FTOS Configuration Guide for the C-Series - Force10 Networks

Configuring a MAC address learning limit for an interface (optional)
The MAC Address Learning Limit feature is related to MAC ACLs as a way to implement port security. It
enables you to set an upper limit on the number of MAC addresses that can be entered for a particular
interface in the MAC Address Table. After you set a learning limit, and the limit is reached, any MAC
addresses encountered by the interface are ignored and the traffic is dropped. To set a limit on the number
of MAC addresses that can access a particular port, use the following command in the INTERFACE mode:
Step Command Syntax Command Mode Purpose
1 switchport INTERFACE Place the interface in Layer 2 mode.
2
mac learning-limit INTERFACE • : Enter a number between 1 and
1000000 (1 million) as the maximum
number of MAC addresses that can be
entered in the MAC Address Table for
the selected interface.
• dynamic (OPTIONAL): MAC
addresses learned for this interface
enter the MAC Address Table as
dynamic addresses (they can age out)
when the learning limit is set.
• no-station-move (OPTIONAL): Stop
addresses learned on this interface
from being moved to another interface
in the MAC Address Table.
• (OPTIONAL): Allow a station move on
learned MAC addresses.
As described in Managing the MAC Address Table on page 198, dynamic addresses are subject to aging
out of the table.
The “sticky MAC” option: MAC addresses learned under a learning limit will enter the MAC Address
Table either as static or dynamic addresses, depending on whether the dynamic option is set, as described
above. In either case, however, if the address is then learned on another interface, the address is moved to
that other interface in the MAC Address Table. This can cause unnecessary MAC shuffling within the
system, causing unnecessary flooding. The no-station-move option, also commonly called a “sticky
MAC” option, prevents that from happening by causing the first entry to persist in the table even if the
address is received on other interface.
Notes:
• For both the dynamic and no-station-move options, addresses entered before those options are set
are not affected.
• MAC learning should be on a per-VLAN basis.
• Egress ACLs can be applied to interfaces that have those features configured on ingress. Only the
MAC limit-learned addresses should be permitted on the ingress interfaces. ACLs can be applied on
the egress (typically to stop unknown protocol traffic). See MAC ACL Implementation on page 190.
200 Layer 2