Symptom

After macsec_ea process restart, MKA Packets that are Transmitted on Encrypt port are getting punted back immediately.

Conditions

RP/0/RSP0/CPU0:macsec-PE2#sh macsec mka interface Te0/3/0/18 detail Interface Name : Te0/3/0/18 Interface Namestring : TenGigE0_3_0_18 Interface short name : Te0/3/0/18 Interface handle : 0xa000540 Interface number : 0xa000540 Macsec-Service : TRUE Service Port Type : macsec-encryption Paired Decryption Intf : Te0/3/0/19 Interface MAC : badb.ad09.7dba Ethertype : 888E Config Received : TRUE IM notify Complete : TRUE Interface CAPS Add : TRUE RxSA CAPS Add : TRUE TxSA CAPS Add : TRUE MKA PSK Info Key Chain Name : script_key_chain1 MKA Cipher Suite : AES-CMAC-128 CKN : ab c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Policy : mk_xpn_1tag Rx SC 1 Rx SCI : badbad097dba0001 <— RX SC and TX SC shows as mac Rx SSCI : 1 Peer MAC : ba:db:ad:09:7d:ba Is XPN : YES SC State : Provisioned SAK State[0] : Provisioned Rx SA Program Req[0] : 2016 Feb 17 15:27:47.352 Rx SA Program Rsp[0] : 2016 Feb 17 15:28:08.336 SAK Data SAK[0] : *** SAK Len : 32 HashKey[0] : *** HashKey Len : 16 Conf offset : 50 Cipher Suite : GCM-AES-XPN-256 CtxSalt[0] : 64 9f bf 40 5e 1d 9c 61 a8 5c 37 e4 CtxSalt Len : 12 Tx SC Tx SCI : badbad097dba0001 Tx SSCI : 2 Active AN : 255 Old AN : 255 Is XPN : NO Next PN : 0, 0, 0, 0 SC State : Provisioned SAK Data MKA traces: Feb 17 16:18:39.230 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7db7/0028: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.230 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7db7/0027: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.230 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7db7/0026: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.229 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7db7/0025: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.229 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7db7/0024: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.229 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7db7/0023: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.228 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7db7/0022: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.228 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7db7/0021: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.228 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7db7/0020: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.228 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7db7/001f: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.227 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7dad/0014: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.227 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7dad/0013: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.227 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7dad/0012: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.226 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7dad/0011: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.226 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7dad/0010: Peer's SCI was found to be the same as local participant's SCI while updating key-server status. Feb 17 16:18:39.226 macsec_mka/errors 0/3/CPU0 t1 TP17: MKA_ERROR badb.ad09.7dad/000f: Peer's SCI was found to be the same as local participant's SCI while updating key-server status.

Workaround

Further Problem Description