BACKGROUND

Media access control security (MACsec) is a security standard, defined by the Institute of Electrical and Electronics Engineers (IEEE) 802.1AE, that defines connectionless data confidentiality and integrity for media access independent protocols. The MACsec standard specifies a set of protocols to meet security requirements for protecting data traversing Ethernet local area networks (LANs). MACsec allows unauthorized LAN connections to be identified and excluded from communication within the network, and defines a security infrastructure to provide data confidentiality, data integrity, and data origin authentication.

SUMMARY

According to some implementations, a network device may include one or more memories, and one or more processors, communicatively coupled to the one or more memories, to establish a media access control security (MACsec) key agreement (MKA) session with another network device via a MACsec communication link; establish a fast heartbeat session via the MACsec communication link, between a first packet processing engine of the network device and a second packet processing engine of the other network device, where the fast heartbeat session is to permit the first packet processing engine and the second packet processing engine to exchange fast heartbeat messages via the fast heartbeat session and the MACsec communication link; place an MKA protocol of the MKA session in a pause state until the first packet processing engine detects a rekey event, where the first packet processing engine, when the MKA protocol is in the pause state, is to: cause an MKA daemon of the network device to suspend transmission of MKA packet data for the MKA session, and cause the MKA daemon to suspend a timeout timer associated with the MKA session; determine that a key for the MKA session is to be regenerated based on detection of the rekey event; and perform an action based on the rekey event for the MKA session.

According to some implementations, a non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a network device, cause the one or more processors to establish a media access control security (MACsec) key agreement (MKA) session with another network device via a MACsec communication link; establish a fast heartbeat session via the MACsec communication link, between a first packet processing engine of the network device and a second packet processing engine of the other network device, where the fast heartbeat session is to permit the first packet processing engine and the second packet processing engine to exchange fast heartbeat messages via the fast heartbeat session and the MACsec communication link; place an MKA protocol of the MKA session in a pause state, where the first packet processing engine, when the MKA protocol is in the pause state, is to cause an MKA daemon of the network device to suspend transmission of MKA packet data for the MKA session, and cause the MKA daemon to suspend a timeout timer associated with the MKA session; detect a rekey event associated with the MKA session; determine that a key for the MKA session is to be regenerated based on detecting the rekey event; and perform an action based on the rekey event for the MKA session, the action including placing the MKA protocol in an active state.

According to some implementations, a method may include establishing, by a network device, a media access control security (MACsec) key agreement (MKA) session with another network device via a MACsec communication link; establishing, by the network device, a fast heartbeat session via the MACsec communication link, where the fast heartbeat session is to permit the network device and the other network device to exchange fast heartbeat messages via the fast heartbeat session and the MACsec communication link; and placing, by the network device, an MKA protocol of the MKA session in a pause state until a rekey event is detected; suspending, by the network device and after the MKA protocol is placed in the pause state, transmission of MKA packet data for the MKA session; and suspending, by the network device, a timeout timer associated with the MKA session.

