话题 - Arista’s TunnelSec

- TunnelSec
Arista’s TunnelSec technology addresses each of these encryption use-cases by providing line-rate hardware based 10G to 400G encryption, embedded within the R3 series routing platforms with support for **IPsec, MACsec and an innovative new VXLANsec solution**.

1. MACsec
MACsec is performed at the interface (MAC layer) level on the platform, where security keys are exchanged with the neighboring node of the link, resulting in all data beyond the initial Ethernet header being fully encrypted between the two nodes. This makes MACsec a suitable solution for high-speed point-to-point connections, or for end-to-end encryption when all nodes in the path are MACsec aware.

1. MACsec frame format
![1719757036232.png](/upload/image/20240630/20240630221716_EB1F8C866AE32CAC378EE971D9224751.png)
2.  MACsec for Point-to-Point encryption in the Campus and the Data Center
![1719757057415.png](/upload/image/20240630/20240630221737_A68BBEC1D3B3607C26E59F3F7204BED6.png)
由此可见：Arista支持E2E MACSec，即至少到AP，是否支持对接终端未知。

- IPSec
IPSec also offers the additional benefit over MACsec by natively supporting both point-to-point and point-to-multipoint encryption topologies. 
即IPSec可以跑在MACSec之上，先做IPSec封装，再做MACSec封装。
1. IPsec frame format and IPsec key-exchange
![1719757208844.png](/upload/image/20240630/20240630222009_30E9EEA1377D579C456071B44E9AF8AD.png)
2. IPsec for Point-to-Point and Point-to-Multipoint encryption across an IP backbone
![1719757284221.png](/upload/image/20240630/20240630222124_AF82AA8398045318440A1CB579A254B0.png)
常用于分支间加密隧道

- VXLANsec
Addressing the demands for high performance 100G and 400G encryption of VXLAN traffic when interconnecting EVPN-VXLAN domains within a colo or across sites as part of a **Data Center Interconnect (DCI) solution**, TunnelSec platforms also provide embedded support for Arista’s innovative VXLANsec encryption technology.

1. VXLANsec frame format, key-exchange and BGP-EVPN peering
![1719757482443.png](/upload/image/20240630/20240630222442_D8A289E08645352EFBBEA196777D0A84.png)
相当于VxLAN over IPSEcc
2. VXLANsec, for encrypted EVPN multi-domain and Data Center Interconnect (DCI)
VxLAN DCI互联口场景
![1719758352386.png](/upload/image/20240630/20240630223912_296BD698B25E6F2FF24D17E50C6144C5.png)

[数据来源](https://www.arista.com/assets/data/pdf/Whitepapers/EVPN-Data-Center-Line-Rate-Encryption-with-Arista-TunnelSec-WP.pdf "数据来源")

	南柯	2023
	cxlove	1970
	vainner	1763
4	1000310428赵成帅	1718
5	XiaoWen	1710
6	1000380213洪伟焕	1701
7	weiben	1684
8	Jungle.Wei	1678
9	1100310131曾翔宇	1664
10	hongwh	1653