[DNX]- sonic-clear macsec, does not clear the macsec counters since rekey causes anomaly in the counters. #19311
Assignees
Labels
Comments
|
@amitpawar12 I checked on our lab testbed -- I see it cleans correctly. |
|
Can you share the exact sequence you tried ? Also you have the traffic stopped when you clear ? Another option with sonic-clear macsec --clean-cache true, which will clear the cache if there. |
|
Sure @judyjoseph. Let me also try with '--clean-cache true' and get back to you. Thanks, |
|
@amitpawar12 I found an issue with "sonic-clear macsec" when the rekey is enabled. I will raise a PR to fix this. Meanwhile as a work around disable rekey by setting rekey_interval = 0 in th emacsec profile, it should work fine. |
|
Working with Brcm, via CSP CS00012356026 |
|
I checked on this again. So according to the current implementation, when we do a rekey -- the key (combination of "PORT:SA_ID:AN_bit" changes ) and the various counters v.z IN_PKTS_OK, OCTETS_ENCRYPTED etc gets reset. Let me know your observations. |
|
Hi @judyjoseph , @vmittal-msft - I still continue to see this issue. The reset happens for a while. But after 2-5 mins, the counters pop up again. |
|
@amitpawar12 can you check if the macsec session is getting rekeyed. This happens on rekey either from sonic/ixia end. |
|
@judyjoseph - You are right. I configured the rekey interval to an hour to test this. Log output: |
|
Will not be fix for 202205. FIx wil targetted for 202405. |
|
@judyjoseph - as a data point, we ran a controlled test with fixed packets. What we observed is that before the rekey, the values are correctly updated but on rekey, they just go to some junk value. Snapshot: |
amitpawar12
changed the title
|
Raised a CSP with Brcm (CS00012371780) to make sure all the counters are cumulative, currently few SAI counters are not cummulative across rekey |
6 tasks
|
@judyjoseph to validate the SAI fix. |
|
@arlakshm can you review this SAI fix ? https://dev.azure.com/mssonic/broadcom/_git/bcm_sai_external_sug/pullrequest/8578. The fix is validated. |
|
The SAI fix is already present in 11.2.18.1 (#21189) |
|
@amitpawar12 ,can you please retest on the latest 202405 image and close this issue if the problem is fixed? |
@arlakshm , I am waiting for the issue #21232 to resolve before I can verify this. Thanks, |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
Steps to reproduce the issue:
Describe the results you received:
Sent some packets over macsec.
Check the macsec statistics:
Describe the results you expected:
'sonic-clear macsec' should have cleared the octets encrypted. The same issue is also for ingress SA as well. Hence it becomes difficult to compare the number of packets encrypted during the test, as the counter just piles up pretty quickly.
Output of
show version:Output of
show techsupport:Additional information you deem important (e.g. issue happens only occasionally):
The text was updated successfully, but these errors were encountered: