This article describes MACsec support on aggregated Ethernet (AE) interfaces and outlines the supported configuration options and implementation guidelines.
Support of MACsec on aggregated interfaces
When configuring MACsec it's important to consider that this feature is not enabled until you attach a connectivity association to an interface. Based on this, in order for MACsec to work properly, we need to associate it to the link that we would like to have running in this secured method.
In some scenarios, the interface forming the link in which we want to enable MACsec is an aggregated interface (ae) and it's important to consider whether it's supported or not. As per the MACsec guidelines, we can see the following important note:
Based on this, as the documentation confirms if you are planning to add MACsec on the aggregated interface facing the peer, such as ae1.0, it won't be supported and you'll have to add it on the physical (child interface). Please see the example below:
Topology:
Switch 1 'ae1' <---- MACsec link ----> 'ae1' Switch 2
Child interfaces for ae1:
-xe-0/0/1
-xe-0/0/2
user@Switch1# show security | display set
set security macsec connectivity-association <ca_name> cipher-suite gcm-aes-128
set security macsec connectivity-association <ca_name> security-mode static-cak
set security macsec connectivity-association <ca_name> mka transmit-interval 6000
set security macsec connectivity-association <ca_name> pre-shared-key ckn abcd
set security macsec connectivity-association <ca_name> pre-shared-key cak "xxxxxxxxxxxxxxxx"
set security macsec interfaces xe-0/0/1 connectivity-association <ca_name>
set security macsec interfaces xe-0/0/2 connectivity-association <ca_name>
In conclusion, when this scenario is experienced, please proceed to link the connectivity-association with the child interfaces.
This configuration was added for reference. However, for further details about this feature please refer to:
Configuring MACsec | Junos OS | Juniper Networks