Hi, just wondering if there is any formal documentation for Mikrotik’s 802.1AE (AKA MACsec) in RoS v7.
Given its been in RoS v7 at least since its early beta release I was hoping to see some doco on it by now.
As of yet I have not got it working between devices( Get as far as it ‘negotiating’, and can see specific 802.1AE traffic via torch).
Is there a particular hardware requirement for it to work, or is it going to be a kernel feature no matter the HW ?
I have the same issues with 7.1rc5 when trying to establish a MACsec link between two CRS326-24G-2S+ devices.
The process hangs on:
[admin@MikroTik] /interface/macsec> print
Flags: I - inactive, X - disabled, R - running
0 name="macsec-test" interface=ether9 status="negotiating" cak=09db3ef1000000000000000000000000 ckn=e9ac profile=default
Is there any documentation or information available on how to setup/test MACsec?
Are there any log filters or outputs available to further track down those issues?
Has this feature been tested at Microtik site and should it work in general?
Please Mikrotik, can you add some comments on where MACSEC is currently at..
Now trying with 7.1rc7 using x86… All I see is ether-type traffic 888e on the interface I configured it on between 2x VM’s.
I can add an IP against the ‘macsec1’ interface using the command line( not winbox ) too,.
I have not seen Mikrotik do anything in this area.!!!
The MACSEC option has been there in the console since the very first v7 RC public release back in 2019. Its 2022 and NOTHING, yet > interface/macsec is there hidden in place sight of the console terminal…
I’ve tried today to setup the MACsec between a 2004 and 1016, both with 7.3.1 that we have in LAB. We need to encrypt an internal gigabit link for a client.
When the MACsec is coming up, the 1016 is rebooting, till the interface is disabled.
With WireGuard the throughput is something less than 1G for UDP and 500M for TCP in both directions.
As I assume I will see a working macsec shortly before I die, I used wireguard (eth — eth) and VXLAN (bridge – wg — wg — bridge) now to get my external port towards my hAPac in the garden quite secure.
this is something which frustrates me …
still have to work this around with a wireguard interconnect and vxlan bridged to PHY port to get a decent throughput
but MACsec would kill this overhead finally
please MT, do smth about this finally
this could be a killer feature against some way overpriced cisco hardware!
I know that some of the Marvell Prestera chips support MACSEC in hardware - would love to hear from MikroTik if there are plans to put MACSEC into the chip.
I need to add MACSEC in my v7 lab and play with it some.
Today I’ve tested MACsec between two CCR2004 in LAB. The interface is working without any problem.
These are the results on a 25G link between two sfp28 interfaces. The CCRs were reset to defaults with no other settings set but the ip addresses and the macsec interface.
