This article documents some working and non-working scenarios for MACsec on MX Series routers, with respect to the platforms that are supported and the configuration that is supported on the platform.
A few scenarios are described as follows:
The 256-bit Cipher suite is not supported without MIC-MACSEC. If this MIC is not used and a 256-bit Cipher is used, the status of the interface shows as "unsecured-init." The following MIC is used an example to explain this behavior:
FPC 1 BUILTIN BUILTIN MPC BUILTIN MIC 0 REV 11 750-049846 CAEJ5854 3D 20x 1GE(LAN)-E,SFP labroot@R2> show configuration security |display set set security authentication-key-chains key-chain NOIBR_MACSEC_256 key 1 secret "$ABC123" set security authentication-key-chains key-chain NOIBR_MACSEC_256 key 1 key-name 00000000000000000000000000000001 set security authentication-key-chains key-chain NOIBR_MACSEC_256 key 1 start-time "2019-11-17.00:38:00 -0800" set security macsec connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI cipher-suite gcm-aes-256 set security macsec connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI security-mode static-cak set security macsec connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI pre-shared-key-chain NOIBR_MACSEC_256 set security macsec interfaces ge-1/0/0 connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI set interfaces ge-1/0/0 unit 0 family inet address 201.1.1.2/30 Interface name: ge-1/0/0 Interface State: Unsecured - Init Member identifier: 76457D43EFDAB08B73A4F800 CAK name: 37C9C2C45DDD012AA5BC8EF284AA23FF6729EE2E4ACB66E91FE34BA2CD9FE311 CAK type: primary Transmit interval: 2000(ms) Preceding Key: enabled Outbound SCI: 80:71:1F:C2:AC:60/1 Message number: 6 Key number: 0 Key server: yes Key server priority: 16 Latest SAK AN: 0 Latest SAK KI: 000000000000000000000000/0 Previous SAK AN: 0 Previous SAK KI: 000000000000000000000000/0
With a MIC that has the above hardware, even a basic CA (without Cipher) works.
FPC 1 BUILTIN BUILTIN MPC BUILTIN MIC 0 REV 11 750-049846 CAEJ5854 3D 20x 1GE(LAN)-E,SFP set security macsec connectivity-association CA_basic security-mode static-cak set security macsec connectivity-association CA_basic pre-shared-key ckn abcd1234abcd1234 set security macsec connectivity-association CA_basic pre-shared-key cak "$ABC123" set security macsec interfaces ge-1/0/0 connectivity-association CA_basic set interfaces ge-1/0/0 unit 0 family inet address 201.1.1.2/30 labroot@host> ping 201.1.1.1 source 201.1.1.2 PING 201.1.1.1 (201.1.1.1): 56 data bytes 64 bytes from 201.1.1.1: icmp_seq=0 ttl=64 time=1.088 ms 64 bytes from 201.1.1.1: icmp_seq=1 ttl=64 time=2.428 ms ^C --- 201.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 1.088/1.758/2.428/0.670 ms
With the same hardware as highlighted below, the "gcm-aes-128" Cipher works.
FPC 1 BUILTIN BUILTIN MPC BUILTIN MIC 0 REV 11 750-049846 CAEJ5854 3D 20x 1GE(LAN)-E,SFP set security macsec connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI cipher-suite gcm-aes-128 set security macsec connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI security-mode static-cak set security macsec connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI pre-shared-key ckn 37c9c2c45ddd012aa5bc8ef284aa23ff6729ee2e4acb66e91fe34ba2cd9fe311 set security macsec connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI pre-shared-key cak "$ABC123" set security macsec interfaces ge-1/0/0 connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI set interfaces ge-1/0/0 unit 0 family inet address 201.1.1.2/30 > ping 201.1.1.1 source 201.1.1.2 PING 201.1.1.1 (201.1.1.1): 56 data bytes 64 bytes from 201.1.1.1: icmp_seq=0 ttl=64 time=4.111 ms 64 bytes from 201.1.1.1: icmp_seq=1 ttl=64 time=1.003 ms ^C --- 201.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 1.003/2.557/4.111/1.554 ms > show security mka sessions Interface name: ge-1/0/0 Interface State: Secured - Primary Member identifier: DAC75923E3EF4CC35E353112 CAK name: 37C9C2C45DDD012AA5BC8EF284AA23FF6729EE2E4ACB66E91FE34BA2CD9FE311 CAK type: primary Transmit interval: 2000(ms) Preceding Key: enabled Outbound SCI: A8:D0:E5:5B:5A:78/1 Message number: 77 Key number: 0 Key server: no Key server priority: 16 Latest SAK AN: 0 Latest SAK KI: 36F5CA5349C228E857290721/1 Previous SAK AN: 0 Previous SAK KI: 000000000000000000000000/0 Peer list 1. Member identifier: 36F5CA5349C228E857290721 (live) Message number: 84 Hold time: 6000 (ms) SCI: 80:71:1F:C2:AC:60/1 Lowest acceptable PN: 3
With the following hardware and MIC, gcm-aes-xpn-128 does not work and the FPC drops these packets as "framing errors." The MKA session outputs display "secured-init." However, the data plane does not get through.
FPC 1 BUILTIN BUILTIN MPC BUILTIN MIC 0 REV 11 750-049846 CAFB6355 3D 20x 1GE(LAN)-E,SFP set security macsec connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI cipher-suite gcm-aes-xpn-128 set security macsec connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI security-mode static-cak set security macsec connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI pre-shared-key ckn 37c9c2c45ddd012aa5bc8ef284aa23ff6729ee2e4acb66e91fe34ba2cd9fe311 set security macsec connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI pre-shared-key cak "$ABC123" set security macsec interfaces ge-1/0/0 connectivity-association NOIBR_MACSEC_AES_XPN_256_PRI set interfaces ge-1/0/0 unit 0 family inet address 201.1.1.2/30 labroot@host> show security mka sessions Interface name: ge-1/0/0 Interface State: Secured - Primary Member identifier: 9FFCFF3E3439E1E0BB297777 CAK name: 37C9C2C45DDD012AA5BC8EF284AA23FF6729EE2E4ACB66E91FE34BA2CD9FE311 CAK type: primary Transmit interval: 2000(ms) Preceding Key: enabled Outbound SCI: A8:D0:E5:5B:5A:78/1 Message number: 856 Key number: 0 Key server: no Key server priority: 16 Latest SAK AN: 0 Latest SAK KI: 5929D899DE64B5A25DF3FD06/1 Previous SAK AN: 0 Previous SAK KI: 000000000000000000000000/0 Peer list 1. Member identifier: 5929D899DE64B5A25DF3FD06 (live) Message number: 761 Hold time: 4500 (ms) SCI: 80:71:1F:C2:AC:60/1 Lowest acceptable PN: 0 labroot@host> ping 201.1.1.1 source 201.1.1.2 PING 201.1.1.1 (201.1.1.1): 56 data bytes ^C --- 201.1.1.1 ping statistics --- 9 packets transmitted, 0 packets received, 100% packet loss labroot@R2> show interfaces ge-1/0/0 extensive | match framing Errors: 8, Drops: 0, Framing errors: 8, Runts: 0, Policed discards: 0, L3 incompletes: 0, labroot@R2> show interfaces ge-1/0/0 extensive | match framing Errors: 10, Drops: 0, Framing errors: 10, Runts: 0, Policed discards: 0, L3 incompletes: 0, labroot@R2> show interfaces ge-1/0/0 extensive | match framing Errors: 11, Drops: 0, Framing errors: 11, Runts: 0, Policed discards: 0, L3 incompletes: 0, labroot@R2> show interfaces ge-1/0/0 extensive | match framing Errors: 11, Drops: 0, Framing errors: 11, Runts: 0, Policed discards: 0, L3 incompletes: 0,
For non-working scenarios, to ensure that MACsec works on MX Series routers with MIC 3D 20x 1GE(LAN)-E,SFP, it is suggested that you use anything from basic CA or gcm-aes-128.
2022-06-17: Version 1