> ## Documentation Index
> Fetch the complete documentation index at: https://docs.megaport.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Using MACsec with Megaport

> This help topic describes how to use MACsec encryption with Megaport services

export const Anchor = ({name}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Anchor -';
  if (name === undefined || name === null || name === 'undefined') {
    console.error(`${errorPrefix} \`name\` must have a value — rendering an empty string instead`);
    return <></>;
  }
  const raw = typeof name === 'string' ? name : JSON.stringify(name);
  const id = raw.replace(/\s+/g, '-').replace(/[^A-Za-z0-9_-]/g, '').replace(/-+/g, '-').replace(/^-+|-+$/g, '');
  if (!id) {
    console.error(`${errorPrefix} \`name\` "${name}" sanitizes to an empty id — rendering an empty string instead`);
    return <></>;
  }
  return <a style={{
    scrollMarginTop: 'var(--scroll-mt)'
  }} id={id}></a>;
};

export const Gloss = ({term, anchor, langDir = 'en'}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Gloss -';
  if (typeof term !== 'string') {
    term = String(term);
  }
  if (typeof anchor !== 'string') {
    anchor = String(anchor);
  }
  if (!term || term === 'undefined') {
    console.error(`${errorPrefix} the \`term\` property is required — rendering an empty string instead`);
    return <></>;
  }
  if (!anchor || anchor === 'undefined') {
    console.error(`${errorPrefix} the \`anchor\` property is required — rendering an empty string instead`);
    return <></>;
  }
  const lang = langDir === 'en' ? '/' : '/' + langDir + '/';
  const glossaryPage = lang + 'glossary/#' + anchor;
  return <a href={glossaryPage}>{term}</a>;
};

export const Image = ({src, alt = '', caption, width, height, shadow}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Image -';
  if (typeof src !== 'string') {
    src = String(src);
  }
  if (!src || src === 'undefined') {
    console.error(`${errorPrefix} \`src\` is required — rendering an empty string instead`);
    return <></>;
  }
  const img = <img className={['mega-image-style', shadow ? 'shadow' : ''].join(' ')} src={src} alt={alt} width={width} height={height} style={{
    display: 'block'
  }} />;
  return caption ? <figure>
      {img}
      <figcaption style={{
    textAlign: 'center',
    width
  }}>{caption}</figcaption>
    </figure> : img;
};

<Gloss term="MACsec" anchor="macsec" /> encrypts traffic at the Ethernet layer between devices connected by a layer 2 path, and is often implemented in hardware. The use of dedicated hardware means that MACsec can maintain wire-speed performance while providing strong security. This makes it suitable for environments that require high throughput, such as data centers and high-performance computing networks.

<Anchor name="tagged-or-untagged-vxc" />

## Using tagged or untagged VXCs

MACsec-encrypted traffic can be carried transparently over untagged VXCs, or over tagged VXCs when the VLAN is not encrypted.\
Some equipment does not support unencrypted VLANs. Check whether the equipment you use supports unencrypted VLANs, also known as <Gloss term="802.1Q" anchor="8021q" /> clear tag mode, before using MACsec-encrypted traffic over tagged VXCs.

<Note>
  Most Cloud Service Providers (CSP) support MACsec from 10 Gbps or above (10 Gbps or 100 Gbps). Check with your Cloud Service Provider. Megaport supports both 10 Gbps and 100 Gbps options.
</Note>

## Creating a customer-to-customer encrypted connection

You can use a MACsec connection between two of your own devices using Megaport services.

**Prerequisites**

To create a MACsec-encrypted link between two of your own devices, you need:

* MACsec capable customer equipment, for example, a switch or router, at each end.
* Two Megaport Ports.
  * One in a location where you can create a physical cross connect to your first MACsec capable device.
  * One in a location where you can create a physical cross connect to your second MACsec capable device.

**To create a customer-to-customer encrypted connection**

1. From your first MACsec capable device, create a physical link to the first Port.
2. From your second MACsec capable device, create a physical link to the second Port
3. Create an untagged VXC to connect your first Port to your second Port. For more information, see [Using tagged or untagged VXCs](#tagged-or-untagged-vxc).
4. Configure MACsec on your devices, on the interfaces connected to Megaport.

The connection will be MACsec-encrypted between your devices.

<Image src="/images/encryption/macsec-customer-customer.png" alt="MACsec customer to customer diagram. This image shows the structure of a MACsec encryption connection from the customer with a MACsec capable switch through a physical connection to a Megaport Port. This is connected to another Megaport Port via a Virtual Cross Connect (VXC). The second Megaport Port is connected via a physical connection to the customer's second MACsec capable switch.  " shadow={true} width={800} />

## Creating a customer-to-cloud encrypted connection

You can use a MACsec connection between your device and a CSP using Megaport services.

**Prerequisites**

To create a MACsec-encrypted link from customer to cloud, you need:

* MACsec capable customer equipment, for example, a switch or router.
* Two Megaport Ports.
  * One in a location where you can create a physical cross connect to your MACsec capable router.
  * One in a location where you can create a physical cross connect to the cloud onramp.
* A dedicated connection service from your cloud provider. For example, AWS Dedicated Direct Connect, or ExpressRoute Direct.

**To create a customer-to-cloud encrypted connection**

1. From your MACsec capable device, create a physical cross connect to the first Megaport Port.
2. Create a physical link from the second Port to the CSP onramp, which is ExpressRoute in this case. You will need to contact your Megaport account team for this step.
3. Create an untagged VXC to connect your first Port to your second Port. For more information, see [Using tagged or untagged VXCs](#tagged-or-untagged-vxc).
4. Configure MACsec on the CSP service and on your device.

The connection will be MACsec-encrypted from the MACsec capable router through to the ExpressRoute Direct Circuit.

<Image src="/images/encryption/macsec-customer-cloud.png" alt="MACsec customer to customer diagram. This image shows the structure of a MACsec encryption connection from the customer with a MACsec capable switch through a physical connection to a Megaport Port. This is connected to another Megaport Port via a Virtual Cross Connect (VXC). The second Megaport Port is connected via a physical connection to an ExpressRoute Direct connection.  " shadow={true} width={700} />

## Creating a cloud-to-cloud encrypted connection

You can use a MACsec connection between cloud providers using Megaport services.

**Prerequisites**

Before creating a MACsec-encrypted link from cloud to cloud, you need:

* Dedicated connection services from your cloud providers. For example, AWS Direct Connect or ExpressRoute Direct.
* Two Megaport Ports.
  * One in a location where you can create a physical cross connect to your first cloud connection.
  * One in a location where you can create a physical cross connect to your second cloud connection.

**To create a cloud-to-cloud encrypted connection**

This example describes a MACsec connection from AWS Direct Connect to Azure ExpressRoute.

1. Create a physical connection from your dedicated AWS Direct Connect to your first Megaport Port. You will need to contact your Megaport account team for this step.

2. Create a physical connection from your second Megaport Port to your Azure ExpressRoute Direct. You will need to contact your Megaport account team for this step.

3. Create a tagged or untagged VXC to connect your Ports.\
   For more information, see [Using tagged or untagged VXCs](#tagged-or-untagged-vxc).

The MACsec-encrypted connection will persist from the dedicated Direct Connect through to the ExpressRoute Direct Circuit.

<Image src="/images/encryption/macsec-cloud-cloud.png" alt="MACsec cloud to cloud diagram. This image shows the structure of a MACsec encryption connection from a dedicated  AWS Direct Connect through a physical connection to a Megaport Port. This is connected to another Megaport Port via a Virtual Cross Connect (VXC). The second Megaport Port is connected via a physical connection to an ExpressRoute Direct connection.  " shadow={true} width={700} />

## Helpful references

* [Comparing Encryption in Transit Options](https://www.megaport.com/blog/comparing-encryption-in-transit-options/)
* [Creating a Port](/connections/creating-port)
* [Creating a VXC](/connections/overview#creating-a-vxc)
* [Technical Specifications](/tech-specs)
* [Using Encryption in Transit with Megaport Services](/encryption)