There are two main modes of encryption in MACsec:
VLAN in clear text (WAN Mode)
VLAN encrypted
802.1AE dictates that the 802.1Q VLAN needs to be encrypted. Some vendors give the option of configuring the MACsec on a port with VLAN in clear text.
SR OS supports both modes. On the 7750 SR and 7450 ESS, 1/10 Gig cards support both mode of operation.
Figure: 802.1 AE LAN and WAN modes and VLAN encrypted/clear shows the VLAN encrypted and VLAN in clear.
Figure: 802.1 AE LAN and WAN modes and VLAN encrypted/clear
