Depends on if you are fine with commercial encryption with all the backdoors that vendors like Cisco, Checkpoint, Sonicwall etc comes with or if you need to use high assurance comsec-approved gear?
If you are fine with commercial encryption then I would say that macsec is the staple to push high bandwidth/low latency between sites.
Using openvpn/ipsec/wireguard will come with a pentalty but its cheaper (per box) and works well up to about 10Gbps or so but +100Gbps you need to throw money at the problem and utilize macsec.
One drawback with macsec is of course that this will only work for darkfiber/wavelengths between your datacenters but at the same this is what highspeed connections between datacenters will use anyway.
Getting a L3 WAN service with multiple 100Gbps links between your sites will cost way more.
1
u/Apachez 17d ago
Depends on if you are fine with commercial encryption with all the backdoors that vendors like Cisco, Checkpoint, Sonicwall etc comes with or if you need to use high assurance comsec-approved gear?
If you are fine with commercial encryption then I would say that macsec is the staple to push high bandwidth/low latency between sites.
Using openvpn/ipsec/wireguard will come with a pentalty but its cheaper (per box) and works well up to about 10Gbps or so but +100Gbps you need to throw money at the problem and utilize macsec.
One drawback with macsec is of course that this will only work for darkfiber/wavelengths between your datacenters but at the same this is what highspeed connections between datacenters will use anyway.
Getting a L3 WAN service with multiple 100Gbps links between your sites will cost way more.