A bank sets MACsec on a leaf-to-spine link with the security policy must-secure. The spine has no MACsec key agreement. User frames on that hop disappear. What does must-secure do with those frames?
Select an answer to reveal the explanation.
Short Explanation
You locked the door and the other side never picked up a key. Must-secure means frames without MACsec headers are dropped. The spine never starts key agreement, so the frames on that hop are not MACsec frames, and they do not pass.
Full Explanation
MACsec protects one Ethernet hop. The NX-OS security policy must-secure drops packets that do not carry MACsec headers, which is why user traffic disappears when the spine has no matching key agreement. The leaf will not fall back to cleartext under that policy. Encryption stops at the device that terminates the hop. Must-secure does not keep the frame encrypted after the spine routes it, and it cannot encrypt a path whose far side never ran MACsec. Permitting cleartext when key agreement fails is the should-secure behavior, and should-secure is not the policy on this link. OSPF key-chain authentication checks routing packets. It does not encrypt Ethernet frames, and it is not what this MACsec policy is doing. Caveat: both ends of the hop need a matching MACsec key and policy or the session never secures. Fixing only the leaf leaves the drop in place. Operational check: confirm the MKA session is up on this link, then confirm frames forward, before you look at any contract or routing key.