Is MACsec(IEEE 802.1AE) supported in the FreeBSD kernel?

[Anupam]

I need to make a choice between IPSec and MACsec. I know that IPSec is supported in the FreeBSD kernel and there is already support for MACsec in the linux kernel. I could not find any information online stating that MACsec support is inbuilt in the FreeBSD kernel now.

 

[SirDice]

Even though both will encrypt traffic they have entirely different purposes. IPSec is used for VPNs and can be routed across the internet. MACsec is primarily used to authenticate local equipment and only works on direct ethernet connections.

What are you trying to do? I'm guessing you're actually wanting to create an encrypted tunnel across (inter)networks, in which case MACsec cannot be used.

 

[fnoyanisi]

Although, I am not an expert on the matter, I doubt there is MACSEC support in the kernel

~ % grep IPSEC /usr/src/sys/amd64/conf/GENERIC
options    IPSEC           # IP (v4/v6) security
# The crypto framework is required by IPSEC
device       crypto           # Required by IPSEC
~ % grep MACSEC /usr/src/sys/amd64/conf/GENERIC
~ %

 

[Anupam]

Even though both will encrypt traffic they have entirely different purposes. IPSec is used for VPNs and can be routed across the internet. MACsec is primarily used to authenticate local equipment and only works on direct ethernet connections.

What are you trying to do? I'm guessing you're actually wanting to create an encrypted tunnel across (inter)networks, in which case MACsec cannot be used.

I want to encrypt traffic between nodes within the same data center. Macsec has the advantage wherein it will encrypt the broadcast and multicast also. For me the only disadvantage of macsec is that it does not have a kernel implementation for now. Also, macsec can also work over the WAN (need to read more about it to talk authoritatively) but my requirement is only to encrypt "ALL" traffic between nodes within the same datacanter for now.