Lecture 141: DX Security - MACSec encryption (Layer2)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：03:59
- 来源：Udemy Lecture 56353841
- Slide 数量：5
- 画面切换：00:17、00:32、00:56、02:23
扫描说明
逐条检查了 Udemy 页面中的 48 条 Transcript cue，并扫描了全长约 3:59 的视频。该讲使用同一张 MACSec 拓扑图逐项渐显，因此按标题、三组功能说明及连接加密模式共划分为 5 个小节。最终截图均在精确 Transcript cue 暂停后将指针移出播放器，隐藏播放器控件并截取完整媒体区域；5 张图片均无黑边、无顶部课程栏、无底部或中心控件，也无右侧或下方裁切，并统一输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. MACSec 二层加密概览
时间范围：00:00–00:17
总结 / Summary
中文
媒体访问控制安全（MAC Security，MACSec）为 AWS Direct Connect（DX）连接提供第 2 层（Layer 2）链路加密，其作用类似第 3 层（Layer 3）的互联网协议安全（IPsec），但工作层次不同。
English
Media Access Control Security (MACsec) provides Layer 2 link encryption for AWS Direct Connect connections. Its purpose resembles Layer 3 IPsec, but it operates at a different layer.
Transcript
00:00 Alright, so now let's talk about the layer 2 encryption that you can apply for your direct
00:05 connect connection and that is called MAC security or MACSEC.
00:10 So this is a different protocol, something similar to the IPSec, but it is at layer 2.
2. IEEE 802.1 安全属性
时间范围：00:17–00:32
总结 / Summary
中文
MACSec 是 IEEE 802.1 标准，可提供数据机密性（Data Confidentiality）、数据完整性（Data Integrity）和数据源真实性（Data Origin Authenticity）。
English
MACsec is an IEEE 802.1 standard that provides data confidentiality, data integrity, and data-origin authenticity.
Transcript
00:17 And because it does the encryption, it provides the standard data confidentiality, data integrity,
00:23 and the data origin authenticity.
00:26 And you can apply this MACSEC security for the dedicated DX connections only and that
3. 支持的连接与带宽
时间范围：00:32–00:56
总结 / Summary
中文
MACSec 只适用于部分 Direct Connect 位置的专用连接（Dedicated Connection），当前支持 10、100 和 400 Gbps；不支持 1 Gbps 或低于 1 Gbps 的托管连接（Hosted Connection）。
English
MACsec is available only for Dedicated Connections at selected Direct Connect locations, currently at 10, 100, and 400 Gbps. It is not supported for 1-Gbps or sub-1-Gbps Hosted Connections.
Transcript
00:32 too at the selected DX locations.
00:35 And as of now, it is supported for 10 Gbps, 100 Gbps and 400 Gbps that is lag direct connection.
00:43 So it is not supported for 1 Gbps or sub 1 Gbps hosted connections.
00:50 Now if you are interested, you can read more about this MACSEC in the AWS documentation.
4. 仅保护 DX 交叉连接链路
时间范围：00:56–02:23
总结 / Summary
中文
MACSec 不是端到端加密（End-to-End Encryption）：它只保护 Direct Connect 位置中客户或合作伙伴路由器与 AWS 路由器之间的物理交叉连接（Cross-Connect）。客户边缘设备（Customer Edge Device）到本地数据中心的链路不在保护范围内，可同时使用站点到站点 VPN（Site-to-Site VPN）的第 3 层加密（Layer 3 Encryption）。
English
MACsec is not end-to-end encryption. It protects only the physical cross-connect between the customer or partner router and the AWS router at the Direct Connect location. The path from the customer edge to the on-premises data center is outside that scope, so a Site-to-Site VPN can be used alongside MACsec for Layer 3 encryption.
Transcript
00:56 But important for you to know is that this MACSEC doesn't really provide end-to-end encryption.
01:04 Though it sounds like that, but if you see this diagram, the MACSEC encryption is applied
01:10 for the traffic between the AWS router and the customer or the partner router at the DX location.
01:18 Because for MACSEC to work, there should be a physical connection between those routers.
01:24 So if you see this, the MACSEC will be just applied for this traffic.
01:29 And which also means that the traffic from this customer edge device to on-premise data
01:34 center will not be encrypted with MACSEC.
01:38 And hence, there you can use then layer 3 encryption in the form of side-to-side VPN
01:43 that we just talked about.
01:45 So you can use both MACSEC as well as side-to-side VPN at the same time.
01:53 Now there is much more about the MACSEC security.
01:55 For example, the different type of the keys it uses for the MACSEC handshake and then
02:00 how these keys are exchanged.
02:03 So there are a lot of internal things about the MACSEC security.
02:06 But good thing is that for your exam, you don't really need to get into that much deeper
02:10 about the MACSEC security.
02:12 Alright, now just one more additional thing about the MACSEC that you should know is that
02:17 when you create the dedicated connection, at that time, you can configure that connection
5. should_encrypt 与 must_encrypt
时间范围：02:23–03:59
总结 / Summary
中文
创建专用连接（Dedicated Connection）时可选择 should_encrypt 或 must_encrypt。默认的 should_encrypt 会尝试完成 MACSec 握手（MACSec Handshake），即使握手失败仍允许未加密流量通过；must_encrypt 则在无法建立加密时阻止流量，因此只应在第 2 层加密（Layer 2 Encryption）为强制要求时使用。
English
A Dedicated Connection can use should_encrypt or must_encrypt. The default should_encrypt attempts the MACsec handshake but still passes unencrypted traffic if negotiation fails. With must_encrypt, traffic is blocked unless encryption is established, so use it only when Layer 2 encryption is mandatory.
Transcript
02:23 with either should encrypt option for MACSEC or must encrypt option for MACSEC.
02:30 Now the default is should encrypt, and which means that MACSEC will try to establish the
02:36 encryption connectivity by the MACSEC handshake, exchanging keys and everything.
02:41 And for some reason, if the handshake fails, or if the encryption cannot be established,
02:46 in that case also the traffic will still go through your direct connect connection.
02:51 So the traffic is not dropped.
02:53 However, if you set this setting to must encrypt, and in case the MACSEC handshake fails, then
03:01 the traffic will not go through your direct connect connection.
03:04 And as you understand, that means the direct connect connection is not useful.
03:09 So only set this to must encrypt, if the traffic must be encrypted at layer two, right.
03:17 So I hope you will remember that.
03:20 Alright, so that's it really about this MACSEC layer two security.
03:24 And with that, let's conclude this topic about the direct connect security.
03:29 And just to recap, there we talked about layer three encryption using the site to site VPN.
03:36 And in there, we talked about two options, the standard site to site VPN, and private
03:40 IP site to site VPN.
03:42 Then for the layer two, there is this MACSEC security, which is available only for dedicated
03:48 direct connect connection at selected direct connect locations, right.
03:53 So I hope you'll remember this.
03:55 And with that, now let's look at the next direct connect topic.
整讲总结 / Overall Summary
中文
媒体访问控制安全（MAC Security，MACSec）为专用 Direct Connect（DX）连接提供 IEEE 802.1 第 2 层加密（Layer 2 Encryption），具备机密性（Confidentiality）、完整性（Integrity）和数据源真实性（Data Origin Authenticity）。它仅支持部分 DX 位置的 10、100 和 400 Gbps 专用连接（Dedicated Connection），并且只保护客户或合作伙伴路由器到 AWS 路由器之间的交叉连接（Cross-Connect），不是端到端加密（End-to-End Encryption）。默认 should_encrypt 在协商失败时继续传输流量，而 must_encrypt 会阻断流量；如需保护其余路径，可叠加站点到站点 VPN（Site-to-Site VPN）。
English
Media Access Control Security (MACsec) supplies IEEE 802.1 Layer 2 encryption for Dedicated Direct Connect connections, providing confidentiality, integrity, and data-origin authenticity. It is supported at selected DX locations for 10-, 100-, and 400-Gbps Dedicated Connections and protects only the cross-connect from the customer or partner router to the AWS router, not the end-to-end path. The default should_encrypt mode keeps traffic flowing if negotiation fails, whereas must_encrypt blocks it. A Site-to-Site VPN can be layered with MACsec to protect the remaining path.