MACsec SAs re-created During RE Mastership Switchover on MX10004

• MACsec Security Associations (SAs) are observed to be re-created during RE mastership switchover.
• No impact to:
  • Data plane traffic (no packet loss)
  • Control plane stability
  • Hardware health
• System remains stable with no interface flaps or alarms.

Example command to verify MKA session details: show security mka sessions interface <interface> detail

Key indicators:

• Change in Association Number (AN)
• New SAK (Secure Association Key) observed
• Stable peer connectivity and uptime

For example:

admin@root> show security mka sessions interface et-2/0/0:0 detail
Interface state: Secured - Primary
Ether-type profile: default - 0x888e
Member identifier: 9BB3036096D1F0436E0XXXX
CAK name: 111111111111111111111111111111111111111111111111111111111111XXXX
Security mode: static
MKA suspended: 0(s)
Transmit interval: 2000(ms)
SAK rekey interval: 0(s)
Preceding Key: enabled
Bounded Delay: disabled
Outbound SCI: B4:F9:5D:99:XX:XX/1
Message number: 1186 Key number: 0
MKA ICV Indicator: enabled
Key server: no Key server priority: 0
Latest SAK AN: 1 Latest SAK KI: 53342DF0B2D392319F45XXXX/21
Previous SAK AN: 0 Previous SAK KI: 000000000000000000000000/0
MKA Suspend For: enabled MKA Suspend On Request: enabled
CAK list: (2)
1. CAK name: 111111111111111111111111111111111111111111111111111111111111XXXX
CAK type: primary Status: live
Member identifier: 9BB3036096D1F0436E0XXXX Message number: 1186
Peer list: (1)
1. Member identifier: 53342DF0B2D392319F45XXXX (live)
Message number: 250569 Hold time: 6000 (ms)
SCI: 2C:DD:E9:9D:XX:XX/1 Uptime: 00:39:27
Lowest acceptable PN: 0
2. CAK name: 222222222222222222222222222222222222222222222222222222222222XXXX
CAK type: fallback Status: active
Member identifier: BF7DF948CA81369B7A8AXXXX Message number: 1182
Peer list: (1)
1. Member identifier: 4DE38942C7E47ACDE2FCXXXX (live)
Message number: 250529 Hold time: 5000 (ms)
SCI: 2C:DD:E9:9D:XX:XX/1 Uptime: 00:39:20
Lowest acceptable PN: 0

• Verify if AN (Association Number) changes post switchover
• Correlate timestamps of:
  • RE switchover
  • SA re-creation event
• Check if MKA daemon restarts
• Validate whether SAK is being re-negotiated internally
• Review session and host logs during the switchover window

Additionally, you can check the output of below commands:

1. > show interfaces et-2/0/0 extensive
2. > show log messages | match kmd
3. > show log messages | match mka
4. > show log messages | match macsec
5. > show interfaces et-2/0/0 extensive | match flap
6. > show log messages | match -i mka OR > show log messages | match -i macsec

After comprehensive log analysis and validation in a lab environment, it has been determined that the observed behavior—MACsec Security Association (SA) re-creation during Routing Engine (RE) switchover is expected. Following an RE switchover, new MACsec SAs are typically established as part of the recovery process.

In our scenario, SA re-creation was observed without any associated traffic loss, control-plane instability, or hardware-related issues. Notably, the SA re-creation occurred approximately 10 minutes after the switchover, whereas MACsec/MKA sessions are generally expected to recover almost immediately following GRES/NSR events.

Further validation should include confirming:

• Stability of MKA sessions
• Consistency of member identifiers
• Absence of negotiation-triggering events
• These observations suggest a delayed MKA rekey event, rather than a complete session reset.

Additional analysis indicates that control-plane recovery timers and potential interoperability behavior with third-party devices (e.g., Arista acting as the key server) may contribute to the delayed SA re-creation.