Layer 2 Encryption over IPsec tunnel

[Hg212]

In my scenario I have to encrypt the traffic on Layer 2 & Layer 3. My thinking is MACsec on the core switch up until it hits the ASA, then configure an IPsec tunnel for that subnet to reach the remote site ASA. In theory, the architecture would be as follows: End device -- MacSec capabable cisco switch - - ASA - - DMZSwitch - - router-- etc.

My question is, would this be a viable solution to solve for multiple methods of encryption? 

and also is MACsec available on 3750x models only or is there better hardware out there? any other solutions im missing or not thinking about?

[balaji.bandi]

looks that is a good approach, MAC sec available new hardware platforms like Cat 9K

some good videos for reference :

https://www.youtube.com/watch?v=6ocoC4W6Hf8

[Rob Ingram]

@Hg212 MACSec is hop by hop encryption, between the switches/routers in your network - the ASA does not support MACSec, so the connectivity from the switch to ASA would be cleartext, obviously communication between the ASAs would be an IPSec VPN,

[Marius Gunnerud · Accepted solution]

MACsec is supported on just about all modern Cisco switches.  You can use the Cisco Feature Navigator to lookup your devices or devices you are considering purchasing and see if MACsec is suported on them.

https://cfnng.cisco.com/browse/switching/products

Just be aware that MACsec only encrypts "on-the-wire" so traffic traveling between interfaces on a switch will not be encrypted.