Secure link aggregation

1. A method comprising:

discovering via a layer 2 neighbor discovery protocol, by a processing resource of a network device within a secure domain, device information associated with a peer network device in an untrusted domain, wherein a first interface of the network device is directly connected to a first interface of the peer network device;

while allowing at least some network traffic to continue to be transmitted through the first interface, authenticating, by the processing resource, the peer network device;

when the peer network device is successfully authenticated, establishing, by the processing resource, a secure session between the network device and the peer network device over a first link coupling the first interface of the network device to the first interface of the peer network device; and

allowing, by the processing resource, the first link to operate as part of a single aggregated logical link including a second link coupling a second interface of the network device to a second interface of the peer network device.

2. The method of claim 1 , wherein the layer 2 neighbor discovery protocol comprises Link Layer Discovery Protocol (LLDP).

3. The method of claim 1 , wherein the device information includes a hostname of the peer network device, an address of the peer network device, or a capability of the peer network device.

4. The method of claim 1 , wherein said authenticating comprises:

establishing, by the processing resource, a Datagram Transport Layer Security (DTLS) connection between the network device and the peer network device via the first link;

receiving, by the processing resource, a signed certificate from the peer network device via the DTLS connection; and

confirming, by the processing resource, the signed certificate is from a trusted certificate authority.

5. The method of claim 1 , wherein said authenticating comprises determining whether the peer network device is known to the network device as a result of having a previously validated peering session with the network device via the second link.

6. The method of claim 5 , wherein information indicative of the previously validated peering session is maintained within a database of the network device.

7. The method of claim 1 , wherein said authenticating comprises subjecting the peer network device to a challenge-response authentication mechanism.

8. The method of claim 1 , further comprising selectively encrypting, by the processing resource, packets transmitted on the single aggregated logical link.

9. The method of claim 8 , wherein said selectively encrypting, by the processing resource, packets transmitted on the single aggregated logical link comprises encrypting control traffic and not encrypting user traffic.

10. A network device comprising:

a processing resource; and

a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to:

discover via a layer 2 neighbor discovery protocol device information associated with a peer network device in an untrusted domain, wherein a first interface of the network device is directly connected to a first interface of the peer network device;

while allowing at least some network traffic to continue to be transmitted through the first interface, authenticate the peer network device;

when the peer network device is successfully authenticated, establish a secure session between the network device and the peer network device over a first link coupling the first interface of the network device to the first interface of the peer network device; and

allow the first link to operate as part of a single aggregated logical link including a second link coupling a second interface of the network device to a second interface of the peer network device.

11. The network device of claim 10 , wherein the layer 2 neighbor discovery protocol comprises Link Layer Discovery Protocol (LLDP).

12. The network device of claim 10 , wherein the device information includes a hostname of the peer network device, an address of the peer network device, or a capability of the peer network device.

13. The network device of claim 10 , wherein the peer network device is authenticated by:

establishing a Datagram Transport Layer Security (DTLS) connection between the network device and the peer network device via the first link;

receiving a signed certificate from the peer network device via the DTLS connection; and

confirming the signed certificate is from a trusted certificate authority.

14. The network device of claim 10 , wherein the peer network device is authenticated by determining whether the peer network device is known to the network device as a result of having a previously validated peering session with the network device via the second link.

15. The network device of claim 14 , wherein information indicative of the previously validated peering session is maintained within a database of the network device.

16. The network device of claim 10 , wherein the peer network device is authenticated by subjecting the peer network device to a challenge-response authentication mechanism.

17. The network device of claim 10 , wherein the instructions further cause the processing resource to selectively encrypt packets transmitted on the single aggregated logical link.

18. The network device of claim 17 , wherein selective encryption of the packets involves encrypting control traffic and not encrypting user traffic.