Secure EVPN with MKA over BGP
Techniques described herein provide procedures for reducing MACsec Key Agreement (MKA)-related traffic and improving resource allocation for MKA protocol through an EVPN environment. Techniques include leveraging Border Gateway Protocol (BGP) signaling for MKA between Provider Edge (PE) routers instead of between Customer Edge (CE) routers, which mitigates both hardware restrictions and scalability challenges with a new Xaas enablement. A new BGP-EVPN route type is defined that can communicate a set of MKA information along with an address destination associated with a provider edge device to establish a BGP MKA session and enable MACsec encryption/decryption at the provider edge device.
1. A method, comprising:
sending, by a first provider edge device of a plurality of provider edge devices of an Ethernet Virtual Private Network (EVPN) instance, a Border Gateway Protocol (BGP) MACsec Key Agreement (MKA) discovery message to one or more remaining provider edge devices of the plurality of provider edge devices;
the BGP MKA discovery message including MKA information;
advertising, by the first provider edge device and using the MKA information, a Security Association Key to the one or more remaining provider edge devices of the plurality of provider edge devices; and
encrypting or decrypting, at the first provider edge device and using the Security Association Key, a content message received at the first provider edge device.
2. The method of claim 1 , further comprising:
establishing a BGP EVPN session between the first provider edge device and the one or more remaining provider edge devices; and
sending, by the first provider edge device and through the BGP EVPN session, the MKA information to the one or more remaining provider edge devices.
3. The method of claim 1 , the BGP MKA discovery message being a BGP prefix advertisement descriptive of a BGP-EVPN route including the MKA information and an address destination associated with the first provider edge device.
4. The method of claim 1 , where receipt of the BGP MKA discovery message including the MKA information configures the one or more remaining provider edge devices to perform one or more functionalities associated with a MACsec encryption protocol.
5. The method of claim 1 , further comprising:
receiving, at the first provider edge device and from a customer edge device in communication with the first provider edge device, the content message for communication to the one or more remaining provider edge devices of the plurality of provider edge devices;
encrypting, at the first provider edge device, the content message using the Security Association Key; and
communicating, at the first provider edge device, the content message to the one or more remaining provider edge devices, the content message having been encrypted using the Security Association Key.
6. The method of claim 1 , further comprising:
receiving, at the first provider edge device and from a remaining provider edge device of the plurality of provider edge devices, the content message for communication to a customer edge device in communication with the first provider edge device;
decrypting, at the first provider edge device, the content message using the Security Association Key; and
communicating, at the first provider edge device, the content message to the customer edge device, the content message having been decrypted using the Security Association Key.
7. The method of claim 1 , further comprising:
sending, at the first provider edge device, one or more BGP maintenance messages through a BGP EVPN session, where the one or more BGP maintenance messages maintain an “active” MKA session status associated with the first provider edge device.
8. The method of claim 7 , further comprising:
assigning an “inactive” MKA session status to the first provider edge device of the plurality of provider edge devices following the withdrawal of the first provider edge device from the BGP EVPN session.
9. A system, comprising:
a first provider edge device of a plurality of provider edge devices of an Ethernet Virtual Private Network (EVPN) instance, comprising:
a processor in communication with a memory and including instructions executable by the processor to:
send a Border Gateway Protocol (BGP) MACsec Key Agreement (MKA) discovery message to one or more remaining provider edge devices of the plurality of provider edge devices, the BGP MKA discovery message including MKA information;
advertise, using the MKA information, a Security Association Key to the one or more remaining provider edge devices of the plurality of provider edge devices; and
encrypt or decrypt, using the Security Association Key, a content message received at the first provider edge device.
10. The system of claim 9 , the memory further comprising instructions executable by the processor to:
establish a BGP MKA session between the first provider edge device and the one or more remaining provider edge devices; and
send, by the first provider edge device and through the BGP EVPN session, the MKA information to the one or more remaining provider edge devices.
11. The system of claim 9 , the BGP MKA discovery message being a BGP prefix advertisement descriptive of a BGP-EVPN route including the MKA information and an address destination associated with the first provider edge device.
12. The system of claim 9 , where receipt of the BGP MKA discovery message including the MKA information configures the one or more remaining provider edge devices to perform one or more functionalities associated with a MACsec encryption protocol.
13. The system of claim 9 , the memory further comprising instructions executable by the processor to:
receive, from a customer edge device in communication with the first provider edge device, the content message for communication to the one or more remaining provider edge devices of the plurality of provider edge devices;
encrypt the content message using the Security Association Key; and
communicate the content message to the one or more remaining provider edge devices, the content message having been encrypted using the Security Association Key.
14. The system of claim 9 , the memory further comprising instructions executable by the processor to:
receive, from a remaining provider edge device of the plurality of provider edge devices, the content message for communication to a customer edge device in communication with the first provider edge device;
decrypt the content message using the Security Association Key; and
communicate the content message to the customer edge device, the content message having been decrypted using the Security Association Key.
15. The system of claim 9 , the memory further comprising instructions executable by the processor to:
send one or more BGP maintenance messages through a BGP EVPN session, where the one or more BGP maintenance messages maintain an “active” MKA session status associated with the first provider edge device.
16. The system of claim 9 , the memory further comprising instructions executable by the processor to:
assign an “inactive” MKA session status to the first provider edge device of the plurality of provider edge devices upon withdrawal of the first provider edge device from a BGP EVPN session.
17. One or more non-transitory computer-readable media comprising computer-readable instructions, executable by one or more processors of a first provider edge device to:
send a Border Gateway Protocol (BGP) MACsec Key Agreement (MKA) discovery message to one or more remaining provider edge devices of a plurality of provider edge devices, the BGP MKA discovery message including MKA information;
advertise, using the MKA information, a Security Association Key to the one or more remaining provider edge devices of the plurality of provider edge devices; and
encrypt or decrypt, using the Security Association Key, a content message received at the first provider edge device.
18. The one or more non-transitory computer-readable media of claim 17 , the BGP MKA discovery message being a BGP prefix advertisement descriptive of a BGP-EVPN route including the MKA information and an address destination associated with the first provider edge device.
19. The one or more non-transitory computer-readable media of claim 17 , where receipt of the BGP MKA discovery message including the MKA information configures the one or more remaining provider edge devices to perform one or more functionalities associated with a MACsec encryption protocol.
20. The one or more non-transitory computer-readable media of claim 17 , further including computer-readable instructions executable by the one or more processors of the first provider edge device to:
send one or more BGP maintenance messages through a BGP EVPN session, where the one or more BGP maintenance messages maintain an “active” MKA session status associated with the first provider edge device.