Cisco MACSec

Recently there is an increased demand for layer-2 encryption, more and more customers are now buying high speed point-to-point links, due to their low cost, and use them to extend their layer-2 network to remote locations, but they still need these links to be encrypted and secure.

For that purpose we have got the MACSec or 802.3ae protocol.

here is some technical information which i gathered:

MacSec - 802.1ae is the IEEE MAC Security standard (also known as MacSec) which defines connectionless data confidentiality and integrity for media access independent protocols.

Security Association Protocol (SAP) negotiation—When both sides of a link support encryption, the supplicant and the authenticator negotiate the necessary parameters to establish a security association (SA).

 

Link Security

When both sides of a link support 802.1AE Media Access Control Security (MACsec), a SAP negotiation is performed. An EAPOL-Key exchange occurs between the supplicant and the authenticator to negotiate a cipher suite, exchange security parameters, and manage keys. Successful completion of all three tasks results in the establishment of a security association (SA). 

Depending on your software version, crypto licensing, and link hardware support, SAP negotiation can use one of the following modes of operation:

• Galois/Counter Mode (GCM)—Specifies authentication and encryption

• GCM authentication (GMAC)—Specifies authentication and no encryption

• No Encapsulation— specifies no encapsulation (clear text)

• Null—Specifies encapsulation, no authentication and no encryption

All modes except No Encapsulation require Cisco TrustSec-capable hardware. 

And now for the practical section - for using MACSec you will have to use a switch with supported hardware such as 3560-X, 3750-X, 4500-6500 series or even Nexus (the complete list can be found on Cisco site),here in my lab i used 3750-X.

Note that there is no need for C3KX-SM-10G module else you want  to encrypt 10G links or one of the SFP ports! For MACSec you can use any one of the copper ports in the switch.

Then there is the IOS issue - you have to use 15.x or newer.

Here is the lab setup:

 

And the configuration:

3750X-A:

interface GigabitEthernet1/0/1  switchport trunk encapsulation dot1q  switchport trunk allowed vlan 1-10  switchport mode trunk  switchport nonegotiate  load-interval 30  cts manual   no propagate sgt   sap pmk 12345ABCDE mode-list gcm-encrypt end

3750X-B:

interface GigabitEthernet1/0/1  switchport trunk encapsulation dot1q  switchport trunk allowed vlan 1-10  switchport mode trunk  switchport nonegotiate  load-interval 30  cts manual   no propagate sgt   sap pmk 12345ABCDE mode-list gcm-encrypt end

Note that this configuration is using manual CTS with pre-shared key (12345ABCDE), there is also an option to use certificates and authentication with RADIUS server but this is out of the scope for this post.

Let's verify connectivity:

3750X-B#show cts interface gigabitEthernet 1/0/1 Global Dot1x feature is Disabled Interface GigabitEthernet1/0/1:     CTS is enabled, mode:    MANUAL     IFC state:               OPEN     Authentication Status:   NOT APPLICABLE         Peer identity:       "unknown"         Peer's advertised capabilities: "sap"     Authorization Status:    NOT APPLICABLE     SAP Status:              SUCCEEDED         Version:             2         Configured pairwise ciphers:             gcm-encrypt         Replay protection:      enabled         Replay protection mode: STRICT         Selected cipher:        gcm-encrypt     Propagate SGT:           Disabled     Cache Info:         Cache applied to link : NONE     Statistics:         authc success:              0         authc reject:               0         authc failure:              0         authc no response:          0         authc logoff:               0         sap success:                4         sap fail:                   0         authz success:              0         authz fail:                 0         port auth fail:             0     L3 IPM:   disabled.

3750X-B#show cts macsec counters interface gigabitEthernet 1/0/1 CTS Security Statistic Counters:                     rxL2UntaggedPkts = 0                        rxL2NotagPkts = 196                       rxL2SCMissPkts = 0                         rxL2CTRLPkts = 0                         rxL3CTRLPkts = 0                    rxL3UnknownSAPkts = 0                       rxL2BadTagPkts = 0                     txL2UntaggedPkts = 0                         txL2CtrlPkts = 0                         txL3CtrlPkts = 0                        txL3UnknownSA = 0                             SA Index : 1                   rxL2ReplayfailPkts = 0                     rxL2AuthfailPkts = 0                           rxL2PktsOK = 716                    rxL3AuthCheckFail = 0                  rxL3ReplayCheckFail = 0                       rxL2SAMissPkts = 196                      rxL3EspGcm_Pkts = 0                 rxL3InverseCheckfail = 0                        txL3Protected = 0                        txL2Protected = 1677 GENERIC Counters:                       CRCAlignErrors = 0                       UndersizedPkts = 0                        OversizedPkts = 0                         FragmentPkts = 0                              Jabbers = 0                           Collisions = 0                             InErrors = 0                            OutErrors = 0                         ifInDiscards = 0                    ifInUnknownProtos = 0                        ifOutDiscards = 0           dot1dDelayExceededDiscards = 0                                txCRC = 0                           linkChange = 0

3750X-B#show macsec interface gigabitEthernet 1/0/1  MACsec is enabled   Replay protect : enabled   Replay window : 0   Include SCI : yes   Cipher : GCM-AES-128   Confidentiality Offset : 0  Capabilities   Max. Rx SA : 16   Max. Tx SA : 16   Validate Frames : strict   PN threshold notification support : Yes   Ciphers supported : GCM-AES-128  Transmit Secure Channels   SCI : 708105E91E810000    Elapsed time : 01:01:00    Current AN: 1   Previous AN: 0    SC Statistics     Auth-only (0 / 0)     Encrypt (20704 / 0)  Receive Secure Channels   SCI : D48CB56FB1010000    Elapsed time : 01:01:00    Current AN: 1   Previous AN: 0    SC Statistics     Notvalid pkts 0      Invalid pkts 0     Valid pkts 15330         Late pkts 0     Uncheck pkts 0       Delay pkts 0   Port Statistics    Ingress untag pkts  0        Ingress notag pkts 219    Ingress badtag pkts 0        Ingress unknownSCI pkts 0    Ingress noSCI pkts 0         Unused pkts 0    Notusing pkts 0              Decrypt bytes 30119536    Ingress miss pkts 219

3750X-B# show macsec summary Interface                     Transmit SC         Receive SC GigabitEthernet1/0/1               1                   1

Final note:

Basically  MACSec should work without intermediate devices on the link, but i have tested it on several links including Metro-Ethernet and Carrier Ethernet and it works fine.

If for some reason you have problems raising MACSec on these kind of links please check the provider settings it's probably there (no CDP neighbors and STP problems are good indication that the provider settings are wrong!)

Cisco ASA ASDM unable to launch device manager

After upgrading to Java version 7 update 51 (build 1.7.0_51-b13) I encounter an error, among a lot of other problems and errors!, which I couldn't use the ASDM (7.1.5) to login into my ASA appliance.

Apparently there is some  compatibility issues between the Java and the ASDM, according to Cisco there are two possible solutions:

1. Use the ASDM Java web start to launch the ASDM (note that first you will have to install
Jave JRE (link: http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.html)

2. Downgrade Java from 7 update 51 to 7 update 40, you can find it here:
http://www.oldapps.com/java.php?old_java=12977

Cisco ASA access ports

While activating AnyConnect and trying to access the ASDM there might be problem to access one of the services.

ASDM and AnyConnect are using both https (SSL/TLS) on port 443 so you need to move one of them to use some other port:

ASA-LAB# show run http http server enable 7443 http server idle-timeout 60 http server session-timeout 40 http 0.0.0.0 0.0.0.0 OUTSIDE http 192.168.100.0 255.255.255.0 INSIDE100

Here I configured the ASDM to use port 7443, so when I will try to connect to the ASA with 

ASDM I will have to insert the port number as show here:

 We can also change the AnyConnect port by configuring it under webvpn:

webvpn  port 8080  enable OUTSIDE  enable INSIDE100  anyconnect image disk0:/anyconnect-win-3.1.04072-k9.pkg 1  anyconnect enable  tunnel-group-list enable

Here I configured the AnyConnect to use port 8080, also note that you will have to add the port in the AnyConnect client:

Any change in the webvpn will force you to shut down the service by issue the command:

webvpn  no enable OUTSIDE  no enable INSIDE100

Track group of objects

Let’s say we want to configure a group of objects to track and if some or all objects are down then we will trigger a failover.

IP SLA and track object are both used frequently for FHRP monitoring; with IP SLA we can measure responsiveness of nodes in the network and if we can’t access them then we can trigger HSRP/VRRP failover to second member. 

So first let’s configure the IP SLA objects:

! ip sla 101  icmp-echo 208.67.222.222 source-interface gigabitEthernet 0/0  owner OPENDNS_SERVER  frequency 5  threshold 2000  timeout 4000  history buckets-kept 15 exit ! ip sla 102  icmp-echo 8.8.8.8 source-interface gigabitEthernet 0/0  owner GOOGLE_DNS_SERVER  frequency 5  threshold 2000  timeout 4000  history buckets-kept 15 exit ! ip sla 103  icmp-echo 8.8.4.4 source-interface gigabitEthernet 0/0  owner GOOGLE_DNS_SERVER  frequency 5  threshold 2000  timeout 4000  history buckets-kept 15 exit ! ip sla 104  icmp-echo 4.2.2.1 source-interface gigabitEthernet 0/0  owner LEVEL3_ANYCAST  frequency 5  threshold 2000  timeout 4000  history buckets-kept 15 exit ! ip sla schedule 101 start-time now life forever ip sla schedule 102 start-time now life forever ip sla schedule 103 start-time now life forever ip sla schedule 104 start-time now life forever !

Here I used OpenDNS and Google DNS servers and Level3 anycast IP’s.

Then configure track objects:

track 101 ip sla 101 track 102 ip sla 102 track 103 ip sla 103 track 104 ip sla 104 !

Each track object is linked to IP SLA object.

Then configure track group:

track 10 list boolean and  object 101  object 102  object 103  object 104 exit !

Here I used Boolean syntax with AND operator but we can also use OR operator or even change it to weighted threshold where each object has certain weight on the trigger decision.

And last link the track group to the FHRP monitoring:

interface Gi0/1 standby 1 ip 192.168.10.1 standby 1 preempt standby 1 priority 150 standby 1 track 10 decrement 100 !

In order to view the tracking group type:

show track

Here is a list of best tracking IP’s:

#Google DNS servers 8.8.8.8 8.8.4.4 #OpenDNS servers 208.67.222.222 208.67.220.220 #Level3 anycast 4.2.2.1 4.2.2.2 4.2.2.3