Description

Hi Support,

TI reported that the Macsec frames is not forwarding between juniper ex switch as below :

CPE(macsec)----ge-0/0/3 (sggssw51) ------ Juniper PE --- Juniper PE ---- (sygssw50) ge-1/1/0----(macsec)CPE

According to the packet capture below of the macsec destination address, it is 01:80:c2:00:00:03.

=========================
Ethernet II, Src: 64:8f:3e:0d:ba:ff (64:8f:3e:0d:ba:ff), Dst: 01:80:c2:00:00:03 (01:80:c2:00:00:03)
Destination: 01:80:c2:00:00:03 (01:80:c2:00:00:03)
Address: 01:80:c2:00:00:03 (01:80:c2:00:00:03)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
Source: 64:8f:3e:0d:ba:ff (64:8f:3e:0d:ba:ff)
Address: 64:8f:3e:0d:ba:ff (64:8f:3e:0d:ba:ff)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: 802.1X Authentication (0x888e)


@sggssw51> show configuration vlans EVPL-203
description "CU~SGGSSW51-G0_0_3~1G~[Telstra_K237]Colt Technology No_IP_Address~SNG EVP 90100655~NA~NA~SGGS60-TG2_0_0.203~SYD SNG EVT 90100658";
interface xe-0/2/3.203;
interface ge-0/0/3.203;
forwarding-options {
filter {
input 1G_POLICER_90100655;
}
}

@sggssw51> show configuration interfaces ge-0/0/3
description "CU~SGGSSW51-G0_0_3~1G~[Telstra_K237]Colt Technology No_IP_Address~SNG EVP 90100655~NA~NA~SGGS60-TG2_0_0.203~SYD SNG EVT 90100658";
flexible-vlan-tagging;
native-vlan-id 1;
speed 1g;
mtu 9192;
encapsulation extended-vlan-bridge;
ether-options {
no-auto-negotiation;
no-flow-control;
}
unit 203 {
vlan-id-list 1-4094;
input-vlan-map push;
output-vlan-map pop;
family ethernet-switching;
}

@sggssw51> show configuration interfaces xe-0/2/3.203
vlan-id 203;

@sggssw51> show configuration firewall family ethernet-switching filter 1G_POLICER_90100655
term POLICE {
from {
interface ge-0/0/3.203;
}
then policer 1G_POLICER_90100655;
}
term OTHERS {
then accept;
}


@sygssw50
set vlans EVPL-100 description "CU~SYGSSW50-G1_1_0~1G~[Telstra_K237]Colt Technology No_IP_Address~SYD EVP 90100654~NA~NA~SYDPSW42~SYDP60-TG8_3_0.100~SYD SNG EVT 90100658"
set vlans EVPL-100 vlan-id 100
set vlans EVPL-100 interface ae0.0
set vlans EVPL-100 interface ge-1/1/0.0
set vlans EVPL-100 dot1q-tunneling

set interfaces ge-1/1/0 description "CU~SYGSSW50-G1_1_0~1G~[Telstra_K237]Colt Technology No_IP_Address~SYD EVP 90100654~NA~NA~SYDPSW42~SYDP60-TG8_3_0.100~SYD SNG EVT 90100658"
set interfaces ge-1/1/0 mtu 9192
set interfaces ge-1/1/0 ether-options no-auto-negotiation
set interfaces ge-1/1/0 ether-options no-flow-control
set interfaces ge-1/1/0 ether-options link-mode full-duplex
set interfaces ge-1/1/0 ether-options speed 1g
set interfaces ge-1/1/0 unit 0 family ethernet-switching port-mode access
set interfaces ge-1/1/0 unit 0 family ethernet-switching filter input 1G_POLICER_90100654

set interfaces ae0 unit 0 family ethernet-switching port-mode trunk
set interfaces ae0 unit 0 family ethernet-switching vlan members NET_MAN

set firewall family ethernet-switching filter 1G_POLICER_90100654 interface-specific
set firewall family ethernet-switching filter 1G_POLICER_90100654 term POLICE then policer 1G_POLICER_90100654

Regards,
Bradford

Solution

Solved

Modification History

2025-05-04 : Article Created