Link-Layer Encryption

Link-layer encryption protects traffic at the data-link layer of the network stack. Instead of establishing an encrypted session between applications, it protects frames exchanged between participating network devices. IEEE 802.1AE MAC Security, commonly called MACsec, is an important implementation for Ethernet connectivity. MACsec can provide confidentiality, integrity, data-origin authentication, and replay protection for protected frames, while leaving information needed for Ethernet forwarding visible.

The most important design question is where encryption begins and ends. A MACsec session might extend between an enterprise router and a cloud provider's edge device. Traffic is decrypted at the receiving MACsec endpoint; that session does not establish continuous encryption through the cloud network to a virtual machine or application. Additional controls may protect later segments, but engineers must assess those segments separately rather than infer end-to-end protection from an encrypted access link.

In hybrid architectures, link-layer encryption is useful when workloads need high-throughput private connectivity and the organization must protect traffic on the access circuit. AWS Direct Connect supports MACsec on eligible dedicated connections at supported locations. Both the customer equipment and the selected connection must support the required MACsec capabilities. A Direct Connect connection is not encrypted by default, and MACsec availability must not be assumed for every connection type, port speed, or location.

For example, an enterprise connecting a data center to AWS can enable MACsec between its compatible router and the Direct Connect device. If a carrier supplies a transport segment between those endpoints, engineers must confirm that it transparently carries the required frames and supports the intended design. They must also identify any network segment before the customer router that remains outside the MACsec protection boundary. In a multi-cloud deployment, each provider-facing connection needs its own capability assessment and protection plan.

MACsec, IPsec, and TLS solve different problems. MACsec protects a Layer 2 link or segment. IPsec protects IP traffic between tunnel endpoints and can span routed networks. TLS protects traffic between TLS endpoints, which may be applications or intermediary proxies. AWS Site-to-Site VPN uses IPsec rather than link-layer encryption. It can complement private connectivity when the required encrypted boundary extends beyond the physical access link, but its supported routing architecture, throughput, tunnel overhead, and MTU implications must be evaluated.

Link-layer encryption can often operate at port line rate using hardware support, avoiding the throughput limitations of some software-based encryption designs. Its trade-offs include compatible equipment, eligible cloud ports, frame overhead, key management, and operational complexity. With MACsec Key Agreement, peers establish secure associations using configured credentials; engineers must coordinate parameters and rotate keys without unexpectedly interrupting connectivity.

Troubleshooting should distinguish physical connectivity, encryption negotiation, and routing. An interface can have carrier while MACsec negotiation fails, and a working encrypted session does not prove that BGP or application traffic is healthy. Check peer capabilities, key identifiers, configured keys, cipher compatibility, security policies, and frame counters. Decide explicitly whether loss of encryption must stop traffic: a policy that permits unencrypted fallback can preserve availability while violating a mandatory encryption requirement. Test failover links as well, because a backup path can otherwise silently weaken the security design.