When macsec is enabled, the EAPOL traffic will be punted to the cpu by default, so transit macsec sessions won't work.
Traffic from the transit session will be processed by the switch and not forwarded across:
root@lab> monitor traffic interface xe-0/0/23
verbose output suppressed, use detail. or extensive. for full protocol decode
Address resolution is ON. Use no. to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on xe-0/0/23, capture size 96 bytes
08:44:10.821426 In xx:xx:xx:xx:xx:Xx> xx:xx:xx:xx:xx:Xx, ethertype EAPOL (0x888e), length 74:
08:44:12.866465 In xx:xx:xx:xx:xx:Xx > xx:xx:xx:xx:xx:Xx, ethertype EAPOL (0x888e), length 74:
As a workaround, you can use the filter below to forward the EAP packets:
set firewall family ethernet-switching filter FLOOD_MACSEC term flood from destination-mac-address xx:xx:xx:xx:xx:xx/48
set firewall family ethernet-switching filter FLOOD_MACSEC term flood then flood
set firewall family ethernet-switching filter FLOOD_MACSEC term flood then count macsec-pkt
set firewall family ethernet-switching filter FLOOD_MACSEC term else then accept
set interfaces xe-0/0/x unit 0 family ethernet-switching filter input FLOOD_MACSEC