MACSec over Wireless Bridge

[Dennis_Aruba]

Team,

About MACSec over wireless Bridge. The setup looks like this and we will be using Aruba 2930F on both ends. On top of this also is it will be a Point-Multipoint Wireless Bridge Setup.

We could not find a reference in Aruba Switches regarding the config and there is also no documents saying that this setup is even possible.

Here is the setup

| MacSec SW1  |---{Wireless Bridge}>>>>><<<<<<{Wireless Bridge}---|  MacSec SW2 |

Is this possbile for Aruba? Can you share please the config on how we can engage this requirement

[akg7]

Hi,

You can refer below link for Access SecurityGuide:

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00042657en_us

Thanks!

[Ivan_B · Accepted solution]

Hi @Dennis_Aruba !

It's kind of unusual request as MACsec is used for Ethernet traffic security and 802.11 protocols have their own security mechanisms - WPA, WPA2, WPA3 etc. So first, MACsec over WDS is redundant and second, it can be hit and miss depending on the actual AP hardware and software. I couldn't find any document describing this corner case with Aruba APs, but for switches you need to use the guide @akg7 provided, the "Infrastructure MACsec" section is what you need. Switches themselves don't need to know anything about WDS bridge, so from their perspective that bridge is just a direct link and no additional configuration is required. But without test I can't guarantee the WDS bridge between APs will allow MACsec traffic. From my side I forsee possible issues with EAPOL-MKA exchange as many WDS implementations do not bridge EAPOL packets. And without EAPOL-MKA successful exchange switches won't be able to establish MKA session.

[Dennis_Aruba]

thank yuou for the response.

You are correct. it seems the only way to found out is to try this setup. We have been looking in the internet but we couldn't find any reference.  We have few setups alredy with MacSec but they are all wired and so far we have no issues on that area.

We intended MacSec over wireless bridge as an added layer in Security. Because the 3rd party networks that will ride on to our corporate network is quite isolated and we do not have much of a way in monitoring them.

[Dennis_Aruba]

thank you. We'll check the link and see what more we can do..

[Dennis_Aruba]

Hello,

Discarding the Wireless Part.  Are there ways for aruba switches (particulary 2930) to support MacSec Point-to-Multipoint. ? Was reviewing the HP Macsec guide it provide solution only for static trunking and probably it is good only for P2P setup.

[Ivan_B]

Typically infrastructure MACsec is used in P2P links where you have only two participants since we speak about switches here, not hubs. Unfortunately you are right and documentation for these switches doesn't state clearly if group CAKs are supported and can you use 3 and more switches with one shared CAK on one link. I think it may have issues with replay protection... For example ArubaOS-CX guides clearly says "Provides Layer 2 hop-by-hop encryption on point-to-point Ethernet links.", and I doubt 2930 to have more extended feature than those. And also typically when a vendor supports group CAK there is a configuration abstraction for multiple key storage, like a keychain. There is no such in 2930...

But as with WDS - only a test can reveal the truth as this is really a corner case.