforms with per-port encryption at full link rate: no aggregate cap, no port-group limits.

Per-Port Mode

Selective enablement

Enable MACsec per physical port or per channel; mix encrypted and clear-text ports on the same chassis to fit hybrid deployments.

Telemetry

Counters + state

gNMI sensors for SecY counters, MKA participant state, packet number high-watermarks, and ICV failures: enough to alert before a key expires.

Operational guarantees with OcNOS MACsec

  • Standards-aligned. Full IEEE 802.1AE-2018 plus 802.1X-2020 MKA, interoperable with major vendor implementations on the wire.
  • No per-port encryption license. MACsec ships in the base OcNOS-SP image on supported platforms.
  • Hitless software upgrades. ISSU on supported chassis preserves MACsec sessions across NOS upgrades. Encryption stays up.
  • Mature operations. CLI, NETCONF, and gNMI configuration paths; ZTP-friendly for Day-0 provisioning of CKN/CAK pairs.
SR-MPLS underlay EVPN-VXLAN BGP OcNOS-SP product page

Designing an encrypted transport network?

Request a Technical Demo →
FAQ

Frequently asked questions

What cipher suites does OcNOS MACsec support?
OcNOS supports both GCM-AES-128 and GCM-AES-256, with extended packet numbering (XPN) on high-bandwidth links to avoid premature security-association rollover.
How does MACsec differ from IPsec?
MACsec encrypts at Layer 2, wrapping each Ethernet frame with a SecTAG and integrity check value in the ASIC at line rate. There is no per-flow tunnel state, no software bottleneck, and only about 32 bytes of overhead, unlike an IPsec tunnel.
Does MACsec rekey cause packet loss?
No. OcNOS performs hitless SAK rotation in-band using overlapping receive associations, so keys can roll on time, packet-count, or operator-trigger with zero packet loss.
Is MACsec line-rate on all ports?
On supported UfiSpace and Edgecore platforms OcNOS does per-port encryption at full link rate with no aggregate cap or port-group limits, and MACsec can be enabled selectively per port or channel.
Does OcNOS MACsec require a separate license?
No. MACsec ships in the base OcNOS-SP image on supported platforms with no per-port encryption license. It is configurable via CLI, NETCONF, and gNMI, and is ZTP-friendly for Day-0 provisioning of CKN/CAK pairs.
Datasheet and Solution Briefs

Go deeper. Take it with you.

The product datasheet plus short, technical downloads that go further than this page.

Datasheet

OcNOS-SP Datasheet

Full OcNOS-SP specification: the access, cell site and aggregation feature set, software SKUs, supported hardware platforms, and the solution ordering guide.

Get the datasheet
Solution Brief

SR-MPLS Upgrade with OcNOS

Migrate SR-MPLS onto OcNOS on open hardware: Flex-Algo, TI-LFA, and a proven Cisco-alternative cutover path.

Get the brief
Solution Brief

Cloud & Service Provider WAN Transport

Cloud and service-provider WAN transport on open hardware: SR-MPLS, EVPN, and scale-tested forwarding.

Get the brief