Methods and devices for automatically reestablishing media access control security sessions over wide area networks
A first electronic device communicates over a wide area network by establishing a MACSec session with a second electronic device over the wide area network. The MACSec session is thereafter torn down in response to the first electronic device sensing a fault in the MACSec session. Then, one or more keep alive probes are transmitted to the second electronic device over the wide area network. A response to the keep alive probe is thereafter received. The MACSec session may then be automatically reestablished in response to receiving the probe.
1 . A method for a first electronic device to communicate over a wide area network, the method comprising:
establishing a MACSec session with a second electronic device over the wide area network;
enabling transmission of a keep alive probe in response to determining that a VxLAN cross-connect feature is not enabled during the MACSec session;
tearing down the MACSec session in response to sensing a fault in the MACSec session;
transmitting the keep alive probe to the second electronic device over the wide area network after tearing down the MACSec session, if the transmission of the keep alive probe is enabled;
receiving a response to the keep alive probe; and thereafter
automatically reestablishing the MACSec session.
2 . The method of claim 1 , further comprising completing a handshake with the second electronic device after receiving the response to the keep alive probe.
3 . The method of claim 1 , wherein the MACSec session is formed over a VxLAN tunnel through the wide area network.
4 . The method of claim 1 , wherein sensing a fault in the MACSec session comprises not receiving a packet over the MACSec session within a first predetermined time period.
5 . The method of claim 4 , wherein the first electronic device is configured to transmit additional keep alive probes at a predetermined interval, where the predetermined interval is longer than the first predetermined time period.
6 . The method of claim 5 , wherein the predetermined interval is configurable.
7 . The method of claim 1 , further comprising receiving a keep alive probe over the wide area network after tearing down the MACSec session.
8 . The method of claim 7 , wherein the received keep alive probe is received from the second electronic device.
9 . The method of claim 1 , wherein the keep alive probe comprises a MACSec HELLO packet.
10 . The method of claim 1 , further comprising disabling transmission of the keep alive probe in response to determining that a MACSec physical interface is not operating.
11 . The method of claim 1 , wherein the first electronic device is a switch.
12 . The method of claim 1 , wherein the MACSec session is automatically reestablished at least in part in response to receiving the response to the keep alive probe.
13 . An electronic device, comprising:
a networking subsystem that is configured to:
establish a MACSec session with a second electronic device over a wide area network;
enable transmission of a keep alive probe in response to determining that a VxLAN cross-connect feature is not enabled during the MACSec session;
tear down the MACSec session prior to conclusion of the MACSec session;
transmit the keep alive probe to the second electronic device over the wide area network after tearing down the MACSec session, if the transmission of the keep alive probe is enabled;
receive a response to the keep alive probe; and
automatically reestablish the MACSec session.
14 . The electronic device of claim 13 , wherein the networking subsystem is further configured to complete a handshake with the second electronic device after receiving the response to the keep alive probe.
15 . The electronic device of claim 13 , wherein the networking subsystem is further configured to enable transmission of the keep alive probe in response to determining that a VxLAN cross-connect feature is not enabled.
16 . The electronic device of claim 13 , wherein the networking subsystem is configured to tear down the MACSec session prior to conclusion of the MACSec session in response to not receiving a packet over the MACSec session within a first predetermined time period.
17 . The electronic device of claim 16 , wherein the networking subsystem is further configured to transmit additional keep alive probes at a predetermined interval, where the predetermined interval is longer than the first predetermined time period, and wherein the predetermined interval is configurable.
18 . The electronic device of claim 13 , wherein the networking subsystem is configured to establish the MACSec session over a VxLAN tunnel through the wide area network.