When you have legacy licensing configured on a VC setup; the macsec license (and or other licenses) may show up as invalid on the backup member.
1. Impact: MACSec license seen as invalid on backup member. 2. Macsec is actually seen as functional on the ports of the backup member. 3. Hence, in a way this is cosmetic problem only. Virtual Chassis:
root@router> show virtual-chassis status Preprovisioned Virtual Chassis Virtual Chassis ID: 0cab.13f7.xxxx Virtual Chassis Mode: Enabled Mstr Mixed Route Neighbor List Member ID Status Serial No Model prio Role Mode Mode ID Interface 0 (FPC 0) Prsnt xxxx1 qfx5120-48ym-8c 129 Master* N VC 2 vcp-255/0/49 1 vcp-255/0/54 1 vcp-255/0/55 1 (FPC 1) Prsnt xxxx2 qfx5120-48ym-8c 0 Linecard N VC 2 vcp-255/0/49 0 vcp-255/0/54 0 vcp-255/0/55 2 (FPC 2) Prsnt xxxx3 qfx5120-48ym-8c 129 Backup N VC 0 vcp-255/0/48 1 vcp-255/0/49
Show system license on master:
root@router> show system license License usage: Licensed Licensed Licensed Feature Feature Feature Feature name used installed needed Expiry filter-based-forwarding 0 1 0 permanent connectivity-fault-management 0 1 0 permanent vrrp 0 1 0 permanent dot1q-tunneling 0 1 0 permanent macsec 1 1 0 permanent mc-lag 0 1 0 permanent Timing License 0 1 0 permanent igmp-multicast 0 1 0 permanent pim 0 1 0 permanent gre_tunnel 0 1 0 permanent rip 0 1 0 permanent ospf 0 1 0 permanent switching-vc-license 0 1 0 permanent inmon-sflow 0 1 0 permanent Licenses installed: License identifier: xxx License version: 4 Valid for device: xxxx1 Customer ID: WSH KFT. Features: macsec - MACsec permanent License identifier: xxxx License version: 4 Valid for device: xxxx2 Customer ID: WSH KFT. Features: macsec - MACsec permanent License identifier: xxx License version: 4 Valid for device: xxxx3 Customer ID: SEMILAB ZRT. Features: macsec - MACsec permanent
Show system license on backup:
root@router> request session member 2 Last login: Sat Apr 11 15:15:57 from master --- JUNOS 23.4R2-S3.9 Kernel 64-bit JNPR-12.1-20240604.39c9257_buil {backup:2} root@router> show system license License usage: Licensed Licensed Licensed Feature Feature Feature Feature name used installed needed Expiry filter-based-forwarding 0 1 0 permanent connectivity-fault-management 0 1 0 permanent vrrp 0 1 0 permanent dot1q-tunneling 0 1 0 permanent macsec 1 0 1 invalid -----> license is seen as not valid (However as we checked MACSEC actually works for backup member ports) mc-lag 0 1 0 permanent Timing License 0 1 0 permanent igmp-multicast 0 1 0 permanent pim 0 1 0 permanent gre_tunnel 0 1 0 permanent rip 0 1 0 permanent ospf 0 1 0 permanent switching-vc-license 0 1 0 permanent inmon-sflow 0 1 0 permanent Licenses installed: none
Since Legacy licensing is being planned to do away with; Engineering has devised "Agile Licensing" where this problem is sorted.
QFX5120 has moved to Agile licensing from release 24.4R1. Hence it is suggested to move to Agile. After upgrade to Agile licensing, show system license detail rus on master only, and the output contains the following:
root@router> show system license detail -- snipped output -- QinQ 0 1 0 1 permanent MACsec 1 1 0 0 2027-05-05 17:00:00 PDT MC-LAG 0 1 0 1 permanent Licensing Mode: Agile Licensing Standalone. ---> this is to be seen on upgraded image - "Agile Licensing" Licensing Persona: JUNOS LKG ---> this is to be seen on upgraded image - "Agile Licensing"
----------------------------------------- Backup member displays an error:
root@router> show system license error: This command can only be used on the master routing engine. {backup:1} root@router> show system license detail error: This command can only be used on the master routing engine.