MACsec: Configurable EAPOL address

You can configure an Extensible Authentication Protocol over LAN (EAPoL) destination MAC address by including the eapol-address (pae | provider-bridge | lldp-multicast) statement at the [set security macsec connectivity-association connectivity-association-name mka] hierarchy level. 

To establish a MACsec session, MACsec Key Agreement PDUs are sent or received between nodes. These PDUs are EAPoL packets and, by default, their destination MAC address is the EAPoL multicast address 01:80:C2:00:00:03. If the nodes are connected through a provider network, they might consume these multicast packets or drop them depending on their configuration. To overcome this issue, configure the EAPoL address for PAE, provider-bridge, and LLDP multicast by using the aforementioned configuration.

You can also configure the destination EAPoL address for MACsec as a unicast address. When MACsec Key Agreement PDUs (MKAPDUs) are exchanged over a provider network, they might be dropped or consumed if the default multicast address is used. You can configure the unicast MAC address to ensure the MKAPDUs reach their destination.