Thanks Network5
Thats quite handy information. Especially on CPU load.
I wonder if one/two of the cores was dedicated to that task thus the ~50%'ish cpu-load !! ?
Not bad I guess for a unit that’s only got a CPU and no dedicated switch chip. At least there is head room for other activities on the router such as firewall/actual routing/queues etc etc..
As for Mikrotik’s future switch range(CRS series) hopefully they will obtain switch chip’s that have macsec hardware offload options !!
Cheers
Any examples how this works with VLAN-Interfaces and Bonding-Interfaces?
Lets say we have a Bonding eth1+eth2 as LAG0 and a 100 VLANs.
Is all we have to create 2 MACsec Inteface (eth1 and eth2) and thats it?
Or do we have it the cascading way: create MACsec-Interfaces → create the Bond with the MACsec-Interfaces
EDIT: Awesome “Internal Error”…
Thats a real-world Example: Bonding, VLANs and MACsec.
LAG0 consists of eth1, LAG0 is a Port of Bridge BR0. MACsec enabled on eth1.
There is no option to add macsec1 as Interface to the Bonding.
I think ( and probably wrong !! will need to test ). Based on some playing of other things a few nights ago
If you adjust the MTU of the ETH ( or adjust down the bridge ) by ~ +/- 64bytes, and take and try again, the error may go, as I dont think MTU gets corrected when you add it to bridges/vlans and may be the issue with the bonding.
Actually, default MACSEC Header is 32 Byte. Depending on cyphers used, it may go up to 160Byte in case of AES512.
Still, 64 Byte leaves you quite a bit of headroom 
cause macsec is applied to HARDWARE interfaces
macsec@eth1
macsec@eth2
eth1+2@bond0
watch out for MTU accordingly (1600 would surely suffice on L2)
add the bond0 to the bridge and (pvid “xyz” for untagged traffic and /interface/bridge/vlans settings on bond0 for tagged vlans)
but do not expect a lot of Performance right now.
Hello,
I tried to get the MACsec connection working, but I always get “Internal Error” and Status “invalid” on both sides.
[admin@MikroTik] > interface/macsec/ print
Flags: I - inactive, X - disabled, R - running
0 I ;;; Internal error
name="macsecPH" mtu=1468 interface=ether6-slave-local status="invalid" cak=32fe28994a90b276f5b2aa7500000000 ckn=6464937365522a8b222c999e97f25b78c456d8e0 profile=default
the MAC address is always 00:00:00:00:00:00 in Webfig (XX:XX:XX:XX:XX:XX in WinBox)
Is this normal?
Thanks, Daniel
paste the whole interfaces and bridge config.
there are many factors which could make it invalid!
Hello,
thanks for your answer, here is the whole config:
[admin@MikroTik-mAP2n] /interface> print detail
Flags: D - dynamic; X - disabled, R - running; S - slave; P - passthrough
0 RS name="ether1" default-name="ether1" type="ether" mtu=1500 actual-mtu=1500 l2mtu=1598 max-l2mtu=2028 mac-address=D4:CA:6D:88:CD:49 ifname="eth0" ifindex=9 id=1 last-link-down-time=nov/21/2022 18:51:45 last-link-up-time=nov/21/2022 18:51:46 link-downs=1
1 name="ether2" default-name="ether2" type="ether" mtu=1500 actual-mtu=1500 l2mtu=1598 max-l2mtu=2028 mac-address=D4:CA:6D:88:CD:4A ifname="eth1" ifindex=10 id=2 link-downs=0
2 RS name="wlan1" default-name="wlan1" type="wlan" mtu=1500 actual-mtu=1500 l2mtu=1600 max-l2mtu=2290 mac-address=D4:CA:6D:88:CD:4B ifname="ath0" ifindex=7 id=3 last-link-up-time=nov/21/2022 18:51:51 link-downs=0
3 R name="bridge2" type="bridge" mtu=auto actual-mtu=1500 l2mtu=1598 mac-address=D4:CA:6D:88:CD:49 ifname="br0" ifindex=6 id=5 last-link-up-time=nov/21/2022 18:51:38 link-downs=0
4 name="macsec1" type="macsec" mtu=1468 mac-address=(invalid) id=6 link-downs=0
[admin@MikroTik-mAP2n] /interface/ethernet> print detail
Flags: X - disabled, R - running; S - slave
0 RS name="ether1" default-name="ether1" mtu=1500 l2mtu=1598 mac-address=D4:CA:6D:88:CD:49 orig-mac-address=D4:CA:6D:88:CD:49 arp=enabled arp-timeout=auto loop-protect=default loop-protect-status=off loop-protect-send-interval=5s loop-protect-disable-time=5m auto-negotiation=yes
advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full full-duplex=yes tx-flow-control=off rx-flow-control=off speed=100Mbps bandwidth=unlimited/unlimited switch=switch1
1 name="ether2" default-name="ether2" mtu=1500 l2mtu=1598 mac-address=D4:CA:6D:88:CD:4A orig-mac-address=D4:CA:6D:88:CD:4A arp=enabled arp-timeout=auto loop-protect=default loop-protect-status=off loop-protect-send-interval=5s loop-protect-disable-time=5m auto-negotiation=yes
advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full full-duplex=yes tx-flow-control=off rx-flow-control=off speed=100Mbps bandwidth=unlimited/unlimited switch=switch1 poe-out=off poe-controller="gpio" poe-priority=10 power-cycle-ping-enabled=no power-cycle-interval=none
[admin@MikroTik-mAP2n] /interface/macsec> print detail
Flags: I - inactive, X - disabled, R - running
0 I name="macsec1" mtu=1468 interface=ether2 status="invalid" cak=32fe28994a90b276f5b2aa7500000000 ckn=6464937365522a8b222c999e97f25b78c456d8e0 profile=default
[admin@MikroTik-mAP2n] /interface/bridge> print detail
Flags: X - disabled, R - running
0 R name="bridge2" mtu=auto actual-mtu=1500 l2mtu=1598 arp=enabled arp-timeout=auto mac-address=D4:CA:6D:88:CD:49 protocol-mode=rstp fast-forward=no igmp-snooping=no auto-mac=yes ageing-time=5m priority=0x8000 max-message-age=20s forward-delay=15s transmit-hold-count=6 vlan-filtering=no dhcp-snooping=no
[admin@MikroTik-mAP2n] /interface/bridge/port> print
Columns: INTERFACE, BRIDGE, HW, PVID, PRIORITY, PATH-COST, INTERNAL-PATH-COST, HORIZON
# INTERFACE BRIDGE HW PVID PRIORITY PATH-COST INTERNAL-PATH-COST HORIZON
0 ether1 bridge2 no 1 0x80 10 10 none
1 wlan1 bridge2 1 0x80 10 10 none
Hi golf0r.
Use ‘export’ rather than 'print to show configs. e.g /export file=MyFile.rsc and from the winbox / files you will see the MyFile.rsc which you can drag onto the windows desktop and open with a text editor
or use /export file=[filename] hide-sensitive command to not add in things pike passwords etc.
That said, you should make sure the Ethernet interface is NOT directly connected to a bridge, as MACSEC does not work like that. It requires the physical interface to itself, and then you would later bond the new UP’ed MACSEC1 interface to things like bridges/vlans etc.
I note your using a mAP2n, that does not have a lot of CPU so any macsec interface will be slow.
[macsec1(ETH2)]------------------[(ETH3)macsec1]
what is the INTENDED goal here?
something like that would bridge 2 networks via L2 over a macsec link
@killersoft:
the Ethernet interface used for MACsec is not connected to the bridge, I removed ether2 as port of the bridge.
@spippan:
when I am back home I will add macsec1 to the bridge and then try again.
My goal is to create a secure ethernet connection between my Router (CRS109-8G-1S-2HnD-IN) and a Wifi Accesspoint (mAP2nD), because the ethernet cabel goes outside of my house.
So on the Router side I would bridge the macsec interface with the internal ethernet ports and wifi and on the Accesspoint side I would bridge macsec interface only with wifi (now ether1 is also bridged until config runs)
should do the trick
but do not expect any kind of good throughput. a mAP is equipped far in the lower specs area
Hello,
sorry my english is not the best.
I used macsec on both ccr1072 an ist works. i got the status invalid if i had no link, negotiating if the link ist up, but MACsec doesn`t work and open-encrypted if all looks fine.
Now my question…
who can i see what kind of MACSec i have configure… MACSec 802.1Q Tag is encrypted oder 802.1Q Tag is clear. I think the first one calls also WAN MACSec and the other LAN MACSec.
my status ist open-encrypted, so i think i actually use WAN MACSec. What must i do if i will use LAN MACSec
Thanks and best regards
Marco
it is very difficult to quite understand your problem here exactly.
could you paste your config. here and maybe a schematic drawing what you WOULD like to achieve?
ps: are you natively german speaking?
Hallo ja spreche besser deutsch als englisch... aber das muss ja auch klappen und man muss seine Wohlfühlzone auch mal verlassen...
Anbei die Konfiguration meiner beiden Mikrotik Router, die MACSec miteinander sprechen.
Ich arbeite bei einem Provider und die Kunden fragen vermehrt an und wollen MACSec über unser Netz übertragen und fragen nach einer Transparenz für dieses Protokoll an. Wir als Provider stellen den Kunden "normale" L2 Switche zur Verfügung und die Kunden schließen an den Kundenport Ihre CPEn an, die dann MACSec übertragen von Punkt A nach Punkt B.
Wir haben um dies zu simulieren zwei Mikrotik Router konfiguriert und MACSec aktiviert. Dieses funktioniert auch und eine Verbindung kommt zu Stande. Im Status wird mir angezeigt "open-encrypted". Ich habe eine png Datei mit angehangen wo unterschieden wird zwischen WAN MACSec und LAN MACSec. Unsere Kunden möchten LAN MACSec über unser Netz übertragen, sprich das VLAN ist Encryprted.
Da mein Status auf den Mikrotik Routern "open-encrypted" anzeigt vermute ich, das meine Konfiguration LAN MACSec konform. Ich wollte dieses nun bestärtigt wissen und gleichzeitig nachfragen was ich konfigurieren müsste um den WAN Mode zu bekommen.
Danke und Gruß
Marco
okay. also natively german speaking, but i will stick to english furthermore.
thanks for clearing up what your setup is made of.
to your question regarding "WAN mode" i guess it could be possible via switch configuration beforehand. so setting the PVID via the bridge menu for the macsec interface
so setting up a macsec interface (e.g. parent-interface ether1), adding the macsec(!) interface to a bridge and then setting the PVID in bridge > ports to the desired untagged VLAN
the bridge therefor has to be vlan-aware (vlan-filtering enabled)
hope this helps.
Hi all.
Same results, but ~28/33% CPU on 25Gbps, with CCR2216 (BW tool -UDP-rOS 7.7).
~450 Mbps Vs ~25Gbps. I can’t figure out how to use MACSec in production enviroment.
please consider the tests for that being done with 2 clients on each end and NOT with bandwidth test inside the 2 MACsec peers
MACsec is VERY cpu intense in relation to normal forwarding
and as long as there are no hw-offload options enabled in rOS7 with supported (marvell) switch chips, this will always be done in cpu (unlike cisco does it with dedicated ASICs)
These are 2 different beasts.
Lan-macsec is point-to-point topology.
WAN-macsec is point-to-multipoint ( multihop ) topology, it's need more components to work:
hub topology management ( peer2peer, star ),
CIA triad (confidentiality, integrity and availability) components,
Just like IPSEC infrastructure has: replay protection, key session/exchange, etc. (example: Strongswan - its an infrastructure not just a simple ipsec-tunnel ).
( The whole process is very similiar to a Switch 802.1X on LAN port where PC has to authenticate to get access to the network, the access request arrive to the NAC server where the Switch receives all the parameters what to do with LAN port: VLAN, IP-ADDRESS, ... ).
Linux has some basic stuff for that: macsec + wpa_supplicant, but the rest of the list is missing for the WAN-macsec.
Anyone got a dhcp-client up and running on a macsec secured LAN-interface?
I always get DHCP offers on the “remote” bridge (see it in the logs) but it never get’s the address.
EDIT: It’s all my fault! I missed setting the MTU of both macsec-interfaces to 1500. Shame on me! 
And: still no macsec documentation at help.mikrotik.com 
Ralf.
