You work for a large organization that recently implemented a 100GB Cloud Interconnect connection between...

MACsec (Media Access Control Security) relies on a shared secret (a pre-shared key, made up of a Connectivity Key Name, CKN, and Connectivity Association Key, CAK) to establish a secure session between the two endpoints. If the session is "operationally down," it indicates a cryptographic mismatch.

Extracts:

"MACsec is operationally down on my Cloud Interconnect connection... The issue could be caused by one of the following: The active keys on your on-premises router and Google's edge routers don't match." (Source 3.1)

The troubleshooting guide further specifies checking that the "active CKN, CAK, and start times on your on-premises router match the values that MACsec for Cloud Interconnect displays." (Source 3.1)

Therefore, the primary and most common step to resolve a "MACsec is operationally down" status is to verify that the cryptographic keys (the pre-shared key) are correctly configured and match on both the on-premises and Google Cloud routers.