MACSEC gets configured in a plain text link passing traffic using fail-open (should-secure). There is a small amount of packet loss when macsec is enabled and the CA comes up. When the configuration changes from should-secure to must-secure, the CA flaps and there's a packet loss. This is an expected behavior.

Packet loss is seen when configuration changes from should-secure to must-secure.

set security authentication-key-chains key-chain MACSEC-KEYCHAIN-ET-0-0-0 key 1 secret "xxxxxxxxxxxxxxxxxxxxxxx"
set security authentication-key-chains key-chain MACSEC-KEYCHAIN-ET-0-0-0 key 1 key-name xxxxxxxxxxx
set security authentication-key-chains key-chain MACSEC-KEYCHAIN-ET-0-0-0 key 1 start-time "2024-8-13.22:50:08 -0700"
set security authentication-key-chains key-chain MACSEC-KEYCHAIN-ET-1-0-0 key 1 secret "xxxxxxxxxxxxxxxxxxxxxxx"
set security authentication-key-chains key-chain MACSEC-KEYCHAIN-ET-1-0-0 key 1 key-name xxxxxxxxxxx
set security authentication-key-chains key-chain MACSEC-KEYCHAIN-ET-1-0-0 key 1 start-time "2024-8-13.22:50:08 -0700"
set security macsec connectivity-association CA_basic_et_0_0_0 cipher-suite gcm-aes-xpn-256
set security macsec connectivity-association CA_basic_et_0_0_0 security-mode static-cak
set security macsec connectivity-association CA_basic_et_0_0_0 mka should-secure
set security macsec connectivity-association CA_basic_et_0_0_0 include-sci
set security macsec connectivity-association CA_basic_et_0_0_0 pre-shared-key-chain MACSEC-KEYCHAIN-ET-0-0-0
set security macsec connectivity-association CA_basic_et_1_0_0 cipher-suite gcm-aes-xpn-256
set security macsec connectivity-association CA_basic_et_1_0_0 security-mode static-cak
set security macsec connectivity-association CA_basic_et_1_0_0 mka should-secure
set security macsec connectivity-association CA_basic_et_1_0_0 include-sci
set security macsec connectivity-association CA_basic_et_1_0_0 pre-shared-key-chain MACSEC-KEYCHAIN-ET-1-0-0
set security macsec interfaces et-0/0/0 connectivity-association CA_basic_et_0_0_0
set security macsec interfaces et-1/0/0 connectivity-association CA_basic_et_1_0_0
 

Changing the configuration to must-secure (default behavior):

user@device# show | compare
[edit security macsec connectivity-association CA_basic_et_0_0_0 mka]
-    should-secure;
[edit security macsec connectivity-association CA_basic_et_1_0_0 mka]
-    should-secure;

 

This is an expected behavior. MACsec can take a few seconds to establish MACsec session.

With Must secure, no data packets are transmitted or received when the MACsec session is down; thus, you’ll see a longer traffic loss until MACsec session gets established.

With Should secure, data packets can be transmitted or received when the MACsec session is down; however, there will be a brief traffic loss when macsec is enabled (may be dependent on hardware used) and when the session is established.  Once MACsec session is established, any unencrypted data packets will get discarded. Thus, the traffic loss is a bit more variable since it is dependent on the time the local and peer end enable the MACsec session in hardware.  

Adding or removing should-secure to change from fail-open to fail-closed mode is a session-teardown operation. The CA will go down and get re-established after this change is applied.