Skip to content

Commit 2833a66

Browse files
American-DipperAmerican-Dipper
authored
Merge pull request #90982 from cherylmc/charley2
new
2 parents f78e283 + cb80b7c commit 2833a66

File tree

3 files changed

+182
-0
lines changed

3 files changed

+182
-0
lines changed

‎articles/expressroute/TOC.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,8 @@
4444
href: expressroute-erdirect-about.md
4545
- name: About ExpressRoute Global Reach
4646
href: expressroute-global-reach.md
47+
- name: About ExpressRoute encryption
48+
href: expressroute-about-encryption.md
4749
- name: Connect Azure to public cloud
4850
href: expressroute-connect-azure-to-public-cloud.md
4951
- name: Backend Connectivity Interoperability
@@ -121,6 +123,8 @@
121123
href: expressroute-howto-erdirect.md
122124
- name: Azure CLI
123125
href: expressroute-howto-expressroute-direct-cli.md
126+
- name: Configure MACsec for ExpressRoute Direct ports
127+
href: expressroute-howto-macsec.md
124128
- name: Configure route filters for Microsoft peering
125129
items:
126130
- name: Azure portal

‎articles/expressroute/expressroute-about-encryption.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
title: About Encryption - Azure ExpressRoute| Microsoft Docs
3+
description: Learn about ExpressRoute encryption.
4+
services: expressroute
5+
author: cherylmc
6+
7+
ms.service: expressroute
8+
ms.topic: conceptual
9+
ms.date: 10/07/2019
10+
ms.author: cherylmc
11+
12+
---
13+
# ExpressRoute encryption
14+
15+
ExpressRoute supports a couple encryption technologies to ensure confidentiality and integrity of the data traversing between your network and Microsoft's network.
16+
17+
## Point-to-point encryption by MACsec FAQ
18+
MACsec is an [IEEE standard](https://1.ieee802.org/security/802-1ae/). It encrypts data at the Media Access control (MAC) level or Network Layer 2. You can use MACsec to encrypt the physical links between your network devices and Microsoft's network devices when you connect to Microsoft via ExpressRoute Direct. MACsec is disabled on ExpressRoute Direct ports by default. You bring your own MACsec key for encryption and store it in Azure Key Vault. You decide when to rotate the key. See other FAQs below.
19+
### Can I enable MACsec on my ExpressRoute circuit provisioned by an ExpressRoute provider?
20+
No. MACsec encrypts all traffic on a physical link with a key owned by one entity (i.e. customer). Therefore, it's available on ExpressRoute Direct only.
21+
### Can I encrypt some of the ExpressRoute circuits on my ExpressRoute Direct ports and leave other circuits on the same ports unencrypted?
22+
No. Once MACsec is enabled all network control traffic, for example, the BGP data traffic, and customer data traffic are encrypted.
23+
### When I enable/disable MACsec or update MACsec key will my on-premises network lose connectivity to Microsoft over ExpressRoute?
24+
Yes. For the MACsec configuration, we support the pre-shared key mode only. It means you need to update the key on both your devices and on Microsoft's (via our API). This change is not atomic, so you'll lose connectivity when there's a key mismatch between the two sides. We strongly recommend that you schedule a maintenance window for the configuration change. To minimize the downtime, we suggest you update the configuration on one link of ExpressRoute Direct at a time after you switch your network traffic to the other link.
25+
### Will traffic continue to flow if there's a mismatch in MACsec key between my devices and Microsoft's?
26+
No. If MACsec is configured and a mismatch in key occurs, you lose connectivity to Microsoft. In other words, we won't fall back to an unencrypted connection, exposing your data.
27+
### Will enabling MACsec on ExpressRoute Direct degrade network performance?
28+
MACsec encryption and decryption occurs in hardware on the routers we use. There's no performance impact on our side. However, you should check with the network vendor for the devices you use and see if MACsec has any performance implication.
29+
30+
## End-to-end encryption by IPsec FAQ
31+
IPsec is an [IETF standard](https://tools.ietf.org/html/rfc6071). It encrypts data at the Internet Protocol (IP) level or Network Layer 3. You can use IPsec to encrypt an end-to-end connection between your on-premises network and your virtual network (VNET) on Azure. See other FAQs below.
32+
### Can I enable IPsec in addition to MACsec on my ExpressRoute Direct ports?
33+
Yes. MACsec secures the physical connections between you and Microsoft. IPsec secures the end-to-end connection between you and your virtual networks on Azure. You can enable them independently.
34+
### Can I use Azure VPN gateway to set up the IPsec tunnel between my on-premises network and my Azure virtual network?
35+
Yes. You can set up this IPsec tunnel over Microsoft Peering of your ExpressRoute circuit. Follow our [configuration guide](site-to-site-vpn-over-microsoft-peering.md).
36+
### Can I use Azure VPN gateway to set up the IPsec tunnel over Azure Private Peering?
37+
No. You have to deploy a third-party VPN gateway in your Azure virtual network and establish an IPsec tunnel between it and your on-premises VPN gateway.
38+
### What is the throughput I will get after enabling IPsec on my ExpressRoute connection?
39+
If Azure VPN gateway is used, check the [performance numbers here](../vpn-gateway/vpn-gateway-about-vpngateways.md). If a third-party VPN gateway is used, check with the vendor for the performance numbers.
40+
41+
## Next steps
42+
See [Configure MACsec](expressroute-howto-macsec.md) for more information about the MACsec configuration.
43+
44+
See [Configure IPsec](site-to-site-vpn-over-microsoft-peering.md) for more information about the IPsec configuration.

‎articles/expressroute/expressroute-howto-macsec.md

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
---
2+
title: 'Configure MACsec - ExpressRoute: Azure | Microsoft Docs'
3+
description: This article helps you configure MACsec to secure the connections between your edge routers and Microsoft's edge routers.
4+
services: expressroute
5+
author: cherylmc
6+
7+
ms.service: expressroute
8+
ms.topic: conceptual
9+
ms.date: 10/07/2019
10+
ms.author: cherylmc
11+
12+
---
13+
14+
# Configure MACsec on ExpressRoute Direct ports
15+
16+
This article helps you configure MACsec to secure the connections between your edge routers and Microsoft's edge routers using PowerShell.
17+
18+
## Before you begin
19+
20+
Before you start configuration, confirm the following:
21+
22+
* You understand [ExpressRoute Direct provisioning workflows](expressroute-erdirect-about.md).
23+
* You've created an [ExpressRoute Direct port resource](expressroute-howto-erdirect.md).
24+
* If you want to run PowerShell locally, verify that the latest version of Azure PowerShell is installed on your computer.
25+
26+
### Working with Azure PowerShell
27+
28+
[!INCLUDE [updated-for-az](../../includes/updated-for-az.md)]
29+
30+
[!INCLUDE [expressroute-cloudshell](../../includes/expressroute-cloudshell-powershell-about.md)]
31+
32+
### Sign in and select the right subscription
33+
34+
To start the configuration, sign in to your Azure account and select the subscription that you want to use.
35+
36+
[!INCLUDE [sign in](../../includes/expressroute-cloud-shell-connect.md)]
37+
38+
## 1. Create Azure Key Vault, MACsec secrets, and user identity
39+
40+
1. Create a Key Vault instance to store MACsec secrets in a new resource group.
41+
42+
```azurepowershell-interactive
43+
New-AzResourceGroup -Name "your_resource_group" -Location "resource_location"
44+
$keyVault = New-AzKeyVault -Name "your_key_vault_name" -ResourceGroupName "your_resource_group" -Location "resource_location" -EnableSoftDelete
45+
```
46+
47+
If you already have a key vault or a resource group, you can reuse them. However, it is critical that you enable the [**soft-delete** feature](https://docs.microsoft.com/en-us/azure/key-vault/key-vault-ovw-soft-delete) on your existing key vault. If soft-delete is not enabled, you can use the following commands to enable it:
48+
49+
```azurepowershell-interactive
50+
($resource = Get-AzResource -ResourceId (Get-AzKeyVault -VaultName "your_existing_keyvault").ResourceId).Properties | Add-Member -MemberType "NoteProperty" -Name "enableSoftDelete" -Value "true"
51+
Set-AzResource -resourceid $resource.ResourceId -Properties $resource.Properties
52+
```
53+
2. Create a user identity.
54+
55+
```azurepowershell-interactive
56+
$identity = New-AzUserAssignedIdentity -Name "identity_name" -Location "resource_location" -ResourceGroupName "your_resource_group"
57+
```
58+
59+
If New-AzUserAssignedIdentity is not recognized as a valid PowerShell cmdlet, install the following module (in Administrator mode) and rerun the above command.
60+
61+
```azurepowershell-interactive
62+
Install-Module -Name Az.ManagedServiceIdentity
63+
```
64+
3. Create a connectivity association key (CAK) and a connectivity association key name (CKN) and store them in the key vault.
65+
66+
```azurepowershell-interactive
67+
$CAK = ConvertTo-SecureString "your_key" -AsPlainText -Force
68+
$CKN = ConvertTo-SecureString "your_key_name" -AsPlainText -Force
69+
$MACsecCAKSecret = Set-AzKeyVaultSecret -VaultName "your_key_vault_name" -Name "CAK_name" -SecretValue $CAK
70+
$MACsecCKNSecret = Set-AzKeyVaultSecret -VaultName "your_key_vault_name" -Name "CKN_name" -SecretValue $CKN
71+
```
72+
4. Assign the GET permission to the user identity.
73+
74+
```azurepowershell-interactive
75+
Set-AzKeyVaultAccessPolicy -VaultName "your_key_vault_name" -PermissionsToSecrets get -ObjectId $identity.PrincipalId
76+
```
77+
78+
Now this identity can get the secrets, for example CAK and CKN, from the key vault.
79+
5. Set this user identity to be used by ExpressRoute.
80+
81+
```azurepowershell-interactive
82+
$erIdentity = New-AzExpressRoutePortIdentity -UserAssignedIdentityId $identity.Id
83+
```
84+
85+
## 2. Configure MACsec on ExpressRoute Direct ports
86+
87+
### To enable MACsec
88+
89+
Each ExpressRoute Direct instance has two physical ports. You can choose to enable MACsec on both ports at the same time or enable MACsec on one port at a time. Doing it one port at time (by switching traffic to an active port while servicing the other port) can help minimize the interruption if your ExpressRoute Direct is already in service.
90+
91+
1. Set MACsec secrets and cipher and associate the user identity with the port so that the ExpressRoute management code can access the MACsec secrets if needed.
92+
93+
```azurepowershell-interactive
94+
$erDirect = Get-AzExpressRoutePort -ResourceGroupName "your_resource_group" -Name "your_direct_port_name"
95+
$erDirect.Links[0]. MacSecConfig.CknSecretIdentifier = $MacSecCKNSecret.Id
96+
$erDirect.Links[0]. MacSecConfig.CakSecretIdentifier = $MacSecCAKSecret.Id
97+
$erDirect.Links[0]. MacSecConfig.Cipher = "gcm-aes-128"
98+
$erDirect.Links[1]. MacSecConfig.CknSecretIdentifier = $MacSecCKNSecret.Id
99+
$erDirect.Links[1]. MacSecConfig.CakSecretIdentifier = $MacSecCAKSecret.Id
100+
$erDirect.Links[1]. MacSecConfig.Cipher = "gcm-aes-128"
101+
$erDirect.identity = $erIdentity
102+
Set-AzExpressRoutePort -ExpressRoutePort $erDirect
103+
```
104+
2. (Optional) If the ports are in Administrative Down state you can run the following commands to bring up the ports.
105+
106+
```azurepowershell-interactive
107+
$erDirect = Get-AzExpressRoutePort -ResourceGroupName "your_resource_group" -Name "your_direct_port_name"
108+
$erDirect.Links[0].AdminState = “Enabled”
109+
$erDirect.Links[1].AdminState = “Enabled”
110+
Set-AzExpressRoutePort -ExpressRoutePort $erDirect
111+
```
112+
113+
At this point, MACsec is enabled on the ExpressRoute Direct ports on Microsoft side. If you haven't configured it on your edge devices, you can proceed to configure them with the same MACsec secrets and cipher.
114+
115+
### To disable MACsec
116+
117+
If MACsec is no longer desired on your ExpressRoute Direct instance, you can run the following commands to disable it.
118+
119+
```azurepowershell-interactive
120+
$erDirect = Get-AzExpressRoutePort -ResourceGroupName "your_resource_group" -Name "your_direct_port_name"
121+
$erDirect.Links[0]. MacSecConfig.CknSecretIdentifier = $null
122+
$erDirect.Links[0]. MacSecConfig.CakSecretIdentifier = $null
123+
$erDirect.Links[1]. MacSecConfig.CknSecretIdentifier = $null
124+
$erDirect.Links[1]. MacSecConfig.CakSecretIdentifier = $null
125+
$erDirect.identity = $null
126+
Set-AzExpressRoutePort -ExpressRoutePort $erDirect
127+
```
128+
129+
At this point, MACsec is disabled on the ExpressRoute Direct ports on the Microsoft side.
130+
131+
## Next steps
132+
1. [Create an ExpressRoute circuit on ExpressRoute Direct](expressroute-howto-erdirect.md)
133+
2. [Link an ExpressRoute circuit to an Azure virtual network](expressroute-howto-linkvnet-arm.md)
134+
3. [Verify ExpressRoute connectivity](expressroute-troubleshooting-expressroute-overview.md)

0 commit comments

Comments
 (0)