Description

The article explains what does mean of received CKN ABCD1234 has ICV error and received CKN ABCD1234 is unknown

Symptoms

Related configuration is as below: 
security {
    macsec {
        connectivity-association CA-basic {
            cipher-suite gcm-aes-xpn-256;
            security-mode static-cak;
            pre-shared-key {
                ckn abcd1234;
                cak "$9$AX31p1RhSreM81INdws4oz3n9uORhSeM8REVws2aJ69CABIaUylMX-dg4ZUjikPzF/pu1Di"; ## SECRET-DATA
            }
        }
        interfaces {
            et-0/0/12 {
                connectivity-association CA-basic;
            }
        }
    }
}
interfaces {
    et-0/0/12 {
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
    }
}

user@router> show security macsec connections
    Interface name: et-0/0/12
        CA name: CA-basic
        Cipher suite: GCM-AES-XPN-256 Encryption: on
        Key server offset: 0        Include SCI: no
        Replay protect: off         Replay window: 0

user@router> show log messages |match MACSEC
May 29 13:03:56.256 2024  router dot1xd[20637]: %DAEMON-4-DOT1XD_MACSEC_SC_CAK_ICV_ERR: intf: et-0/0/12 received CKN ABCD1234 has ICV error
There is another case with log: received CKN ABCD123456 is unknown: 
user@router> show log messages |match MACSEC
May 29 14:41:22.092 2024  router dot1xd[20637]: %DAEMON-4-DOT1XD_MACSEC_SC_UNKNOWN_CAK_ERR: intf: et-0/0/12 received CKN ABCD123456 is unknown

Solution

  • The log received CKN has ICV error indicates CKN is matching but CAK is not matching between MACsec peer node.
Check CAK value in CLI and make them same for both MACsec nodes.
  • The log received CKN is unknown indicates interface et-0/0/12 receives hello packet from remote node with CKN: ABCD123456 but local node pre-shared-key CKN: ABCD1234, i.e. received CKN is not matching any of the configured CKN on that interface on that CA.
Check CKN value in CLI and make them same for both MACsec nodes.


After fix the configuration issue, check it again, the expected output is as below:

user@router> show security macsec connections
    Interface name: et-0/0/12
        CA name: CA-basic
        Cipher suite: GCM-AES-XPN-256 Encryption: on
        Key server offset: 0        Include SCI: no
        Replay protect: off         Replay window: 0
          Outbound secure channels
            SC Id: 4C:6D:58:15:87:5C/1
            Outgoing packet number: 1
            Secure associations
            AN: 1 Status: inuse Create time: 00:00:09
          Inbound secure channels
            SC Id: 3C:61:04:45:81:C1/1
            Secure associations
            AN: 1 Status: inuse Create time: 00:00:09

Refer to user guide Configuring MACsec for more details.

Modification History

2024-05-29 : Article Created