We get MACSec working between a Cisco 9500 switch and a Cisco 4331 ISR Router.  I imagine that a 3850 would be similar.  The trick was to pad the key number on the switch with a bunch of zeroes.  Here is a working snippet, obviously you should replac...