This article provides documentation related to MACsec feature limitations on Juniper Networks environments.

The customer is requesting information about MACsec limitations, specially on how it will encrypt Spanning Tree frames.

You need to visit the Juniper site Understanding Media Access Control Security (MACsec), then scroll down to "MACsec Limitations". There you will find a list of limitations including Spanning Tree related information.

MACsec Limitations

• All types of Spanning Tree Protocol frames cannot currently be encrypted using MACsec.

• MACsec traffic drops are expected during GRES switchover.

• On EX4300 switches, MACsec might not work properly on PHY84756 1G SFP ports if auto negotiation is enabled and MACsec is configured on those ports. As a workaround, configure no- auto-negotiation on PHY84756 1G SFP ports before configuring MACsec on those ports.

https://www.juniper.net/documentation/us/en/software/junos/chassis-cluster-security-devices/topics/topic-map/security-chassis-cluster-macsec.html#id-understanding-media-access-control-security-macsec

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/topic-map/understanding_media_access_control_security_qfx_ex.html