close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Common Configuration for All VPNs
- play_arrow VPNs Overview
- play_arrow Assigning Routing Instances to VPNs
- play_arrow Distributing Routes in VPNs
- play_arrow Distributing VPN Routes with Target Filtering
- play_arrow Configuring Forwarding Options for VPNs
  - Chained Composite Next Hops for VPNs and Layer 2 Circuits
  - Example: Configuring Chained Composite Next Hops for Direct PE-PE Connections in VPNs
- play_arrow Configuring Graceful Restart for VPNs
- play_arrow Configuring Class of Service for VPNs
  - VPNs and Class of Service
  - Rewriting Class of Service Markers and VPNs
- play_arrow Pinging VPNs
play_arrow Common Configuration for Layer 2 VPNs and VPLS
- play_arrow Overview
- play_arrow Layer 2 VPNs Configuration Overview
- play_arrow Configuring Layer 2 Interfaces
- play_arrow Configuring Path Selection for Layer 2 VPNs and VPLS
  - Understanding BGP Path Selection
  - Enabling BGP Path Selection for Layer 2 VPNs and VPLS
- play_arrow Creating Backup Connections with Redundant Pseudowires
  - Redundant Pseudowires for Layer 2 Circuits and VPLS
  - Configuring Redundant Pseudowires for Layer 2 Circuits and VPLS
- play_arrow Configuring Class of Service for Layer 2 VPNs
  - Configuring Traffic Policing in Layer 2 VPNs
- play_arrow Monitoring Layer 2 VPNs
play_arrow Configuring Group VPNs
- play_arrow Configuring Group VPNv2
play_arrow Configuring Public Key Infrastructure
- play_arrow Configuring Digital Certificate Validation
  - Understanding Digital Certificate Validation
  - Example: Improving Digital Certificate Validation by Configuring Policy OIDs on an MX Series Device
- play_arrow Configuring a Device for Certificate Chains
  - IKE Authentication (Certificate-Based Authentication)
  - Example: Configuring a Device for Peer Certificate Chain Validation
- play_arrow Managing Certificate Revocation
  - Online Certificate Status Protocol and Certificate Revocation Lists
  - Example: Improving Security by Configuring OCSP for Certificate Revocation Status
play_arrow Configuring Layer 2 Circuits
- play_arrow Overview
  - Layer 2 Circuit Overview
- play_arrow Layer 2 Circuits Configuration Overview
- play_arrow Configuring Class of Service with Layer 2 Circuits
- play_arrow Configuring Pseudowire Redundancy for Layer 2 Circuits
- play_arrow Configuring Load Balancing for Layer 2 Circuits
  - Reducing APS Switchover Time in Layer 2 Circuits
- play_arrow Configuring Protection Features for Layer 2 Circuits
- play_arrow Monitoring Layer 2 Circuits with BFD
  - Configuring BFD for VCCV for Layer 2 Circuits
  - Example: Configuring BFD for VCCV for Layer 2 Circuits
- play_arrow Troubleshooting Layer 2 Circuits
  - Tracing Layer 2 Circuit Operations
play_arrow Configuring VPWS VPNs
- play_arrow Overview
- play_arrow Configuring VPWS VPNs
play_arrow Configuring VPLS
play_arrow Connecting Layer 2 VPNs and Circuits to Other VPNs
- play_arrow Connecting Layer 2 VPNs to Other VPNs
- play_arrow Connecting Layer 2 Circuits to Other VPNs
play_arrow Configuration Statements and Operational Commands
- Junos CLI Reference Overview

list Table of Contents

English

Understanding and Preventing Unknown Unicast Forwarding

date_range 18-Sep-24

arrow_backward

arrow_forward

Unknown unicast traffic consists of unicast packets with unknown destination MAC addresses. By default, the switch floods these unicast packets that traverse a VLAN to all interfaces that are members of that VLAN. Forwarding this type of traffic can create unnecessary traffic that leads to poor network performance or even a complete loss of network service. This flooding of packets is known as a traffic storm.

To prevent a traffic storm, you can disable the flooding of unknown unicast packets to all VLAN interfaces by configuring specific VLANs or all VLANs to forward all unknown unicast traffic traversing them to a specific interface. You can configure multiple VLANs to forward unknown unicast packets to the same interface or configure different interfaces for different VLANs. This channels the unknown unicast traffic traversing VLANs to specific interfaces instead of flooding all interfaces.

Note:

The unknown-unicast-forwarding feature is not supported on QFX10000 Series platforms.

Verifying That Unknown Unicast Packets Are Forwarded to a Single Interface

Purpose
Action
Meaning

Purpose

Verify that a VLAN is forwarding all unknown unicast packets (those with unknown destination MAC addresses) to a single interface instead of flooding unknown unicast packets across all interfaces that are members of that VLAN.

Note:

This procedure uses Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style. For ELS details see: Using the Enhanced Layer 2 Software CLI.

Action

(EX4300 Switches) Display the forwarding interface for unknown unicast packets for a VLAN (here, the VLAN name is v1):

content_copy zoom_out_map
user@switch> show configuration switch-options             

unknown-unicast-forwarding {
    vlan v1 {
        interface ge-0/0/7.0;
    }
}

(EX9200 Switches) Display the forwarding interface for unknown unicast packets:

content_copy zoom_out_map
user@switch> show forwarding-options             

next-hop-group uuf-nhg {
    group-type layer-2;
    interface ge-0/0/7.0;
}

Meaning

The sample output from the show commands show that the unknown unicast forwarding interface for VLAN v1is interface ge-0/0/7.

Configuring Unknown Unicast Forwarding (ELS)

Note:

This task uses Junos OS for EX Series switches or QFX Series with support for the Enhanced Layer 2 Software (ELS) configuration style. For ELS details, see Using the Enhanced Layer 2 Software CLI

The unknown-unicast-forwarding feature is not supported on QFX10000 Series platforms.

Unknown unicast traffic consists of packets with unknown destination MAC addresses. By default, the switch floods these packets that traverse a VLAN to all interfaces associated with that VLAN. This flooding of packets is known as a traffic storm and can negatively impact network performance.

To prevent flooding unknown unicast traffic across the switch, configure unknown unicast forwarding to direct all unknown unicast packets within a VLAN to a specific interface. You can configure each VLAN to divert unknown unicast traffic to a different interface or use the same interface for multiple VLANs.

Configuring Unknown Unicast Forwarding on EX4300 Switches
Configuring Unknown Unicast Forwarding on EX9200 Switches

Configuring Unknown Unicast Forwarding on EX4300 Switches

To configure unknown unicast forwarding options on EX4300 switches:

Configure unknown unicast forwarding for a specific VLAN and specify the interface to which all unknown unicast traffic will be forwarded:
```
[edit switch-options]
user@switch# set unknown-unicast-forwarding vlan vlan-name interface interface-name
```
Configure unknown unicast forwarding for all VLANs and specify the interface to which all unknown unicast traffic will be forwarded:
```
[edit switch-options]
user@switch# set unknown-unicast-forwarding vlan all interface interface-name
```

Configuring Unknown Unicast Forwarding on EX9200 Switches

To configure unknown unicast forwarding on EX9200 switches, you must configure a flood filter and apply it to VLANs for which you want to configure unknown unicast forwarding. Flood filters are firewall filters that are applied only to broadcast, unknown unicast, and multicast (BUM) traffic. If a flood filter is configured, only traffic packets that are of the packet type unknown-unicast are forwarded to the interface on which unicast forwarding is configured. A next-hop group redirects the packets according to the action specified in the flood filter.

To configure the next-hop group that receives Layer 2 packets and then configure the interface to which these packets are forwarded:

Configure the next-hop-group action for the Layer 2 interface expected to receive unknown unicast packets:

content_copy zoom_out_map
[edit forwarding-options]
user@switch# set next-hop-group next-hop-group-name group-type layer-2
[edit forwarding-options]
user@switch# set next-hop-group next-hop-group-name interface interface-name

For example:

content_copy zoom_out_map
[edit forwarding-options]
user@switch# set next-hop-group uuf-nhg group-type layer-2
[edit forwarding-options]
user@switch# set next-hop-group uuf-nhg interface ge-3/1/7.0

Configure a firewall filter with family address type ethernet-switching:

content_copy zoom_out_map
[edit firewall]
user@switch# set family ethernet-switching filter filter-name

For example:

content_copy zoom_out_map
[edit firewall]
user@switch# set family ethernet-switching filter uuf_filter

Configure a term in the firewall filter for the interface that receives unknown unicast packets (the interface specified in Step 1) to discard unknown unicast packets:

content_copy zoom_out_map
[edit firewall family ethernet-switching filter filter-name]
user@switch# set term term-name from interface interface-name
user@switch# set term term-name from traffic-type unknown-unicast
user@switch# set term term-name then discard 

For example:

content_copy zoom_out_map
[edit firewall family ethernet-switching filter uuf_filter]
user@switch# set term source-drop from interface ge-3/1/7.0
user@switch# set term source-drop from traffic-type unknown-unicast
user@switch# set term source-drop then discard 

Configure a term in the firewall filter for unknown unicast packets to be flooded to the interface enabled for unknown unicast forwarding by using next-hop-group (in step 1):

content_copy zoom_out_map
[edit firewall family ethernet-switching filter filter-name]

user@switch# set term term-name from traffic-type unknown-unicast
user@switch# set term term-name then next-hop-group group-name 

For example:

content_copy zoom_out_map
[edit firewall family ethernet-switching filter uuf_filter]

user@switch# set term uuf-flood from traffic-type unknown-unicast
user@switch# set term uuf-flood then next-hop-group uuf-nhg 

Configure a default term for the firewall filter to forward packets other than unknown unicast packets:

content_copy zoom_out_map
[edit firewall family ethernet-switching filter filter-name]

user@switch# set term term-name then accept

For example:

content_copy zoom_out_map
[edit firewall family ethernet-switching filter uuf_filter]

user@switch# set term fwd-default then accept

Apply the filter as a flood filter on the VLAN that includes the interface which will receive unknown unicast packets:
```
[edit vlans vlan-name]

user@switch# set forwarding-options flood input filter-name
```
For example:
```
[edit vlans v1]

user@switch# set forwarding-options flood input uuf_filter
```

Verifying That Unknown Unicast Packets Are Forwarded to a Trunk Interface

Purpose
Action
Meaning

Purpose

Verify that a VLAN is forwarding all unknown unicast packets (those with unknown destination MAC addresses) to a single trunk interface instead of flooding unknown unicast packets across all interfaces that are members of the same VLAN.

Action

Display the forwarding interface for unknown unicast packets for a VLAN (here, the VLAN name is v1):

content_copy zoom_out_map
user@switch> show configuration ethernet-switching-options             

unknown-unicast-forwarding {
    vlan v1 {
        interface ge-0/0/7.0;
    }
}

Display the Ethernet switching table:

content_copy zoom_out_map
user@switch> show ethernet-switching table vlan v1             
Ethernet-switching table: 3 unicast entries
  VLAN              MAC address       Type         Age Interfaces
  v1                *                 Flood          - All-members
  v1                00:01:09:00:00:00 Learn         24 ge-0/0/7.0
  v1                00:11:09:00:01:00 Learn         37 ge-0/0/3.0

 

Meaning

The sample output from the show configuration ethernet-switching-options command shows that the unknown unicast forwarding interface for VLAN v1 is interface ge-0/0/7. The show ethernet-switching table command shows that an unknown unicast packet is received on interface ge-0/0/3 with the destination MAC address (DMAC) 00:01:09:00:00:00 and the source MAC address (SMAC) of 00:11:09:00:01:00. This shows that the SMAC of the packet is learned in the normal way (through the interface ge-0/0/3.0), while the DMAC is learned on interface ge-0/0/7.

Configuring Unknown Unicast Forwarding (CLI Procedure)

Unknown unicast traffic consists of packets with unknown destination MAC addresses. By default, the switch floods these packets to all interfaces associated with a VLAN. Forwarding such traffic to interfaces on the switch can create a security issue.

To prevent flooding unknown unicast traffic across the switch, configure unknown unicast forwarding to direct all unknown unicast packets within a VLAN out to a specific trunk interface. From there, the destination MAC address can be learned and added to the Ethernet switching table. You can configure each VLAN to divert unknown unicast traffic to different trunk interfaces or use one trunk interface for multiple VLANs.

Note:

For Junos OS for EX Series switches or QFX Series with support for the Enhanced Layer 2 Software (ELS) configuration style, see Configuring Unknown Unicast Forwarding (ELS).

The unknown-unicast-forwarding feature is not supported on QFX10000 Series platforms.

To configure unknown unicast forwarding options:

Note:

Before you can configure unknown unicast forwarding within a VLAN, you must first configure that VLAN.

Configure unknown unicast forwarding for a specific VLAN (here, the VLAN name is employee):
```
[edit ethernet-switching-options]
user@switch# set unknown-unicast-forwarding vlan employee
```

Specify the trunk interface to which all unknown unicast traffic will be forwarded:

content_copy zoom_out_map
[edit ethernet-switching-options]
user@switch# set unknown-unicast-forwarding vlan employee interface ge-0/0/3.0

arrow_backward PREVIOUS Enabling Unicast Reverse-Path Forwarding Check for VPNs

NEXT arrow_forward VPNs and Class of Service

Layer 2 VPNs and VPLS User Guide for Routing Devices

ON THIS PAGE

Understanding and Preventing Unknown Unicast Forwarding

Verifying That Unknown Unicast Packets Are Forwarded to a Single Interface

Purpose

Action

Meaning

Configuring Unknown Unicast Forwarding (ELS)

Configuring Unknown Unicast Forwarding on EX4300 Switches

Configuring Unknown Unicast Forwarding on EX9200 Switches

Verifying That Unknown Unicast Packets Are Forwarded to a Trunk Interface

Purpose

Action

Meaning

Configuring Unknown Unicast Forwarding (CLI Procedure)

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Layer 2 VPNs and VPLS User Guide for Routing Devices

ON THIS PAGE

Understanding and Preventing Unknown Unicast Forwarding

Verifying That Unknown Unicast Packets Are Forwarded to a Single Interface

Purpose

Action

Meaning

Configuring Unknown Unicast Forwarding (ELS)

Configuring Unknown Unicast Forwarding on EX4300 Switches

Configuring Unknown Unicast Forwarding on EX9200 Switches

Verifying That Unknown Unicast Packets Are Forwarded to a Trunk Interface

Purpose

Action

Meaning

Configuring Unknown Unicast Forwarding (CLI Procedure)

Related Documentation

Stay in touch