Mac Address in Vlan is Moving Continuously
Configuring the MAC address table
Overview
An Ethernet device uses a MAC address table to forward frames. A MAC address entry includes a destination MAC address, an outgoing interface, and a VLAN ID. When the device receives a frame, it uses the destination MAC address of the frame to look for a match in the MAC address table.
·The device forwards the frame out of the outgoing interface in the matching entry if a match is found.
·The device floods the frame in the VLAN of the frame if no match is found.
How a MAC address entry is created
The entries in the MAC address table include entries automatically learned by the device and entries manually added.
MAC address learning
The device can automatically populate its MAC address table by learning the source MAC addresses of incoming frames on each interface.
The device performs the following operations to learn the source MAC address of incoming packets:
1. Checks the source MAC address (for example, MAC-SOURCE) of the frame.
2. Looks up the source MAC address in the MAC address table.
¡The device updates the entry if an entry is found.
¡The device adds an entry for MAC-SOURCE and the incoming p ort i f no entry is found.
When the device receives a frame destined for MAC-SOURCE after learning this source MAC address, the device performs the following operations:
1. Finds the MAC-SOURCE entry in the MAC address table.
2. Forwards the frame out of the p ort in the entry .
The device performs the learning process for each incoming frame with an unknown source MAC address until the table is fully populated.
Manually configuring MAC address entries
Dynamic MAC address learning does not distinguish between illegitimate and legitimate frames, which can invite security hazards. When Host A is connected to port A, a MAC address entry will be learned for the MAC address of Host A (for example, MAC A). When an illegal user sends frames with MAC A as the source MAC address to port B, the device performs the following operations:
1. Learns a new MAC address entry with port B as the outgoing interface and overwrites the old entry for MAC A .
2. Forwards frames destined for MAC A out of p ort B to the illegal user.
As a result, the illegal user obtains the data of Host A. To improve the security for Host A, manually configure a static entry to bind Host A to port A. Then, the frames destined for Host A are always sent out of port A. Other hosts using the forged MAC address of Host A cannot obtain the frames destined for Host A.
Types of MAC address entries
A MAC address table can contain the following types of entries:
· Static entries —A s tatic entr y is manually added to forward frames with a specific destination MAC address out of the associated interface, and it never age s out. A static entry has higher priority than a dynamically learned one.
· Dynamic entries —A d ynamic entr y can be manually configured or dynamically learned to forward frames with a specific destination MAC address out of the associated interface . A dynamic entry might age out. A manually configured dynamic entry has the same priority as a dynamically learned one.
· Blackhole entries —A b lackhole entr y is manually configured and never age s out. A b lackhole entr y is configured for filtering out frames with a specific destination MAC address. For example, to block all frame s destined for a user, you can configure the MAC address of the user as a blackhole MAC address entry. A blackhole entry has higher priority than a dynamically learned one.
A static or blackhole MAC address entry can overwrite a dynamic MAC address entry, but not vice versa. A static MAC address and a blackhole MAC address cannot overwrite each other.
Command and hardware compatibility
The WX1800H series, WX2500H series, and WX3000H series access controllers do not support the slot keyword or the slot-number argument.
MAC address table configuration task list
The configuration tasks discussed in the following sections can be performed in any order.
This document covers only the configuration of MAC address entries, including static, dynamic, and blackhole MAC address entries.
To configure the MAC address table, perform the following tasks:
| Tasks at a glance |
| (Optional.) Configuring MAC address entries · Adding or modifying a static or dynamic MAC address entry globally · Adding or modifying a static or dynamic MAC address entry on an interface · Adding or modifying a blackhole MAC address entry |
| (Optional.) Disabling MAC address learning |
| (Optional.) Setting the aging timer for dynamic MAC address entries |
| (Optional.) Setting the MAC learning limit on interfaces |
| (Optional.) Configuring the device to forward unknown frames after the MAC learning limit on an interface is reached |
| (Optional.) Assigning MAC learning priority to interfaces |
| (Optional.) Configuring MAC address move notifications and suppression |
| (Optional.) Enabling SNMP notifications for the MAC address table |
Configuring MAC address entries
Configuration guidelines
·You cannot add a dynamic MAC address entry if a learned entry already exists with a different outgoing interface for the MAC address.
·The manually configured static and blackhole MAC address entries cannot survive a reboot if you do not save the configuration. The manually configured dynamic MAC address entries are lost upon reboot whether or not you save the configuration.
A frame whose source MAC address matches different types of MAC address entries is processed differently.
| Type | Description |
| Static MAC address entry | Forwards the frame according to the destination MAC address regardless of whether the frame's ingress interface is the same as that in the entry. |
| Dynamic MAC address entry | ·Learns the MAC address of the frames received on a different interface from that in the entry and overwrites the original entry. · Forwards the frame received on the same interface as that in the entry and updates the aging timer for the entry. |
Adding or modifying a static or dynamic MAC address entry globally
| Step | Command | Remarks |
| 1. Enter system view. | system-view | N/A |
| 2. Add or modify a static or dynamic MAC address entry. | mac-address { dynamic | static } mac-address interface interface-type interface-number vlan vlan-id | By default, no MAC address entry is configured globally. Make sure you have created the VLAN and assigned the interface to the VLAN. |
Adding or modifying a static or dynamic MAC address entry on an interface
| Step | Command | Remarks |
| 1. Enter system view. | system-view | N/A |
| 2. Enter interface view. | ·E nter Layer 2 Ethernet interface view : ·E nter Layer 2 aggregate interface view : | N/A |
| 3. Add or modify a static or dynamic MAC address entry. | mac -address { dynamic | static } mac-address vlan vlan-id | By default, no MAC address entry is configured on the interface. Make sure you have created the VLAN and assigned the interface to the VLAN. |
Adding or modifying a blackhole MAC address entry
| Step | Command | Remarks |
| 1. Enter system view. | system-view | N/A |
| 2. Add or modify a blackhole MAC address entry. | mac -address blackhole mac-address vlan vlan-id | By default, no blackhole MAC address entry is configured. Make sure you have created the VLAN. |
Disabling MAC address learning
MAC address learning is enabled by default. To prevent the MAC address table from being saturated when the device is experiencing attacks, disable MAC address learning. For example, you can disable MAC address learning to prevent the device from being attacked by a large amount of frames with different source MAC addresses.
After MAC address learning is disabled, existing dynamic MAC address entries will age out.
Disabling global MAC address learning
Disabling global MAC address learning disables MAC address learning on all interfaces. The device stops learning MAC addresses.
To disable global MAC address learning:
| Step | Command | Remarks |
| 1. Enter system view. | system-view | N/A |
| 2. Dis able global MAC address learning. | undo mac-address mac-learning enable | By default, global MAC address learning is enabled. |
Disabling MAC address learning on interfaces
When global MAC address learning is enabled, you can disable MAC address learning on a single interface.
To disable MAC address learning on an interface:
| Step | Command | Remarks |
| 1. Enter system view. | system-view | N/A |
| 2. Enter interface view. | ·E nter Layer 2 Ethernet interface view : ·E nter Layer 2 aggregate interface view : | N/A |
| 3. Dis able MAC address learning on the interface. | undo mac-address mac-learning enable | By default, MAC address learning on the interface is enabled. |
Setting the aging timer for dynamic MAC address entries
For security and efficient use of table space, the MAC address table uses an aging timer for each dynamic MAC address entry. If a dynamic MAC address entry is not updated before the aging timer expires, the device deletes the entry. This aging mechanism ensures that the MAC address table can promptly update to accommodate latest network topology changes.
A stable network requires a longer aging interval, and an unstable network requires a shorter aging interval.
An aging interval that is too long might cause the MAC address table to retain outdated entries. As a result, the MAC address table resources might be exhausted, and the MAC address table might fail to update its entries to accommodate the latest network changes.
An interval that is too short might result in removal of valid entries, which would cause unnecessary floods and possibly affect the device performance.
To reduce floods on a stable network, set a long aging timer or disable the timer to prevent dynamic entries from unnecessarily aging out. Reducing floods improves the network performance. Reducing flooding also improves the security because it reduces the chances for a data frame to reach unintended destinations.
To set the aging timer for dynamic MAC address entries:
| Step | Command | Remarks |
| 1. Enter system view. | system-view | N/A |
| 2. Set the aging timer for dynamic MAC address entries. | mac-address timer { aging seconds | no-aging } | The default setting is 300 seconds. The no-aging keyword disables the aging timer. |
Setting the MAC learning limit on interfaces
This feature limits the MAC address table size. A large MAC address table will degrade forwarding performance.
To set the MAC learning limit on an interface:
| Step | Command | Remarks |
| 1. Enter system view. | system-view | N/A |
| 2. Enter interface view. | ·E nter Layer 2 Ethernet interface view : ·E nter Layer 2 aggregate interface view : | N/A |
| 3. Set the MAC learning limit on the interface. | mac-address max-mac-count count | By default, the MAC learning limit is the device-specific maximum value for the count argument. For more information, see Layer 2—LAN Switching Command Reference. |
Configuring the device to forward unknown frames after the MAC learning limit on an interface is reached
You can enable or disable forwarding of unknown frames after the MAC learning limit on an interface is reached.
In this document, unknown frames refer to frames whose source MAC addresses are not in the MAC address table.
To configure the device to forward unknown frames received on the interface after the MAC learning limit on the interface is reached:
| Step | Command | Remarks |
| 1. Enter system view. | system-view | N/A |
| 2. Enter interface view. | · Enter Layer 2 Ethernet interface view. ·Enter Layer 2 aggregate interface view. | N/A |
| 3. Configure the device to forward unknown frames received on the interface after the MAC learning limit on the interface is reached. | mac-address max-mac-count enable-forwarding | By default, the device can forward unknown frames received on an interface after the MAC learning limit on the interface is reached. |
Assigning MAC learning priority to interfaces
The MAC learning priority mechanism assigns either low priority or high priority to an interface. An interface with high priority can learn MAC addresses as usual. However, an interface with low priority is not allowed to learn MAC addresses already learned on a high-priority interface.
The MAC learning priority mechanism can help defend your network against MAC address spoofing attacks. In a network that performs MAC-based forwarding, an upper layer device MAC address might be learned by a downlink interface because of a loop or attack to the downlink interface. To avoid this problem, perform the following tasks:
·Assign high MAC learning priority to an uplink interface.
·Assign low MAC learning priority to a downlink interface.
To assign MAC learning priority to an interface:
| Step | Command | Remarks |
| 1. Enter system view. | system-view | N/A |
| 2. Enter interface view. | ·E nter Layer 2 Ethernet interface view : ·E nter Layer 2 aggregate interface view : | N/A |
| 3. Assign MAC learning priority to the interface. | mac-address mac-learning priority { high | low } | By default, low MAC learning priority is used. |
Configuring MAC address move notificatio ns and suppression
The outgoing interface for a MAC address entry learned on interface A is changed to interface B when the following conditions exist:
·Interface B receives a packet with the MAC address as the source MAC address.
·Interface B belongs to the same VLAN as interface A.
In this case, the MAC address is moved from interface A to interface B, and a MAC address move occurs.
The MAC address move notifications feature enables the device to output MAC address move logs when MAC address moves are detected.
If a MAC address is continuously moved between the two interfaces, Layer 2 loops might occur. To detect and locate loops, you can view the MAC address move information. To display the MAC address move records after the device is started, use the display mac-address mac-move command.
If the system detects that MAC address moves occur frequently on an interface, you can configure MAC address move suppression to shut the interface down. The interface automatically goes up after a suppression interval. Or, you can manually bring up the interface.
To configure MAC address move notifications and MAC address move suppression:
| Step | Command | Remarks |
| 1. Enter system view. | system-view | N/A |
| 2. Enable MAC address move notifications and optionally specify a MAC move detection interval . | mac-address notification mac-move [ interval interval-value ] | By default, MAC address move notifications are disabled. If you do not specify a detection interval, the default setting of 1 minute is used. After you execute this command, the system sends only log messages to the information center module. If the device is also configured with the snmp-agent trap enable mac-address command, the system also sends SNMP notifications to the SNMP module. |
| 3. (Optional.) Set MAC address move suppression parameters . | mac-address notification mac-move suppression { interval interval-value | threshold threshold-value } | By default, the suppression interval is 30 seconds, and the suppression threshold is 3. |
| 4. Enter interface view. | · Enter Layer 2 Ethernet interface view : · Enter Layer 2 aggregate interface view: | N/A |
| 5. Enable MAC address move suppression. | mac-address notification mac-move suppression | By default, MAC address move suppression is disabled. |
Enabling SNMP notifications for the MAC address table
After you enable SNMP notifications for the MAC address table, the device will send SNMP notifications to the SNMP module to notify the NMS of important events. You can set the notification sending parameters in SNMP to determine the attributes of sending notifications.
After you disable SNMP notifications for the MAC address table, the device will send only log messages to the information center module. You can set the output rules and destinations to examine the log messages of the MAC address table module.
For more information about SNMP notifications and information center, see Network Management and Monitoring Configuration Guide.
To enable SNMP notifications for the MAC address table:
| Step | Command | Remarks |
| 1. Enter system view. | system-view | N/A |
| 2. Enable SNMP notifications for the MAC address table. | snmp-agent trap enable mac-address [ mac-move ] | By default, SNMP notifications are enabled for the MAC address table. When SNMP notifications are disabled for the MAC address table, syslog messages are sent to notify important events on the MAC address table module. |
Displaying and maintaining the MAC address table
Execute display commands in any view.
| Task | Command |
| Display MAC address table information. | display mac-address [ mac-address [ vlan vlan-id ] | [ [ dynamic | static ] [ interface interface-type interface-number ] | blackhole ] [ vlan vlan-id ] [ count ] ] |
| Display the aging timer for dynamic MAC address entries. | display mac-address aging-time |
| Display the system or interface MAC address learning state. | display mac-address mac-learning [ interface interface-type interface-number ] |
| Display the MAC address move records. | display mac-address mac-move [ slot slot-number ] |
MAC address table configuration example
Network requirements
As shown in Figure 1 :
·Host A at MAC address 000f-e235-dc71 is connected to interface GigabitEthernet 1/0/1 of the AC and belongs to VLAN 1.
·Host B at MAC address 000f-e235-abcd, which behaved suspiciously on the network, also belongs to VLAN 1.
Configure the MAC address table as follows:
·To prevent MAC address spoofing, add a static entry for Host A in the MAC address table of the AC.
·To drop a ll frames destined for Host B , a dd a blackhole MAC address entry for Host B.
·Set the aging timer to 500 seconds for dynamic MAC address entries.
Figure 1 Network diagram
Configuration procedure
# Add a static MAC address entry for MAC address 000f-e235-dc71 on GigabitEthernet 1/0/1 that belongs to VLAN 1.
<AC> system-view
[AC] mac-address static 000f-e235-dc71 interface gigabitethernet 1/0/1 vlan 1
# Add a blackhole MAC address entry for MAC address 000f-e235-abcd that belongs to VLAN 1.
[AC] mac-address blackhole 000f-e235-abcd vlan 1
# Set the aging timer to 500 seconds for dynamic MAC address entries.
[AC] mac-address timer aging 500
Verifying the configuration
# Display the static MAC address entries for interface GigabitEthernet 1/0/1.
[AC] display mac-address static interface gigabitethernet 1/0/1
MAC Address VLAN ID State Port/NickName Aging
000f-e235-dc71 1 Static GE1/0/1 N
# Display the blackhole MAC address entries.
[AC] display mac-address blackhole
MAC Address VLAN ID State Port/NickName Aging
000f-e235-abcd 1 Blackhole N/A N
# Display the aging time of dynamic MAC address entries.
[AC] display mac-address aging-time
MAC address aging time: 500s.
Source: http://www.h3c.com/en/Support/Resource_Center/HK/Home/WLAN/00-Public/Configure/Configuration_Guide/H3C_AC_CG%28E5208P03_R5215P01%29-6W102/04/201905/1178213_294551_0.htm
0 Response to "Mac Address in Vlan is Moving Continuously"
Post a Comment