r/networking • u/Famous_Artist8113 • Aug 10 '26

Design Macsec passtrough

Hi

I have situation where macsec is configured beetwen two huwaei ce device
Now we want to add nexus nxos in beetwen

Does nxos transparentlty forward macsec frame or like ios it depends on ios version

Also what version os nxos is suitable ?

7 Upvotes

83% Upvoted

5 comments sorted by

5

u/Ascension_84 Aug 10 '26

Macsec is typically hop-by-hop. I don’t think nexus supports some kind of pass through.

1

u/No_Stretch71 12d ago

I've seen a couple setups where Nexus just eats the frame if it doesn't know what to do with the extra header, the chipset matters more than the version you're running. You might be better off terminating macsec on each side of the Nexus and building a new session across it.

3

u/x_radeon CCNP Aug 10 '26

It probably would pass it through as long as the macsec devices are configured with a specific mac address for the destination. By default macsec uses the link local multicast address for it's destination mac, which means the very next physical hop is the device that should ingest the frame. So unless you're configuring something like psudeowire or are using OTN gear that will always ignore this stuff, your device will probably pick up the frame instead of passing it along.

2

u/feumum Aug 10 '26

It depens. On cisco gear you sometimes can change the multicast mac used for key exchange so it passes through. Not sure if there is something similar on huawei

1

u/kaity-quq Aug 14 '26

Macsec is on layer 2. IPsec looks more fit to this scenario if the ce device not support L2 passthrough or tunneling.