Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
A system architecture diagram showing Azure Key Vault providing MACsec keys to an ExpressRoute Direct port via a managed identity, which establishes a Layer 2 encrypted tunnel to the Microsoft edge where BGP and ARP validate connectivity.
MACsec (Media Access Control Security) is a data-link layer encryption that protects data traveling between an on-premises network and Microsoft's network over ExpressRoute Direct by encrypting the entire frame, creating a secure tunnel.
The MACsec secrets, the Connectivity Association Key (CAK) and Connectivity Association Key Name (CKN), are stored in Azure Key Vault. A user-assigned managed identity with read permission is linked to the ExpressRoute port, allowing Azure to retrieve the keys automatically.
For 40 Gbps or faster ports, you should choose the XPN cipher variants, GcmAesXpn128 or GcmAesXpn256, as they prevent session drops during heavy traffic.
You verify MACsec is working by checking that BGP sessions and ARP resolution are established, as both require correct encryption. You can also capture packets on your edge devices to confirm data is encrypted and monitor Azure Monitor metrics for encryption health.
MACsec stands for Media Access Control Security, and it protects data as it travels between your on-premises network and Microsoft's network over ExpressRoute Direct. Unlike encryption that happens at higher layers (like TLS), MACsec works at the data-link layer (Layer 2), which means it encrypts the entire frame before it leaves your router and decrypts it only when it reaches Microsoft's edge. This creates a secure tunnel that hides your traffic from anyone who might intercept it on the physical connection between your equipment and Azure.
To use MACsec, you need two secret values: the Connectivity Association Key (CAK) and the Connectivity Association Key Name (CKN). These act like a password and its identifier. You store both secrets in Azure Key Vault, which keeps them safe and controls who can access them. Next, you create a user-assigned managed identity and give it permission to read the secrets from the vault. This identity is then linked to your ExpressRoute port, allowing Azure to retrieve the keys automatically when it needs to encrypt or decrypt traffic.
A cipher determines how the encryption math works, and ExpressRoute Direct supports different options depending on your port speed. For 10 Gbps ports, you can choose either GcmAes128 or GcmAes256, where the number refers to how long the encryption key is (128 or 256 bits). For 40 Gbps or faster ports, you have additional options called XPN variants: GcmAesXpn128 and GcmAesXpn256. The XPN ciphers prevent session drops during heavy traffic, so choose these when running at higher speeds.
You configure MACsec using PowerShell, Azure CLI, or an ARM template by updating the MacSecConfig properties on each ExpressRoute port. You provide the secret identifiers from Key Vault (pointing to your CAK and CKN) and specify which cipher to use. After setting these values, you apply the changes with Set-AzExpressRoutePort. If the port shows as Administrative Down, you must set AdminState = "Enabled" and turn on the Secure Channel Identifier with SciState = "Enabled" to bring the link online with encryption active. To disable MACsec later, you clear the secret identifiers and remove the managed identity, which immediately turns off encryption on the Microsoft side of the connection.
Once MACsec is running, you verify it works by checking your BGP sessions and ARP resolution. BGP relies on neighbors being reachable, and ARP resolves IP addresses to hardware addresses—both require the encryption to be working correctly. If the CAK, CKN, or cipher settings mismatch between your router and Microsoft, ARP and BGP will fail to establish, and no traffic will flow. For deeper verification, you can capture packets on your own edge devices to confirm data is encrypted, and you can monitor Azure Monitor metrics to track encryption health and spot any failures before they affect users.
StudyCerts
StudyCerts