Leveraging MACsec key agreement (MKA) state events to trigger fast IGP/EGP convergence on MACsec encrypted links
A network device configured to communicate with a network executes a security protocol. The security protocol establishes a secure session with a security peer network device, exchanges security protected traffic with the security peer network device over a secure link, detects whether there is a security failure in the secure session, and upon detecting a security failure, signals there is a security failure. The network device also executes a routing protocol. The routing protocol maintains a routing table that includes a route to the security peer over the secure link, routes the security protected traffic along the route, and, upon receiving from the security protocol the signal that there is a security failure, removes the route from the routing table to stop the routing.
1. A method comprising:
at a network device configured to communicate with a network, executing a security protocol and executing a routing protocol, wherein:
executing the security protocol includes:
establishing a secure session with a security peer network device, and exchanging security protected traffic with the security peer network device over a secure link;
detecting whether there is a security failure in the secure session; and
upon detecting the security failure, signaling to the routing protocol that there is the security failure by sending, to the routing protocol, a message having a message type to indicate the security failure, a failure type, and identifiers of security peers; and
executing the routing protocol includes:
maintaining a routing table that indicates a route to the security peer network device over the secure link, and routing the security protected traffic along the route; and
upon receiving from the security protocol signaling that there is the security failure, immediately executing a neighbor termination process and removing the route from the routing table to stop routing.
2. The method of claim 1 , wherein:
executing the security protocol includes executing a media access control (MAC) security (MACsec) Key Agreement (MKA) protocol; and
exchanging the security protected traffic includes exchanging MACsec protected traffic.
3. The method of claim 2 , wherein executing the routing protocol includes executing an Interior Gateway Protocol (IGP) or an Exterior Gateway Protocol (EGP).
4. The method of claim 1 , wherein:
detecting whether there is the security failure in the secure session includes detecting, independent of the routing protocol, an absence of regular, periodic heartbeat messages from the security peer network device.
5. The method of claim 4 , wherein:
executing the routing protocol further includes monitoring, independent of the security protocol, a routing protocol timer for a timeout indicative of a route failure; and
executing the security protocol further includes, prior to when routing protocol monitoring detects the timeout of the routing protocol timer:
detecting the absence of the regular, periodic heartbeat messages; and
upon detecting the absence of the regular, periodic heartbeat messages, performing the signaling to the routing protocol.
6. The method of claim 1 , wherein executing the routing protocol further includes:
detecting, independent of the security protocol, whether there is a routing peer failure for purposes of routing; and
upon receiving from the security protocol signaling that there is the security failure, removing the route includes removing the route to stop the routing whether the routing peer failure is detected or is not detected, such that signaling and removing the route override detecting whether there is the routing peer failure.
7. The method of claim 6 , wherein executing the routing protocol further includes:
upon receiving signaling that there is the security failure, and after removing the route, determining a new route to the security peer network device; and
upon determining the new route, installing the new route in the routing table, and routing the security protected traffic to the security peer network device over the new route.
8. The method of claim 1 , wherein executing the security protocol and executing the routing protocol are performed concurrently.
9. An apparatus comprising:
a network interface unit configured to communicate with a network; and
a processor coupled to the network interface unit and configured to:
execute a security protocol to:
establish a secure session with a security peer network device, and exchange security protected traffic with the security peer network device over a secure link;
detect whether there is a security failure in the secure session; and
upon detecting the security failure, signal to a routing protocol that there is the security failure by sending, to the routing protocol, a message having a message type to indicate the security failure, a failure type, and identifiers of security peers; and
execute the routing protocol to:
maintain a routing table that indicates a route to the security peer network device over the secure link, and route the security protected traffic along the route; and
upon receiving from the security protocol the signal that there is the security failure, immediately execute a neighbor termination process and remove the route from the routing table to stop routing.
10. The apparatus of claim 9 , wherein:
the security protocol includes a media access control (MAC) security (MACsec) Key Agreement (MKA) protocol; and
the security protected traffic includes MACsec protected traffic.
11. The apparatus of claim 10 , wherein the routing protocol includes a Interior Gateway Protocol (IGP) or a Exterior Gateway Protocol (EGP).
12. The apparatus of claim 9 , wherein:
the security protocol is configured to detect whether there is the security failure in the secure session by detecting, independent of the routing protocol, an absence of regular, periodic heartbeat messages from the security peer network device.
13. The apparatus of claim 12 , wherein:
the routing protocol is further configured to monitor, independent of the security protocol, a routing protocol timer for a timeout indicative of a route failure; and
the security protocol is further configured to, prior to when the timeout of the routing protocol timer is detected by the routing protocol:
detect the absence of the regular, periodic heartbeat messages; and
upon detecting the absence of the regular, periodic heartbeat messages, send the signal to the routing protocol.
14. The apparatus of claim 9 , wherein the routing protocol is further configured to:
detect, independent of the security protocol, whether there is a routing peer failure for purposes of routing; and
upon receiving from the security protocol the signal that there is the security failure, remove the route whether the routing peer failure is detected or is not detected.
15. The apparatus of claim 14 , wherein the routing protocol is further configured to:
upon receiving the signal that there is the security failure, and after the route is removed, determine a new route to the security peer network device; and
upon determining the new route, install the new route in the routing table, and route the security protected traffic to the security peer network device over the new route.
16. A non-transitory computer readable storage media encoded with instructions that, when executed by a processor of a network device configured to communicate with a network, cause the processor to perform:
executing a security protocol and executing a routing protocol, wherein:
executing the security protocol includes:
establishing a secure session with a security peer network device, and exchanging security protected traffic with the security peer network device over a secure link;
detecting whether there is a security failure in the secure session; and
upon detecting the security failure, signaling to the routing protocol that there is the security failure by sending, to the routing protocol, a message having a message type to indicate the security failure, a failure type, and identifiers of security peers; and
executing the routing protocol includes:
maintaining a routing table that indicates a route to the security peer network device over the secure link, and routing the security protected traffic along the route; and
upon receiving from the security protocol signaling that there is the security failure, immediately executing a neighbor termination process and removing the route from the routing table to stop routing.
17. The non-transitory computer readable storage media of claim 16 , wherein:
the instructions to cause the processor to perform executing the security protocol include instructions to cause the processor to perform executing a media access control (MAC) security (MACsec) Key Agreement (MKA) protocol; and
the instructions to cause the processor to perform exchanging the security protected traffic include instructions to cause the processor to perform exchanging MACsec protected traffic.
18. The non-transitory computer readable storage media of claim 16 , wherein:
the instructions to cause the processor to perform detecting whether there is the security failure in the secure session include instructions to cause the processor to perform detecting, independent of the routing protocol, an absence of regular, periodic heartbeat messages from the security peer network device.
19. The non-transitory computer readable storage media of claim 18 , wherein:
the instructions to cause the processor to perform executing the routing protocol include instructions to cause the processor to perform monitoring, independent of the security protocol, a routing protocol timer for a timeout indicative of a route failure; and
the instructions to cause the processor to perform executing the security protocol include instructions to cause the processor to perform, prior to when the monitoring detects the timeout of the routing protocol timer:
detecting the absence of the regular, periodic heartbeat messages; and
upon detecting the absence of the regular, periodic heartbeat messages, performing the signaling to the routing protocol.
20. The non-transitory computer readable storage media of claim 16 , wherein the instructions to cause the processor to perform executing the routing protocol further include instructions to cause the processor to perform:
detecting, independent of the security protocol, whether there is a routing peer failure for purposes of routing; and
upon receiving from the security protocol signaling that there is the security failure, removing the route to stop the routing whether the routing peer failure is detected or is not detected, such that signaling and removing the route override detecting whether there is the routing peer failure.