Supported Platforms
Configuring MAC Address Validation for Subscriber Interfaces
This topic describes how to configure MAC address validation for subscriber interfaces in dynamic profiles on MX Series routers.
The subscriber interfaces can be statically created and associated with a dynamic profile (for example, VLAN interfaces) or dynamically created in the dynamic profile (such as demux interfaces).
By default, MAC address validation is disabled.
This topic contains the following sections:
Configuring MAC Address Validation for Static Subscriber Interfaces
This topic describes how to configure MAC address validation for static subscriber interfaces in dynamic profiles on MX Series routers.
Before you begin:
- Configure the dynamic profile.
- (Optional) Configure an enhanced network services mode.
See Configuring Junos OS to Run a Specific Network Services Mode in MX Series Routers.
To configure MAC address validation on static subscriber interfaces:
- Configure the static VLAN interface. [edit interfaces]user@host# set interface-name unit logical-unit-number family inet
- Configure the type of MAC address validation for the interface.
- To configure loose validation:[edit interfaces interface-name unit logical-unit-number family inet] user@host# set mac-validate loose
- To configure strict validation:[edit interfaces interface-name unit logical-unit-number family inet] user@host# set mac-validate strict
- To configure loose validation:
For example, to configure loose validation on interface fe-0/0/0.0, configure the following:
After you configure MAC address validation:
- Associate the static VLAN interface with the dynamic profile.
See Associating Dynamic Profiles with Statically Created Interfaces.
Configuring MAC Address Validation for Dynamic Subscriber Interfaces
This topic describes how to configure MAC address validation for subscriber interfaces created on demux interfaces in dynamic profiles on MX Series routers.
When you configure MAC address validation for demux interfaces in a dynamic profile and specify either loose or strict validation, the resulting behavior is always loose validation. To enable strict behavior for a dynamic IP demux interface, besides configuring either loose or strict mode on the IP demux interface, you must also configure strict validation on the underlying interface.
Before you begin:
- Configure the dynamic profile.
- Configure the dynamic IP demux interface.
See Configuring Dynamic Subscriber Interfaces Using IP Demux Interfaces in Dynamic Profiles.
- (Optional) Configure an enhanced network services mode.
See Configuring Junos OS to Run a Specific Network Services Mode in MX Series Routers.
To configure loose MAC address validation for a dynamic subscriber interface:
- Configure loose validation for the demux interface.[edit dynamic-profiles profile-name interfaces demux0 unit “$junos-interface-unit” family inet]user@host# set mac-validate loose
For loose validation, you do not need to configure MAC address validation on the underlying interface.
To configure strict MAC address validation for a dynamic subscriber interface:
- Configure validation for the demux interface.[edit dynamic-profiles profile-name interfaces demux0 unit “$junos-interface-unit” family inet]user@host# set mac-validate validation-mode
Note: Remember, although you must configure validation on the IP demux interface, it does not matter which mode you specify because the behavior is always loose.
- Configure strict validation for the underlying interface.[edit interfaces interface-name unit logical-unit-number family inet]user@host# set mac-validate strict
The underlying interface in this case is statically configured—for example, ge-1/0/0.1—and assigned to a DHCP configuration group that is associated with the dynamic profile. In a more complicated configuration, the underlying interface itself can be configured by a dynamic profile; in that case the validation is configured in the profile that creates the underlying interface.
