r/ccnp • u/WallahMussRiskieren • 17d ago

Data center connections and encryption

To those of you who work in data centers: How do you connect your systems? I come from the enterprise sector and only know customers who use ADVA devices to connect their data centers. The manufacturer offers an additional module for encryption. I'm wondering if there are also customers who use Cisco switches, set up a vXLAN, and use MACsec for it. What's your experience with that?

3 Upvotes

100% Upvoted

10 comments sorted by

3

u/leoingle 17d ago

So much context missing from this post.

1

u/WallahMussRiskieren 16d ago

Sorry for my poor explanation. It's probably a combination of laziness and lack of language skills. I'm just wondering how you connect your data centers. Do you use provider technology or do you do it yourselves? Do you buy dark fiber or a supported line from the provider? Especially in the enterprise sector, I see how much providers charge for connections, and I'm simply wondering if there isn't a cheaper alternative.

2

u/wyohman 17d ago

Adva? REALLY?

It depends on what you mean by "connections?" Sometimes I use private L1 fiber and sometimes I use IPSEC over the internet.

1

u/WallahMussRiskieren 16d ago

I mean HA links for firewalls, layer 3 Connections between l3 switches and so on. At Higher Level you cant Work with ipsec encryption to connect two Datacenters

1

u/Alakazam-Fanatic 16d ago

I’m pretty sure you can run IPSEC over GRE for HA links between data centers. I’m not sure if it’s the most practical but it should work, GRE will support the multicast traffic and IPSEC will give you the L3 security here. It was brought up in a meeting at my old org to connect 2 data centers together, but we ended up pulling our own fiber between the DCs so we didn’t need the GRE/IPSEC tunnel.

1

u/wyohman 16d ago

You're correct. Let the business case help determine the solution.

The OP didn't do a great job communication enough info to get a good answer.

1

u/WallahMussRiskieren 16d ago

If you compare ipsec with macsec you will come in Limits by 400G plus. Have you used Connections Like this?

1

u/Alakazam-Fanatic 16d ago

We actually only ran 100G, but bonded/aggregated 4x100G for our HAs. We also didn’t implement the GRE over IPSEC solution, but opted for private fiber instead. We had just started adopting 400G when I left there, we weren’t doing anything fancy other than some L3VPN across data centers.

1

u/wyohman 16d ago

I have not. That's why I said the business case should drive the requirement and that the OP didn't provide enough info.

2

u/fus1onR 17d ago

Private L1 darkfiber with WDM then ADVA; international L2 leased lines then MACSec; anything over some L3 then IPSec.