When macsec exists?
Just to elaborate for others, MACSec is a standard (802.1ae) and runs at line rate. Something like a Juniper PTX10008 can run it at 400Gbps, and it’s just a feature you turn on for the port you’d be using for the link you want to protect anyway (PTXs are routers/switches, not security devices).
If I need to provide encryption on a DCI, I’m at least somewhat likely to have gear that can just do this with vendor support instead of needing to slap together some Linux based solution.
Unless, I suppose, there’s various layer 2 domains you’re stitching together with multiple L2 hops and you don’t control the ones in the middle. In which case I’d just get a different link where that isn’t true.
'Testing MACsec' paragraph, especially around
>> Last but not least, ... so that half of the traffic ... was being sent fully unencrypted ...
When you say "exists" ... is there an OpenSource high-quality implementation ?
Generally its used when you have links going between two of your sites, so you typically only need it on your switch or router that terminate that link.