A regional hospital enabled MACsec on the link between a leaf and a firewall and expects those frames to stay encrypted across the routed WAN to a remote clinic. What does this MACsec session actually protect?
Select an answer to reveal the explanation.
Short Explanation
MACsec is a locked door on one hallway, and the next hallway is a different building. You encrypted only the leaf-to-firewall link, so the frames are clear again once they are routed toward the clinic. It is not a site-to-site VPN, and it does not ride the Fibre Channel VSAN.
Full Explanation
MACsec, IEEE 802.1AE, encrypts frames on a single link. MKA agrees the keys for that hop. The hospital session protects the leaf-to-firewall link and stops there. The firewall decrypts the frames before it routes them, so the WAN toward the clinic is clear unless some other encryption is configured on the later hops. A site-to-site VPN such as IPsec is what would cover a routed path. MACsec does not become that VPN because it was enabled on the first link. MKA is the key agreement. Once the session is up, MACsec encrypts the data frames on the link, not only the OSPF hellos. A Fibre Channel VSAN and its zoneset are a SAN construct. MACsec does not encrypt Fibre Channel frames and it is not a zoning feature. Caveat: if the following hop also has MACsec, that is a second, separate session, and a break on that hop does not keep the first link's protection. Operational check: confirm the MACsec session is up on the leaf-to-firewall interfaces, then capture beyond the firewall and verify the clinic-bound packets are no longer MACsec frames.