Description

MACSEC comes UP as expected immediately after it is configured. However, traffic fails between the Cisco switch and Juniper Router.

Symptoms

  • When initiating a ping from Cisco switch to Juniper router, it is clear that ARP is being learnt on Juniper, while Cisco fails to do the same.

  • It is also clear that ARP responses are being sent out from Juniper router, but the Cisco switch fails to see them.

  • Verified with firewall filters on the physical interfaces to ensure that the MACSEC has 'must-secure' configured on both sides, along with the same Cipher suite, which shows the MACSEC status is UP as expected.


 

Solution

In this situation, the 'include-sci' is 'yes' by default on the Cisco switch, while it is optional for Juniper. 

Add  'include-sci' on the Juniper Router MACSEC configuration as follows:

#set  security macsec connectivity-association  connectivity-association-name include-sci