Does MACsec for Cloud Interconnect actually encrypt traffic or not?

[anlex_N]

MACsec for Cloud Interconnect overview have two statements:

1. MACsec for Cloud Interconnect doesn't provide encryption in transit within Google.

2. The following diagrams show how MACsec encrypts traffic

This docs is generated by AI/Machine?

Everyone and @DarwinVinoth 

[kensan]

Hi @anlex_N,

Welcome to Google Cloud Community.

No, the public documentation for Google Cloud is not generated by AI or Machine. It is written, reviewed and maintained by the professionals like Technical Writers and Engineers who work together to create accurate and helpful documentation.

MACsec is a layer 2 security and primary purpose is to secure the connection between your on-premise network and Google’s network. MACsec encryption's job is to protect the traffic on physical attacks (i.e. wiretapping, Data Injection etc.) before entering the Google Network. Once the traffic is decrypted on Google's peering edge the MACsec job is completed. Thus, the statement “MACsec for Cloud Interconnect doesn't provide encryption in transit within Google” is correct. And same with the diagram shown in the documentation where MACsec encryption is located in between the Google peering edge and On-premises router or Service provider peering edge.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.

[anlex_N]

Hello, @kensan . If I use MACsec for Cloud Interconnect, I don't need to use HA VPN over Cloud Interconnect. right?

[DarwinVinoth]

If you use MACsec with Cloud Interconnect, it provides encryption at Layer 2 directly on the physical connection between your on-premises router and Google’s edge router. This secures the traffic on the dedicated link.

Using HA VPN over Cloud Interconnect in addition to MACsec is not strictly required for securing the link because MACsec already ensures encryption and integrity on the physical path.

However, here’s the key difference:

• MACsec:

  • Protects Layer 2 link (physical security of the connection).

  • Does not provide site-to-site failover or path redundancy beyond the physical link.

  • No overlay encryption beyond the direct interconnect.

• HA VPN:

  • Protects Layer 3 traffic with IPsec encryption.

  • Provides redundancy and failover across Google’s global network.

  • Adds an additional security layer at the IP level.