Category: Cryptography & Encryption
IPsec / MACsec
Also known as: IPsec / MACsec, Internet Protocol Security, Media Access Control Security, IEEE 802.1AE
Simply put
IPsec and MACsec are two distinct network security technologies used to protect data as it travels across networks, and they differ mainly in where they operate. IPsec generally secures traffic at the network layer, making it commonly used for VPNs and encryption across larger IP-based networks, while MACsec generally secures traffic at the data link layer over direct Ethernet links. Because they operate at different layers and address different scopes, they are not interchangeable, and the appropriate choice depends on what is being protected and where.
Formal definition
IPsec is a security protocol suite that operates at the network layer (OSI Layer 3), providing encryption and integrity protection for IP traffic and commonly used in most implementations to establish VPNs and secure large-scale IP networks. MACsec (Media Access Control Security) is a Layer 2 (data link layer) security protocol standardized by the IEEE as 802.1AE, operating on Ethernet frames to secure point-to-point or hop-by-hop Ethernet links, and per the cited evidence can achieve near-line-rate performance with minimal latency impact. The principal distinction is the OSI layer at which each operates: MACsec protects individual Ethernet links while IPsec protects routed IP communications. According to the evidence, MACsec is often described as easier to set up and manage than an IPsec VPN, though selection should be driven by the protection scope, topology, and performance requirements of the specific deployment. This entry does not address protocol version details, cipher suites, key management specifics (such as MKA for MACsec or IKE for IPsec), or federal control-baseline and authorization requirements; readers should verify implementation and compliance specifics against current authoritative sources.
Why it matters
For defense and public sector networks, the decision between IPsec and MACsec is not a matter of preference but of matching the protection to the scope and topology of the traffic being secured. Because the two operate at different layers of the OSI model, choosing the wrong one can leave gaps in coverage or impose performance penalties that do not fit the mission. IPsec generally protects routed IP communications across larger networks and is commonly used to establish VPNs, while MACsec generally protects individual Ethernet links at the data link layer. Treating them as interchangeable is a common mistake that an experienced network security engineer would correct: they address different scopes and are frequently deployed together rather than as substitutes.
Who it's relevant to
Network and Infrastructure Engineers
Engineers designing or operating agency and defense networks need to select the protocol that matches the layer and scope of what they are protecting. MACsec is generally suited to securing individual Ethernet links with minimal latency impact, while IPsec generally suits encryption across larger routed IP networks such as VPNs. In many environments the two are deployed together rather than as alternatives, so understanding the layer distinction is essential to designing coverage without gaps.
Information System Security Managers and Authorizing Officials
ISSMs and AOs evaluating how data-in-transit protection is implemented should understand that IPsec and MACsec address different scopes and are not interchangeable. This entry describes the technologies at a conceptual level and does not address federal control-baseline or authorization requirements; readers should confirm how a given deployment maps to applicable control families and impact levels against current authoritative sources.
Compliance Officers and Auditors
Those reviewing network security documentation should verify that stated data-in-transit protections align with the actual traffic scope and topology. This entry does not cover cipher suites, key management (such as MKA for MACsec or IKE for IPsec), protocol version details, or contractual and control-baseline specifics, all of which must be validated against current official sources rather than assumed from the presence of a protocol name alone.
Inside IPsec / MACsec
IPsec (Internet Protocol Security)
A suite of protocols that provides confidentiality, integrity, and authentication for IP traffic operating at the network layer (Layer 3). It can secure communications across routed networks, including traffic traversing untrusted intermediate networks, and is commonly implemented in gateway-to-gateway (site-to-site) and host-to-gateway configurations.
MACsec (Media Access Control Security)
A standard that provides confidentiality, integrity, and authentication for traffic on a single Ethernet link at the data link layer (Layer 2). It generally protects communications hop-by-hop between directly connected devices rather than end-to-end across routed networks.
Layer of operation distinction
IPsec operates at Layer 3 and can protect traffic across multiple network hops, while MACsec operates at Layer 2 and typically secures an individual link between adjacent nodes. This difference determines where each is appropriate within a given architecture.
Security services provided
Both technologies can offer confidentiality (encryption), integrity, and authentication of transmitted data. The specific services enabled depend on configuration, negotiated parameters, and the applicable revision of the underlying standards.
Relationship to protection requirements
IPsec and MACsec are among the mechanisms that may be used to satisfy transmission protection objectives, such as protecting the confidentiality and integrity of information in transit. The suitability of a given mechanism depends on the system's architecture, data sensitivity, and applicable control baseline or tailoring.
Common questions
Answers to the questions practitioners most commonly ask about IPsec / MACsec.
Are IPsec and MACsec interchangeable ways to encrypt network traffic?
No. Although both provide cryptographic protection for data in transit, they operate at different layers of the network stack and are not interchangeable. IPsec generally operates at the network layer (Layer 3) and protects IP traffic, which allows it to secure communications across routed networks and over untrusted intermediaries such as the public internet. MACsec generally operates at the data link layer (Layer 2) and protects traffic on a point-to-point or hop-by-hop basis between directly connected devices. Because MACsec protection is applied per link, it does not by itself provide end-to-end protection across routed hops the way an IPsec tunnel can. Selecting between them depends on your topology and the protection boundary you need; confirm the specific requirement against the applicable control baseline and your system security plan.
Does deploying IPsec or MACsec by itself make a system compliant with encryption-in-transit requirements?
Not necessarily. Deploying a protocol is not the same as satisfying a compliance requirement, and compliance is not the same as security. Many federal and defense requirements for protecting data in transit are tied to the use of validated cryptography, meaning the underlying cryptographic modules generally must be validated under the applicable FIPS process rather than simply configured to use strong-sounding algorithms. The specific requirement also depends on the data category (for example, CUI versus national security systems), the applicable control set, and any agency or contractual tailoring. Enabling IPsec or MACsec is a means of implementing a control, but you must confirm the configuration meets the governing requirement as stated in the current authoritative text and as documented in your authorization package.
When would I choose IPsec over MACsec for a given network segment?
In most implementations, IPsec is chosen when traffic must traverse routed networks or untrusted intermediaries and you need protection that persists across multiple hops, such as connecting sites over a wide-area or public network. MACsec is more commonly chosen to protect traffic on individual physical links within a controlled environment, such as between switches or between a host and an adjacent switch in a data center. The decision should be driven by where your protection boundary lies, your topology, performance considerations, and the specific control requirement applicable to the information being protected. Document the rationale in your system security plan and verify it against your authorizing official's expectations.
How does the choice between IPsec and MACsec affect what my auditor or assessor will review?
An assessor generally reviews whether the implemented protection actually enforces the required protection boundary and whether the cryptography used is validated as required by the applicable baseline. For IPsec, this typically includes examining tunnel configurations, key management, algorithm selection, and the validation status of the cryptographic modules. For MACsec, the review typically focuses on which links are protected, key agreement configuration, and whether hop-by-hop protection covers the intended segments. Keep in mind that assessment is distinct from authorization; a favorable assessment supports but does not by itself grant an Authority to Operate. Confirm evidence expectations with your assessor against the current guidance.
Can MACsec protection cover an entire routed path end to end?
Generally no, because MACsec provides protection on a per-link basis between directly connected devices rather than across an entire routed path. On a path that includes multiple routed hops, traffic is typically decrypted and re-encrypted at each MACsec-protected link, meaning the data may be exposed within intermediate devices between links. If your requirement is end-to-end protection across a routed path or untrusted intermediaries, an approach such as IPsec is more commonly appropriate. Determine whether your control requirement calls for hop-by-hop or end-to-end protection before selecting a mechanism, and verify against the applicable requirement text.
What should I document about IPsec or MACsec in my system security plan?
In most implementations you should document which control or controls the mechanism is intended to satisfy, the scope of protection (which links, segments, or communication paths are covered), the cryptographic algorithms and modes in use, the validation status of the cryptographic modules where validated cryptography is required, and the key management approach. You should also note any residual exposure, such as points where traffic is decrypted, and how continuous monitoring will confirm the protection remains effective over time. Because control baselines and tailoring vary by revision and by agency, confirm the specific documentation expectations against the current authoritative guidance and your authorizing official's requirements.
Common misconceptions
IPsec and MACsec are interchangeable and one can simply be substituted for the other.
They operate at different layers and protect different scopes. IPsec protects traffic across routed networks at Layer 3, while MACsec protects an individual Ethernet link at Layer 2 on a hop-by-hop basis. The appropriate choice depends on the architecture and the protection objective, and in some designs the two are complementary rather than substitutes.
MACsec provides end-to-end protection for traffic traversing a network.
MACsec generally secures traffic only on a single link between directly connected devices. Traffic crossing multiple hops is typically protected on a per-link basis, so MACsec alone does not inherently provide end-to-end protection across a routed path.
Deploying IPsec or MACsec by itself makes a system compliant with transmission protection requirements.
Encryption technology is one implementation choice, not a compliance determination. Whether a specific deployment satisfies applicable transmission confidentiality and integrity controls depends on configuration, the governing baseline and any tailoring, and assessment against the current authoritative requirements. Practitioners should verify against the applicable official sources rather than assuming the technology alone establishes compliance.
Best practices
Select IPsec or MACsec based on the layer and scope of protection required: use IPsec for protecting traffic across routed, multi-hop networks and MACsec for securing individual Ethernet links between directly connected devices.
Map the chosen mechanism to the specific transmission confidentiality and integrity objectives it is intended to satisfy, and confirm the mapping against the applicable control baseline and any agency-specific tailoring.
Confirm that configuration enables the intended security services (confidentiality, integrity, and authentication), since these depend on how the technology is deployed rather than being guaranteed by default.
Recognize that MACsec typically protects only a single link; where end-to-end protection is required across multiple hops, evaluate whether IPsec or a layered combination of mechanisms is needed.
Do not treat deployment of these technologies as evidence of compliance on its own; validate implementations through assessment against the current authoritative requirements.
Verify parameters, supported services, and applicability against the current applicable revisions of the relevant standards and official guidance rather than relying on prior configurations or assumptions.