Configuring the MAC address table· 1

Overview·· 1

How a MAC address entry is created· 1

Types of MAC address entries 2

Configuring the MAC address table task list 2

Configuring MAC address entries 3

Configuration guidelines 3

Adding or modifying a static or dynamic MAC address entry globally· 4

Adding or modifying a static or dynamic MAC address entry on an interface· 4

Adding or modifying a blackhole MAC address entry· 4

Adding or modifying a multiport unicast MAC address entry· 5

Disabling MAC address learning· 6

Disabling MAC address learning on interfaces 6

Disabling MAC address learning on a VLAN·· 6

Setting the aging timer for dynamic MAC address entries 7

Setting the MAC learning limit 7

Setting the MAC learning limit on interfaces 7

Setting the MAC learning limit for a VLAN·· 8

Configuring the unknown frame forwarding rule after the MAC learning limit is reached· 8

Configuring the device to forward unknown frames after the MAC learning limit on an interface is reached  9

Configuring the device to forward unknown frames after the MAC learning limit for a VLAN is reached· 9

Configuring MAC address move notifications and suppression· 9

Configuring MAC address move notifications 10

Configuring MAC address move suppression· 10

Enabling SNMP notifications for the MAC address table· 11

Displaying and maintaining the MAC address table· 12

MAC address table configuration example· 12

Network requirements 12

Configuration procedure· 12

Verifying the configuration· 13

 

Overview

An Ethernet device uses a MAC address table to forward frames. A MAC address entry contains a destination MAC address, an outgoing interface, and a VLAN ID. When the device receives a frame, it uses the destination MAC address of the frame to look for a match in the MAC address table.

·     The device forwards the frame out of the outgoing interface in the matching entry if a match is found.

·     The device floods the frame to all interfaces in the VLAN of the frame if no match is found.

How a MAC address entry is created

The entries in the MAC address table include entries automatically learned by the device and entries manually added.

MAC address learning

The device can automatically populate its MAC address table by learning the source MAC addresses of incoming frames on each interface.

When a frame arrives at an interface (for example, port A), the device performs the following tasks:

1.     Checks the source MAC address (for example, MAC-SOURCE) of the frame.

2.     Looks up the source MAC address in the MAC address table.

¡     The device updates the entry if an entry is found.

¡     The device adds an entry for MAC-SOURCE and port A if no entry is found.

3.     When the device receives a frame destined for MAC-SOURCE after learning this source MAC address, the device performs the following tasks:

a.     Finds the MAC-SOURCE entry in the MAC address table.

b.     Forwards the frame out of port A.

The device performs the learning process each time it receives a frame with an unknown source MAC address until the table is fully populated.

Manually configuring MAC address entries

Dynamic MAC address learning does not distinguish between illegitimate and legitimate frames, which can invite security hazards. When Host A is connected to port A, a MAC address entry will be learned for the MAC address of Host A (for example, MAC A). When an illegal user sends frames with MAC A as the source MAC address to port B, the device performs the following tasks:

1.     Learns a new MAC address entry with port B as the outgoing interface and overwrites the old entry for MAC A.

2.     Forwards frames destined for MAC A out of port B to the illegal user.

As a result, the illegal user obtains the data of Host A. To improve the security for Host A, you can manually configure a static entry to bind Host A to port A. Then, the frames destined for Host A are always sent out of port A. Other hosts using the forged MAC address of Host A cannot obtain the frames destined for Host A.

Types of MAC address entries

A MAC address table can contain the following types of entries:

·     Static entries—A static entry is manually added in order to forward frames with a specific destination MAC address out of the associated interface, and it never ages out. A static entry has higher priority than a dynamically learned one.

·     Dynamic entries—A dynamic entry can be manually configured or dynamically learned to forward frames with a specific destination MAC address out of the associated interface. A dynamic entry might age out. A manually configured dynamic entry has the same priority as a dynamically learned one.

·     Blackhole entries—A blackhole entry is manually configured and never age out. A blackhole entry is configured for filtering out frames with a specific source or destination MAC address. For example, to block all frames destined for or sourced from a user, you can configure the MAC address of the user as a blackhole MAC address entry.

·     Multiport unicast entries—A multiport unicast entry is manually added to send frames with a specific unicast destination MAC address out of multiple ports, and it never ages out. A multiport unicast entry has higher priority than a dynamically learned one.

A static, blackhole, or multiport unicast MAC address entry can overwrite a dynamic MAC address entry, but not vice versa.

Configuring the MAC address table task list

The configuration tasks discussed in the following sections can be performed in any order.

The MAC address table can contain only Layer 2 Ethernet interfaces and Layer 2 aggregate interfaces.

This document covers only the configuration of unicast MAC address entries, including static, dynamic, blackhole, and multiport unicast MAC address entries. For information about configuring static multicast MAC address entries, see IP Multicast Configuration Guide.

To configure the MAC address table, perform the following tasks:

 

Tasks at a glance
(Optional.) Configuring MAC address entries ·     Adding or modifying a static or dynamic MAC address entry globally ·     Adding or modifying a static or dynamic MAC address entry on an interface ·     Adding or modifying a blackhole MAC address entry ·     Adding or modifying a multiport unicast MAC address entry
(Optional.) Disabling MAC address learning
(Optional.) Setting the aging timer for dynamic MAC address entries
(Optional.) Setting the MAC learning limit
(Optional.) Configuring the unknown frame forwarding rule after the MAC learning limit is reached
(Optional.) Configuring MAC address move notifications and suppression
(Optional.) Enabling SNMP notifications for the MAC address table

 

Configuring MAC address entries

Configuration guidelines

·     You cannot add a dynamic MAC address entry if a learned entry already exists with a different outgoing interface for the MAC address.

·     The manually configured static, blackhole, and multiport unicast MAC address entries cannot survive a reboot if you do not save the configuration. The manually configured dynamic MAC address entries are lost upon reboot whether or not you save the configuration.

A frame whose source MAC address matches different types of MAC address entries is processed differently.

 

Type	Description
Static MAC address entry	·     Discards the frame received on a different interface from that in the entry. ·     Forwards the frame received on the same interface with that in the entry.
Multiport unicast MAC address entry	Learns the MAC address (for example, MAC A) of the frame, generates a dynamic MAC address entry for MAC A, and forwards the frame. However, the generated dynamic MAC address entry does not take effect. Frames destined for MAC A are forwarded based on the multiport unicast MAC address entry.
Dynamic MAC address entry	·     Learns the MAC address of the frames received on a different interface from that in the entry and overwrites the original entry. ·     Forwards the frame received on the same interface with that in the entry and updates the aging timer for the entry.

 

Adding or modifying a static or dynamic MAC address entry globally

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Add or modify a static or dynamic MAC address entry.	mac-address { dynamic | static } mac-address interface interface-type interface-number vlan vlan-id	By default, no MAC address entry is configured globally. Make sure you have created the VLAN and assigned the interface to the VLAN.

 

Adding or modifying a static or dynamic MAC address entry on an interface

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter interface view.	·     Enter Layer 2 Ethernet interface view: interface interface-type interface-number ·     Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number	N/A
3.     Add or modify a static or dynamic MAC address entry.	mac-address { dynamic | static } mac-address vlan vlan-id	By default, no MAC address entry is configured on an interface. Make sure you have created the VLAN and assigned the interface to the VLAN.

 

Adding or modifying a blackhole MAC address entry

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Add or modify a blackhole MAC address entry.	mac-address blackhole mac-address vlan vlan-id	By default, no blackhole MAC address entry is configured. Make sure you have created the VLAN.

 

Adding or modifying a multiport unicast MAC address entry

You can configure a multiport unicast MAC address entry to associate a unicast destination MAC address with multiple ports. The frame with a destination MAC address matching the entry is sent out of multiple ports.

For example, when a group of servers are processing a request from a client, the client does not know that more than one server is responding. In this case, you can configure a multiport unicast MAC address entry on the device connected to the group of servers. The device forwards the frame destined for the server group to every server.

You can configure a multiport unicast MAC address entry globally or on an interface.

Configuring a multiport unicast MAC address entry globally

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Add or modify a multiport unicast MAC address entry.	mac-address multiport mac-address interface interface-list vlan vlan-id	By default, no multiport unicast MAC address entry is configured globally. Make sure you have created the VLAN and assigned the interface to the VLAN.

 

Configuring a multiport unicast MAC address entry on an interface

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter interface view.	·     Enter Layer 2 Ethernet interface view: interface interface-type interface-number ·     Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number	N/A
3.     Add the interface to a multiport unicast MAC address entry.	mac-address multiport mac-address vlan vlan-id	By default, no multiport unicast MAC address entry is configured on an interface. Make sure you have created the VLAN and assigned the interface to the VLAN.

 

The mac-address multiport command specifies the MAC address for a multiport unicast MAC address entry. The ipv6 neighbor command specifies the MAC address for a static neighbor entry. In IRF mode, to avoid a conflict, make sure these two MAC addresses are different. For more information about static neighbor entries, see Layer 3—IP Services Configuration Guide.

The multiport unicast MAC address entries on an Ethernet interface might not take effect after the Ethernet interface joins an aggregation group. H3C recommends that you configure multiport unicast MAC address entries on aggregate interfaces in Layer 2 aggregate interface view.

Disabling MAC address learning

MAC address learning is enabled by default. To prevent the MAC address table from being saturated when the device is experiencing attacks, disable MAC address learning. For example, you can disable MAC address learning to prevent the device from being attacked by a large amount of frames with different source MAC addresses.

After MAC address learning is disabled, the existing dynamic MAC addresses age out still based on the aging mechanism.

Disabling MAC address learning on interfaces

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter interface view.	·     Enter Layer 2 Ethernet interface view: interface interface-type interface-number ·     Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number	N/A
3.     Disable MAC address learning on the interface.	undo mac-address mac-learning enable	By default, MAC address learning on the interface is enabled.

 

Disabling MAC address learning on a VLAN

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enable global MAC address learning.	mac-address mac-learning enable	By default, global MAC address learning is enabled.
3.     Enter VLAN view.	vlan vlan-id	N/A
4.     Disable MAC address learning on the VLAN.	undo mac-address mac-learning enable	By default, MAC address learning on the VLAN is enabled.

 

Setting the aging timer for dynamic MAC address entries

For security and efficient use of table space, the MAC address table uses an aging timer for each dynamic MAC address entry. If a dynamic MAC address entry is not updated before the aging timer expires, the device deletes the entry. This aging mechanism ensures that the MAC address table could promptly update to accommodate latest network topology changes.

A stable network requires a longer aging interval, and an unstable network requires a shorter aging interval.

An aging interval that is too long might cause the MAC address table to retain outdated entries. As a result, the MAC address table resources might be exhausted, and the MAC address table might fail to update its entries to accommodate the latest network changes.

An interval that is too short might result in removal of valid entries, which would cause unnecessary floods and possibly affect the device performance.

To reduce floods on a stable network, set a long aging timer or disable the timer to prevent dynamic entries from unnecessarily aging out. Reducing floods improves network performance. Reducing flooding also improves the security because it reduces the chances for a data frame to reach unintended destinations.

To set the aging timer for dynamic MAC address entries:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Set the aging timer for dynamic MAC address entries.	mac-address timer { aging seconds | no-aging }	By default, the aging timer for dynamic MAC address entries is 300 seconds. The no-aging keyword disables the aging timer.

 

Setting the MAC learning limit

Setting the MAC learning limit on interfaces

This feature limits the MAC address table size. A large MAC address table will degrade forwarding performance.

To set the MAC learning limit on an interface:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter interface view.	·     Enter Layer 2 Ethernet interface view: interface interface-type interface-number ·     Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number	N/A
3.     Set the MAC learning limit on the interface.	mac-address max-mac-count count	By default, no MAC learning limit on the interface is set.

 

Setting the MAC learning limit for a VLAN

You can also limit the number of MAC addresses that can be learned on a per-VLAN basis.

This feature does not work on a super VLAN, because a super VLAN has no physical interfaces and cannot learn any MAC addresses. For more information about super VLANs, see "Configuring super VLANs."

To set the MAC learning limit for a VLAN:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter VLAN view.	vlan vlan-id	N/A
3.     Set the MAC leaning limit for the VLAN.	mac-address max-mac-count count	By default, no MAC learning limit for the VLAN is set.

 

Configuring the unknown frame forwarding rule after the MAC learning limit is reached

You can enable or disable forwarding of unknown frames after the MAC learning limit is reached.

In this document, unknown frames refer to frames whose source MAC addresses are not in the MAC address table.

Configuring the device to forward unknown frames after the MAC learning limit on an interface is reached

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter interface view.	·     Enter Layer 2 Ethernet interface view. interface interface-type interface-number ·     Enter Layer 2 aggregate interface view. interface bridge-aggregation interface-number	N/A
3.     Configure the device to forward unknown frames received on the interface after the MAC learning limit on the interface is reached.	mac-address max-mac-count enable-forwarding	By default, the device can forward unknown frames received on an interface after the MAC learning limit on the interface is reached.

 

Configuring the device to forward unknown frames after the MAC learning limit for a VLAN is reached

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter VLAN view.	vlan vlan-id	N/A
3.     Configure the device to forward unknown frames received on interfaces in the VLAN after the MAC learning limit for the VLAN is reached.	mac-address max-mac-count enable-forwarding	By default, the device can forward unknown frames received on interfaces in a VLAN after the MAC learning limit for the VLAN is reached.

 

Configuring MAC address move notifications and suppression

The outgoing interface for a MAC address entry learned on interface A is changed to interface B when the following conditions exist:

·     Interface B receives a packet with the MAC address as the source MAC address.

·     Interface B belongs to the same VLAN as interface A.

In this case, the MAC address is moved from interface A to interface B, and a MAC address move occurs.

If a MAC address is continuously moved between the two interfaces, Layer 2 loops might occur. To detect and locate loops, you can configure MAC address move notifications and MAC address move suppression.

Configuring MAC address move notifications

This feature enables the device to output MAC address move logs when MAC address moves are detected.

To display the MAC address move records after the device is started, use the display mac-address mac-move command.

To configure MAC address move notifications:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enable MAC address move notifications, and optionally specify a detection interval.	mac-address notification mac-move [ interval interval-value ]	By default, MAC address move notifications are disabled. If you do not specify a detection interval, the default setting of 1 minute is used. To enable the system to display MAC address move logs, you must execute the snmp-agent trap enable mac-address command after executing the mac-address notification mac-move command.
3.     (Optional.) Enable MAC address move suppression.	mac-address notification mac-move suppression [ interval interval-value ]	By default, MAC address move suppression is disabled.

 

Configuring MAC address move suppression

When the system detects that a MAC address frequently moves to or from an interface, you can configure MAC address move suppression on the interface to bring it down. The interface can automatically come up after waiting for the specified suppression interval. Also, you can use the shutdown command and then the undo shutdown command to bring up the interface.

To configure MAC address move suppression:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     (Optional.) Set a MAC address move suppression interval.	mac-address notification mac-move suppression interval interval-value	The default setting is 30 seconds.
3.     (Optional.) Set a threshold for MAC address moves sourced from or destined for an interface within a detection interval.	mac-address notification mac-move suppression threshold threshold-value	The default setting is 3.
4.     Enter interface view.	·     Enter Layer 2 Ethernet interface view: interface interface-type interface-number ·     Enter Layer 2 aggregate interface: interface bridge-aggregation interface-number	N/A
5.     Enable MAC address move suppression.	mac-address notification mac-move suppression	By default, MAC address move suppression is disabled.

 

Enabling SNMP notifications for the MAC address table

After you enable SNMP notifications for the MAC address table, the device will send SNMP notifications to the SNMP module to notify the NMS of important events. You can set the notification sending parameters in SNMP to determine the attributes of sending notifications.

After you disable SNMP notifications for the MAC address table, the device will send log messages to the information center module. You can set the output rules and destinations to examine the log messages of the MAC address table module.

For more information about SNMP and information center, see Network Management and Monitoring Configuration Guide.

To enable SNMP notifications for the MAC address table:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enable SNMP notifications for the MAC address table.	snmp-agent trap enable mac-address [ mac-move ]	By default, SNMP notifications are enabled for the MAC address table.

 

Displaying and maintaining the MAC address table

Execute display commands in any view.

 

Task	Command
Display MAC address table information.	display mac-address [ mac-address [ vlan vlan-id ] | [ [ dynamic | static ] [ interface interface-type interface-number ] | blackhole | multiport ] [ vlan vlan-id ] [ count ] ]
Display the aging timer for dynamic MAC address entries.	display mac-address aging-time
Display the system or interface MAC address learning state.	display mac-address mac-learning [ interface interface-type interface-number ]
Display the MAC address move records (in standalone mode).	display mac-address mac-move [ slot slot-number ]
Display the MAC address move records (in IRF mode).	display mac-address mac-move [ chassis chassis-number [ slot slot-number ] ]

 

MAC address table configuration example

By default, Ethernet, VLAN, and aggregate interfaces are shut down. You must use the undo shutdown command to bring them up. This example assumes that all these interfaces are already up.

Network requirements

On a network:

·     Host A at MAC address 000f-e235-dc71 is connected to interface GigabitEthernet 3/0/1 of Device and belongs to VLAN 1.

·     Host B at MAC address 000f-e235-abcd, which behaved suspiciously on the network, also belongs to VLAN 1.

Configure the MAC address table as follows:

·     To prevent MAC address spoofing, add a static entry for Host A in the MAC address table of Device.

·     To drop all frames destined for Host B, add a blackhole MAC address entry for Host B.

·     Set the aging timer to 500 seconds for dynamic MAC address entries.

Configuration procedure

# Add a static MAC address entry for MAC address 000f-e235-dc71 on GigabitEthernet 3/0/1 that belongs to VLAN 1.

<Device> system-view

[Device] mac-address static 000f-e235-dc71 interface GigabitEthernet 3/0/1 vlan 1

# Add a blackhole MAC address entry for MAC address 000f-e235-abcd that belongs to VLAN 1.

[Device] mac-address blackhole 000f-e235-abcd vlan 1

# Set the aging timer for dynamic MAC address entries to 500 seconds.

[Device] mac-address timer aging 500

Verifying the configuration

# Display the static MAC address entry for interface GigabitEthernet 3/0/1.

[Device] display mac-address static interface GigabitEthernet 3/0/1

MAC Address      VLAN ID    State            Port/NickName            Aging

000f-e235-dc71   1          Static           GE3/0/1                  N

# Display the blackhole MAC address entries.

[Device] display mac-address blackhole

MAC Address      VLAN ID    State            Port/NickName            Aging

000f-e235-abcd   1          Blackhole        N/A                      N

# Display the aging time of dynamic MAC address entries.

[Device] display mac-address aging-time

MAC address aging time: 500s.