To apply MACsec protection to a Link Aggregation Group (LAG), MACsec must be individually enabled on each physical port within the LAG. MACsec cannot be enabled on the top level LAG port (for example, the command set macsec port mka enable lag.0.1 is not allowed).