LACP goes down after configuring macsec between a QFX5120 and an EX4600. When macsec is removed, LACP comes UP.
After adding macsec configuration, LACP goes down.
set security macsec connectivity-association <ca_name> cipher-suite gcm-aes-128
set security macsec connectivity-association <ca_name> security-mode static-cak
set security macsec connectivity-association <ca_name> mka transmit-interval 6000
set security macsec connectivity-association <ca_name> pre-shared-key ckn abcd
set security macsec connectivity-association <ca_name> pre-shared-key cak "xxxxxxxxxxxxxxxx"
set security macsec interfaces xe-0/0/A connectivity-association <ca_name>
set security macsec interfaces xe-0/0/B connectivity-association <ca_name>
Since the configuration is between a QFX5120 and an EX4600, the keyword "include-sci" must be added on the QFX5120.
Refer to Configuring MACsec
You must enable SCI tagging on a switch that is enabling MACsec on an Ethernet link connecting to an EX4300 or EX4600 switch.
SCI tags are automatically appended to packets leaving a MACsec-enabled interface on an EX4300 or EX4600 switch, so this option is not available on these switches.
You should only use this option when connecting a switch to an EX4300 or EX4600 switch, or to a host device that requires SCI tagging. SCI tags are eight octets long, so appending an SCI tag to all traffic on the link adds a significant amount of unneeded overhead.
After adding the keyword "include-sci" on the QFX5120, LACP came UP.
This is the configuration on the QFX5120 with the keyword "include-sci".
{master:0}[edit]
user@qfx5120# show security | display set
set security macsec connectivity-association <ca_name> include-sci
user@qfx5120# run show lacp interfaces
Aggregated interface: aeX
LACP state: Role Exp Def Dist Col Syn Aggr Timeout Activity
xe-0/0/A Actor No No Yes Yes Yes Yes Fast Active
xe-0/0/A Partner No No Yes Yes Yes Yes Fast Active
xe-0/0/B Actor No No Yes Yes Yes Yes Fast Active
xe-0/0/B Partner No No Yes Yes Yes Yes Fast Active
LACP protocol: Receive State Transmit State Mux State
xe-0/0/A Current Fast periodic Collecting distributing
xe-0/0/B Current Fast periodic Collecting distributing
And this is the configuration on the EX4600.
user@EX4600# show security | display set
user@EX4600# run show lacp interfaces