gimmicks for most & a question networking curious/experts - ? MACSEC

[lejeczek]

Hi guys.

Looking at macsec I've only started - so go easy on me with 
my possibly trivial questions -  and write here in hope, 
that some of you have expertise to tell...

To start with the most basic of what I ponder over - basic 
in my mind though I get, that it does not have to be that or 
simple/obvious - is MACSEC with 'bond' as parent or in other 
words: macsec "on" a 'bond' network interface.
Should such a "thing" work, does it work?

All & any thoughts shared are much appreciated.
many thanks, L.

[Chris Adams]

Once upon a time, lejeczek <peljasz(a)yahoo.co.uk&gt; said:
>  To start with the most basic of what I ponder over - basic in my
>  mind though I get, that it does not have to be that or
>  simple/obvious - is MACSEC with 'bond' as parent or in other words:
>  macsec "on" a 'bond' network interface.
>  Should such a "thing" work, does it work? 
My understanding is that you do MACsec on physical interfaces, so you
would configure it on each member of a LAG, not the virtual LAG
interface (e.g. bond0) itself.
-- 
Chris Adams <linux(a)cmadams.net&gt;

[Roger Heflin]

If the bond is an active/passive (non-LACP) then the older setup
scripts/bonding module would put the mac address for the first
interface it finds on the bond device and on both underlying physical
interfaces and in the bond.

Using the old scripts/bonding module (with LACP) both underlying
physical interfaces and the bond get the mac address of the first
interface added to the bond.

From what I can tell it appears that teamd is still using the bonding
module so if that is true then it should also act the same.

On Tue, Jun 6, 2023 at 7:51 AM Chris Adams <linux(a)cmadams.net&gt; wrote:
>
> Once upon a time, lejeczek <peljasz(a)yahoo.co.uk&gt; said:
> > To start with the most basic of what I ponder over - basic in my
> > mind though I get, that it does not have to be that or
> > simple/obvious - is MACSEC with 'bond' as parent or in other words:
> > macsec "on" a 'bond' network interface.
> > Should such a "thing" work, does it work?
>
> My understanding is that you do MACsec on physical interfaces, so you
> would configure it on each member of a LAG, not the virtual LAG
> interface (e.g. bond0) itself.
> --
> Chris Adams <linux(a)cmadams.net&gt;
> _______________________________________________
> users mailing list -- users(a)lists.fedoraproject.org
> To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[lejeczek]

de

On 06/06/2023 14:50, Chris Adams wrote:
>  Once upon a time, lejeczek <peljasz(a)yahoo.co.uk&gt; said:
> > To start with the most basic of what I ponder over - basic in my
> > mind though I get, that it does not have to be that or
> > simple/obvious - is MACSEC with 'bond' as parent or in other words:
> > macsec "on" a 'bond' network interface.
> > Should such a "thing" work, does it work?
>  My understanding is that you do MACsec on physical interfaces, so you
>  would configure it on each member of a LAG, not the virtual LAG
>  interface (e.g. bond0) itself.
>  
So I started from the bottom, went to do 'macsec' physical 
eth interfaces but when under 'bond' in "broadcast" I got NM 
failing to set such macsec ifaces up:
...
<info>  [1686137957.1794] device (macsec-ten-bott): 
supplicant interface state: disconnected -> completed
<info>  [1686137957.1829] device (macsec-ten-bott): carrier: 
link connected
<info>  [1686137957.1829] device (macsec-ten-bott): 
Activation: Stage 2 of 5 (Device Configure) successful.
<info>  [1686137957.2081] device (macsec-ten-bott): state 
change: config -> ip-config (reason 'none', sys-iface-state: 
'managed')
<warn>  [1686137957.2149] device (macsec-ten-bott): 
Activation: connection 'macsec-10.1.1-slave-bott' could not 
be enslaved
<info>  [1686137957.2150] device (macsec-ten-bott): state 
change: ip-config -> failed (reason 'unknown', 
sys-iface-state: 'managed')
<info>  [1686137957.2152] device (macsec-ten-bott): released 
from master device bond-1011
<warn>  [1686137957.2153] device (macsec-ten-bott): 
Activation: failed for connection 'macsec-10.1.1-slave-bott'
<info>  [1686137957.2156] device (macsec-ten-bott): state 
change: failed -> disconnected (reason 'none', 
sys-iface-state: 'managed')
<info>  [1686137957.2402] device (macsec-ten-bott): state 
change: disconnected -> unmanaged (reason 'user-requested', 
sys-iface-state: 'managed')

And to share what I find - obvious to those with expertise - 
that 'macsec' "on" a bond iface (broadcast mode is my case!) 
works, or seems to work I shall add as it's less than 1hr of 
my fiddling.

But I'd rather see physical MACs "macseced" and then these 
being bonded/bridged - as going to the lowest layer/device 
in a stack puts my mind at ease the best.
I should add - I do all that in Centos 9.

thanks, L.