5.2 MACsec Link Security and Key Agreement

JNCIS-ENT Enterprise Routing and Switching Study Guide 2026 Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Exam Overview & Junos Enterprise Fundamentals

1.1 JNCIS-ENT Exam Logistics & Blueprint Breakdown 1.2 Junos CLI, Enterprise Platforms & Interface Families 1.3 Layer 2 Bridging Mechanics & Packet Forwarding

2 Chapter 2: VLANs & Inter-VLAN Routing

2.1 VLAN Segmentation and 802.1Q Tags 2.2 Access, Trunk, Native and Voice VLANs 2.3 IRB Architecture and Interface Families 2.4 IRB Configuration and Packet Walk 2.5 VLAN Configuration, Verification & Troubleshooting

3 Chapter 3: Spanning Tree Protocols

3.1 Layer 2 Loops and Root Bridge Election 3.2 STP Costs, Port Roles, States and BPDUs 3.3 RSTP Rapid Convergence & Link Types 3.4 MSTP Architecture & Spanning Tree Operations

4 Chapter 4: Layer 2 Security & Feature Protection

4.1 Edge BPDU and Root Protection 4.2 Loop Protection and Diagnostic States 4.3 Port Security, MAC Limiting & Persistent MAC Learning 4.4 DHCP Snooping, Dynamic ARP Inspection (DAI) & IP Source Guard 4.5 Layer 2 Firewall Filters: Types, Order and Actions

5 Chapter 5: Advanced Layer 2 Features & Storm Control

5.1 Storm Control & Broadcast/Multicast Suppression 5.2 MACsec Link Security and Key Agreement 5.3 LLDP and LLDP-MED Operations & Verification

6 Chapter 6: Protocol-Independent Routing & Load Balancing

6.1 Static, Aggregate, and Generated Routes 6.2 Routing Instances and RIB Groups 6.3 Junos Load Balancing & Filter-Based Forwarding (FBF) 6.4 Martian Routes and Route Acceptance

7 Chapter 7: Junos Routing Policy & Firewall Filters

7.1 Routing Policy Framework & Term Evaluation 7.2 Prefix Lists & Route Filters 7.3 Firewall Filters & Policers

8 Chapter 8: Open Shortest Path First (OSPF) Operation

8.1 OSPF Architecture & Neighbor Adjacency Formation 8.2 OSPF Areas & LSA Types 8.3 OSPFv2 & OSPFv3 Configuration and Verification

9 Chapter 9: Advanced OSPF Features & Routing Policies

9.1 OSPF Special Area Types 9.2 Route Summarization & OSPF Authentication 9.3 OSPF Diagnostics & Common Failure Scenarios

10 Chapter 10: Intermediate System to Intermediate System (IS-IS)

10.1 IS-IS Encapsulation and NET Identity 10.2 IS-IS Levels, Areas and Default Routing 10.3 IS-IS PDU Families and Neighbor Exchange 10.4 IS-IS Database Synchronization and DIS 10.5 IS-IS Configuration, Metrics & Troubleshooting

11 Chapter 11: Border Gateway Protocol (BGP)

11.1 BGP Roles, AS Numbers and TCP Transport 11.2 EBGP/IBGP Sessions, State Machine and Messages 11.3 BGP Attributes & Junos Path Selection Algorithm 11.4 BGP Configuration & Policy Implementation 11.5 BGP Scaling with Route Reflection & Diagnostics

12 Chapter 12: IP Tunneling & High Availability

12.1 GRE & IP-IP Tunneling Architecture 12.2 Link Aggregation (LAG/LACP) & Redundant Trunk Groups (RTG) 12.3 Virtual Chassis Roles and Elections 12.4 Virtual Chassis Links, Splits and Provisioning 12.5 Routing Engine Redundancy: GRES, NSR, NSB and GR 12.6 BFD Detection and VRRP Gateway Redundancy 12.7 Unified ISSU: Requirements and Verification

5.2 MACsec Link Security and Key Agreement

Key Takeaways Explain This Topic AI

MACsec is IEEE 802.1AE protection for an Ethernet link; every protected hop needs its own supported configuration.

A connectivity association describes the trusted peers; MKA manages secure association keys in CAK modes.

Static CAK configuration needs matching CKN/CAK values and an interface association; creating the association alone does not protect traffic.

Validate key agreement, protected traffic counters and MTU support on both endpoints before declaring a link secured.

Last updated: October 2026

Why MACsec Is a Separate Layer 2 Security Skill

A VLAN separates broadcast domains, but it does not encrypt traffic on the wire. DHCP snooping checks selected control messages, and a MAC limit restricts learned source addresses. Neither prevents someone with access to the physical link from reading unencrypted Ethernet payloads. Media Access Control Security (MACsec) , standardized in IEEE 802.1AE, provides Ethernet-frame integrity and data-origin protection, with confidentiality when encryption is enabled. Replay protection helps reject old protected frames presented again.

The protection applies between MACsec peers on a supported Ethernet link. Suppose Access A connects through Distribution B to Core C. Protecting A–B does not automatically protect B–C. Each link has its own association and security state. A routed IPsec VPN instead protects traffic between IPsec endpoints across a routed network. Select the technology from the required protection boundary rather than from the fact that both can encrypt data.

Associations, Channels and Keys

A connectivity association (CA) identifies the cooperating security relationship. A secure channel is a unidirectional flow of protected frames from one participant; a secure association (SA) identifies a particular key/state used on that channel. Key rollover can replace an SA without redefining the VLAN or changing the host’s IP subnet.

In connectivity association key modes, MACsec Key Agreement (MKA) establishes and maintains the working security relationship. The CAK supplies the association’s keying basis, while the CKN identifies that keying context. The elected key server distributes a working secure association key (SAK) . These names are not interchangeable: the manually provisioned CAK is not simply a fixed frame-encryption key copied unchanged into every packet. Working SAKs can be refreshed during operation.

Mode or component Operational meaning

Static CAK Administrators provision compatible association credentials on the switch/router peers; MKA manages working SAKs

Dynamic CAK Authentication supplies association keying material; Juniper’s switch-to-host design uses 802.1X/EAP-TLS and certificate infrastructure

Static SAK, where supported Administrators directly manage secure associations and their keys; it has a different configuration model

Interface association Binds the security relationship to the actual Ethernet link carrying traffic

Do not assume a mode supported on one Juniper platform exists on every EX, QFX, MX or SRX interface. Port, optic, speed, licensing and release restrictions can determine whether the design is possible. The exam’s concept is the protection mechanism and its dependencies; production configuration must follow the actual hardware support matrix.

Reading a Junos Configuration

For an applicable static-CAK switch-to-switch link, the high-level work is to create a named connectivity association, choose security-mode static-cak , configure its CKN and CAK on both endpoints, and attach it under security macsec interfaces . The following shows the attachment and mode only; it intentionally omits key material and is not a complete deployable configuration: [edit]

• set security macsec connectivity-association CAMPUS security-mode static-cak
• set security macsec interfaces ge-0/0/0 connectivity-association CAMPUS

Creating CAMPUS without the final interface reference does not enable MACsec on ge-0/0/0 . Conversely, matching local association names alone proves nothing about the remote peer’s credentials. Confirm the actual key context, mode and selected interface. Keep real secrets out of tickets and shared examples; an invented sample key is not evidence that a live link negotiated successfully.

Operational Verification and Failure Scenarios

Use the supported show security macsec statistics, connection and interface views to check agreement and protected traffic in both directions. First establish that the physical interface is up. Then check MKA/association state and the installed transmit/receive SAs. Finally, send controlled traffic and verify that protected frame counters rise on both peers. A link-up LED establishes physical carrier, not encryption.

If physical carrier is present but agreement fails, compare static CAK/CKN values, security mode and the interface attachment. If agreement succeeds but traffic fails, inspect MTU, validation/replay counters and platform-specific behavior. MACsec adds framing overhead; Juniper’s configuration guide requires allowing space for the documented overhead between media and protocol MTUs. A design passing small pings can still lose larger frames if the wire-size budget is wrong.

A replay/validation error counter should lead to a specific investigation: peer state, key rollover, ordering, cabling path or incompatible settings. Disabling validation just to make counters stop would defeat the security requirement. Likewise, MACsec does not replace access authentication or routing policy. An authorized compromised endpoint can originate harmful traffic inside a valid protected channel; the cryptographic protection confirms the link relationship, not that every application request is appropriate.

Before accepting a scenario as “secure,” identify both MACsec endpoints, the key agreement mechanism, the protected direction and actual counters. This reasoning separates an incomplete configuration from a key mismatch and from a packet-size fault.

Official references checked 2026-10-18: MACsec configuration , security modes , and interface association .