MACsec packet-loss between C9300/17.9.5 and Nexus C93180YC-FX/10.2.6

[MATTHIAS SCHAERER]

Hi

I have a 10Gb link between the two devices that is secured by MACsec/PSK. When I ping between the two devices after about 90KB of traffic I lose one ping in regular intervals. Due to the regularity I assume this is something process related but up to now I have not found out, what parameter might be the reason for this behaviour.

Config C9300:
------------

key chain MACSEC_KEYS_1 macsec
 key 02
  cryptographic-algorithm aes-256-cmac
  key-string <omitted>
 lifetime local 00:00:00 Jan 1 2024 infinite
!
!
license boot level network-advantage
mka policy MKA_POLICY_1
 key-server priority 90
 sak-rekey interval 3600
!
interface TenGigabitEthernet1/1/1
 switchport access vlan 22
 mtu 9100
 macsec network-link
 mka policy MKA_POLICY_1
 mka pre-shared-key key-chain MACSEC_KEYS_1
!

Config C93180YC-FX:
-------------------

key chain MACSEC_KEYS_1 macsec
 key 02
  key-octet-string 7 <omitted> cryptographic-algorithm AES_256_CMAC
 send-lifetime local 00:00:00 Jan 01 2024 infinite

macsec policy MACSEC_POLICY_1
 cipher-suite GCM-AES-256
 key-server-priority 100

interface Ethernet1/48
 macsec keychain MACSEC_KEYS_1 policy MACSEC_POLICY_1
 switchport
 switchport access vlan 22
 mtu 9100
 no shutdown

[marce1000]

 - Doubt if that is important ; but configure a syslog server on both devices and examine logs send to it ; watch for anomalies reported , if any ,

 M.

[Ruben Cocheno]

@MATTHIAS SCHAERER 

Check any errors on the interfaces and Tx/Rx levels

[MATTHIAS SCHAERER · Accepted solution]

Both answers did not really help but I retested the connection without MACsec and observed the same behaviour. I then attached a host to the Nexus device and repeated the pings from the C9300. With that setup I did not observe any failure (100k pings). The reason for the packet loss is probably the CPU of the Nexus that could not match the speed of the pings sourced from the C9300.