Description

In the following scenario:

  1. Traffic enters et-0/0/0 without MACSEC enabled, with default MTU 1500
  2. Traffic goes out et-0/0/1 with MACSEC enabled, with default MTU 1500

 

When traffic size is close to 1500B (From 1468 To 1500), the traffic could be dropped on et-0/0/1 egress direction due to  "Oversized frames" and output "MTU errors" 

This is because MACSEC will add 24-32B in the ethernet header and this can't be fragmented. Drop could be seen if no additional MTU is given on MACSEC interfaces

Symptoms

 

Traffic drop could be seen on MACSEC enabled interface due to Oversized frames and generate output MTU errors

Solution

When enabling MACsec, we recommend that you examine your interface MTU, adjusting it for MACsec overhead, which is 32 bytes.

 

In your case, should set et-0/0/0 with MTU of 9000 and et-0/0/1 with MTU of 9032. It should avoid any MTU issues

Modification History

2024-03-06 : Article Created