Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Configuring MAC Limiting (CLI Procedure)

Configuring MAC Limiting for Port Security by Limiting the Number of MAC Addresses That Can be Learned on Interfaces

• Apply the MAC limit on a single interface (here, the interface is ge-0/0/1):
  [edit ethernet-switching-options secure-access-port]
user@switch# set interface ge-0/0/1 mac-limit 10

  When no action is specified for configuring the MAC limit on an interface, the switch performs the default action drop if the limit is exceeded.

• Apply the MAC limit on a single access interface, on the basis of its membership within a specific VLAN (here, the interface is ge-0/0/1 and the VLAN is v1.
  [edit ethernet-switching-options secure-access-port]
user@switch# set interface ge–0/0/1 vlan v1 mac-limit 5

  With this type of configuration, the switch drops any additional packets if the limit is exceeded, and also logs a message.

• Apply the limit to all access interfaces:
  [edit ethernet-switching-options secure-access-port]
user@switch# set interface all mac-limit 10

  When no action is specified for configuring the MAC limit on all interfaces, the switch performs the default action drop if the limit is exceeded:

Configuring MAC Limiting for Port Security by Specifying MAC Addresses That Are Allowed

You must clear existing entries in the MAC address forwarding table prior to changing the MAC address limit.

• On a single interface (here, the interface is ge-0/0/2):
  [edit ethernet-switching-options secure-access-port]
user@switch# set interface ge–0/0/2 allowed-mac 00:05:85:3A:82:80
user@switch# set interface ge–0/0/2 allowed-mac 00:05:85:3A:82:81
user@switch# set interface ge–0/0/2 allowed-mac 00:05:85:3A:82:83

• On all interfaces:
  [edit ethernet-switching-options secure-access-port]
user@switch#set interface all allowed-mac 00:05:85:3A:82:80
user@switch#set interface all allowed-mac 00:05:85:3A:82:81
user@switch#set interface all allowed-mac 00:05:85:3A:82:83

Configuring MAC Limiting for VLANs

You must clear existing entries in the MAC address forwarding table before you can change the MAC address limit.

MAC limiting for a VLAN restricts the MAC addresses that can be learned for that VLAN, but does not drop the packet. Therefore, setting the MAC limit on a VLAN is not considered a port-security feature.

Note: The configuration of specific allowed MAC addresses does not apply to VLANs.

• Limit the number of dynamic MAC addresses on a VLAN:

  If the MAC limit on a specific VLAN is exceeded, the switch logs the MAC addresses of packets that cause the limit to be exceeded. No other action is possible.

  [edit vlans]
user@switch# set vlan-abc mac-limit 20

  Note: When you are applying a MAC limit on a VLAN, do not set mac-limit to 1 for a VLAN composed of Routed VLAN Interfaces (RVIs) or a VLAN composed of aggregated Ethernet bundles using LACP. In these cases, setting the mac-limit to 1 prevents the switch from learning MAC addresses other than the automatic addresses: For RVIs, the first MAC address inserted into the forwarding database is the MAC address of the RVI. For aggregated Ethernet bundles using LACP, the first MAC address inserted into the forwarding database in the forwarding table is the source address of the protocol packet. If the VLAN is composed of regular access or trunk interfaces, you can set the mac-limit to 1 if you choose to do so.