Deactivating MACSEC results in traffic loss
When MACSEC is up passing traffic, deactivating MACSEC globably or per interface will result in traffic loss. This is expected behavior.
Example:
topology: --ixia----et-0/0/1.0----PTX-et-0/0/0---macsec/isis------et-0/0/0---PTX--et-0/0/1.0--IXIA Bidectional traffic Lab provided if needed. Customer is expecting little to no traffic loss when deactivating MACSEC on a interface. Example: topology: --ixia----et-0/0/1.0----PTX-et-0/0/0---macsec/isis------et-0/0/0---PTX--et-0/0/1.0--IXIA Bidectional traffic Customer is expecting little to no traffic loss when deactivating MACSEC on a interface. Example: set security authentication-key-chains key-chain JUNIPER-CORE_macsec_key_chain key 1 secret "$9$zYn56tuhSrvMXeK87dVY2aZUD.PFn/pu1DimTQz6/reKW7-Vb24oGbw2aUDmPcyrevLVb2oZU2gz36/0O1RhyvWxNdg4ZreJGikPf1REcvWN-woaUdVgJZUHk.P5F39tpBSlKIRrvWX-dHq.fT3AtORcypuBEcSMWJGUHkPzF/CuODiPQn6AtvW8L-V" set security authentication-key-chains key-chain JUNIPER-CORE_macsec_key_chain key 1 key-name deadbeefcaf4 set security authentication-key-chains key-chain JUNIPER-CORE_macsec_key_chain key 1 start-time "2025-3-11.18:22:22 -0700" set security macsec connectivity-association JUNIPER-CORE cipher-suite gcm-aes-xpn-256 set security macsec connectivity-association JUNIPER-CORE security-mode static-cak set security macsec connectivity-association JUNIPER-CORE mka transmit-interval 2000 set security macsec connectivity-association JUNIPER-CORE mka should-secure set security macsec connectivity-association JUNIPER-CORE fallback-key ckn 37c9c2c45ddd012aa5bc8ef284aa23ff6729ee2e4acb66e91fe34ba2cd9fe312 set security macsec connectivity-association JUNIPER-CORE fallback-key cak "$9$mPz369AuBIn6evWLN-mf5FCtEcylM8" set security macsec connectivity-association JUNIPER-CORE pre-shared-key-chain JUNIPER-CORE_macsec_key_chain set security macsec interfaces et-0/0/0 connectivity-association JUNIPER-CORE Deactivate MACSEC on interface et-0/0/0 Traps stats show 6~7 second traffic loss with MKA interval set to 2k when MACSEC is deactivated. Aligns with MKA interval 2000ms * 3 = 6seconds ---(refreshed at 2025-03-17 07:10:05 PDT)--- Trap Stats: DEV TRAPCODE NAME COUNT RATE 0 4 dlu.ucode.discard 159787 0 0 93 slu.trapcode.pkt_eope 131951 0 0 250 sw.irp_nh_discard_sample 2 0 ---(refreshed at 2025-03-17 07:10:06 PDT)--- Trap Stats: DEV TRAPCODE NAME COUNT RATE 0 4 dlu.ucode.discard 159822 34 0 93 slu.trapcode.pkt_eope 131951 0 0 250 sw.irp_nh_discard_sample 2 0 ---(refreshed at 2025-03-17 07:10:07 PDT)--- Trap Stats: DEV TRAPCODE NAME COUNT RATE 0 4 dlu.ucode.discard 160823 1002 0 93 slu.trapcode.pkt_eope 131951 0 0 250 sw.irp_nh_discard_sample 2 0 ---(refreshed at 2025-03-17 07:10:08 PDT)--- Trap Stats: DEV TRAPCODE NAME COUNT RATE 0 4 dlu.ucode.discard 161823 1000 0 93 slu.trapcode.pkt_eope 131951 0 0 250 sw.irp_nh_discard_sample 2 0 ---(refreshed at 2025-03-17 07:10:09 PDT)--- Trap Stats: DEV TRAPCODE NAME COUNT RATE 0 4 dlu.ucode.discard 162824 1001 0 93 slu.trapcode.pkt_eope 131951 0 0 250 sw.irp_nh_discard_sample 2 0 ---(refreshed at 2025-03-17 07:10:10 PDT)--- Trap Stats: DEV TRAPCODE NAME COUNT RATE 0 4 dlu.ucode.discard 163825 1001 0 93 slu.trapcode.pkt_eope 131951 0 0 250 sw.irp_nh_discard_sample 2 0 ---(refreshed at 2025-03-17 07:10:11 PDT)--- Trap Stats: DEV TRAPCODE NAME COUNT RATE 0 4 dlu.ucode.discard 164825 1000 0 93 slu.trapcode.pkt_eope 131951 0 0 250 sw.irp_nh_discard_sample 2 0 ---(refreshed at 2025-03-17 07:10:12 PDT)--- Trap Stats: DEV TRAPCODE NAME COUNT RATE 0 4 dlu.ucode.discard 165125 300 0 93 slu.trapcode.pkt_eope 131951 0 0 250 sw.irp_nh_discard_sample 2 0 ---(refreshed at 2025-03-17 07:10:13 PDT)--- Trap Stats: DEV TRAPCODE NAME COUNT RATE 0 4 dlu.ucode.discard 165126 1 0 93 slu.trapcode.pkt_eope 131951 0 0 250 sw.irp_nh_discard_sample 2 0 ---(refreshed at 2025-03-17 07:10:14 PDT)--- Trap Stats: DEV TRAPCODE NAME COUNT RATE 0 4 dlu.ucode.discard 165127 1 0 93 slu.trapcode.pkt_eope 131951 0 0 250 sw.irp_nh_discard_sample 2 0 abroot@e05-38# run show security macsec connections Mar 17 07:17:17 Interface name: et-0/0/0 CA name: JUNIPER-CORE Cipher suite: GCM-AES-XPN-256 Encryption: on Key server offset: 0 Include SCI: no Replay protect: off Replay window: 0 Outbound secure channels SC Id: D0:81:C5:8C:E0:C0/1 Outgoing packet number: 74882 Secure associations AN: 0 Status: inuse Create time: 00:01:20 Inbound secure channels SC Id: D0:81:C5:8E:D3:C0/1 Secure associations AN: 0 Status: inuse Create time: 00:01:20 labroot@e05-38# run show security macsec statistics Mar 17 07:17:30 Interface name: et-0/0/0 Secure Channel transmitted Encrypted packets: 82883 Encrypted bytes: 83533521 Protected packets: 0 Protected bytes: 0 Secure Association transmitted Encrypted packets: 82883 Protected packets: 0 Secure Channel received Accepted packets: 82747 Validated bytes: 0 Decrypted bytes: 83369381 Secure Association received Accepted packets: 82747 Validated bytes: 0 Decrypted bytes: 0 [edit] labroot@e05-38# run show security macsec statistics Mar 17 07:17:34 Interface name: et-0/0/0 Secure Channel transmitted Encrypted packets: 94888 Encrypted bytes: 95631688 Protected packets: 0 Protected bytes: 0 Secure Association transmitted Encrypted packets: 94888 Protected packets: 0 Secure Channel received Accepted packets: 94751 Validated bytes: 0 Decrypted bytes: 95463758 Secure Association received Accepted packets: 94751 Validated bytes: 0 Decrypted bytes: 0 [edit] labroot@e05-38#
This is expected behavior.