Hi Team,

We are facing issues on our devices and not seeing isis, lacp and macsec... on particular interfaces et-0/1/5 where rest of the interfaces working good.

user@abc> show isis interface ae136.0
IS-IS interface database:
Interface L CirID Level 1 DR Level 2 DR L1/L2 Metric
ae136.0 2 0x1 Disabled Down 10/15000000

user@abc show lacp interfaces ae136
Aggregated interface: ae136
LACP state: Role Exp Def Dist Col Syn Aggr Timeout Activity
et-0/1/5 Actor No No No No Yes Yes Fast Active
et-0/1/5 Partner Yes Yes No No No Yes Fast Active
LACP protocol: Receive State Transmit State Mux State
et-0/1/5 Current Fast periodic Attached

user@abc

user@abc show lacp statistics interfaces ae136
Aggregated interface: ae136
LACP Statistics: LACP Rx LACP Tx Unknown Rx Illegal Rx
et-0/1/5 109909 110188 0 0

user@abc

user@abc show security macsec connections interface et-0/1/5 | match packet
Outgoing packet number: 1

user@abc

The current RCA due to the mismatch of the “exclude-protocol” config applied on et-0/1/5 and et-0/1/6:0 through different CA?

security {

    macsec {

        connectivity-association CORE_MACSEC_POLICY_V3 {

            cipher-suite gcm-aes-xpn-256;

            security-mode static-cak;

            mka {

                transmit-interval 6000;

                key-server-priority 0;

            }

            replay-protect {

                replay-window-size 100;

            }

            offset 0;

            pre-shared-key {

                ckn 7CB07A07B09B2A5A704B7F061672F620C309EE3B241D209D3FA23161087A2FA7;

            }

            exclude-protocol lldp;

        }

        connectivity-association core_macsec_policy {

            cipher-suite gcm-aes-256;

            security-mode static-cak;

            mka {

                transmit-interval 6000;

                key-server-priority 0;

            }

            replay-protect {

                replay-window-size 100;

            }

            offset 50;

            pre-shared-key {

                ckn 7CB07A07B09B2A5A704B7F061672F620C309EE3B241D209D3FA23161087A2FA7;

            }

            exclude-protocol lldp;

            exclude-protocol lacp;

        }

        interfaces {

.

.

            et-0/1/5 {

                connectivity-association CORE_MACSEC_POLICY_V3;

            }

            et-0/1/6:0 {

                connectivity-association core_macsec_policy;

            }

The 4 middle group are ports are QSFP-28 ports so these 4 belong to the same port group.

All other ports are qsfp56-dd and have their own port group so only channelized ports will share the same port group.

2. All exclude protocol (lldp, lacp,cdp) need to be the same in the port group.  This is due to this Hardware filter control is only available on the port group; thus, it will apply to all ports in the port group.  To avoid confusion, we recommend all ports in the port group configure exclude protocol the same for all ports in the port group.  Another limitation is some port/sc macsec stats are on port group basis instead of per port/per session.  Also, note these hardware limitations are fixed In BX Asic.