Typical MAC Configuration

Overview

MAC address entries are automatically generated when the switch learns the source MAC addresses of packets. Static MAC address entries are manually configured.

A network administrator manually adds MAC address entries of authorized users into the MAC address table. The static MAC address entries are often used to prevent unauthorized users from intercepting data of authorized users.

If a large number of static MAC address entries are manually configured, network maintenance can be difficult. You can enable port security to dynamically bind MAC addresses to interfaces.

Configuration Notes

This example applies to all versions of all S series switches.

Networking Requirements

In Figure 3-70, the server connects to the switch through GE1/0/2. To prevent the switch from broadcasting packets destined for the server, the static MAC address entry of the server needs to be configured on the switch. This ensures that the switch unicasts packets destined for the server through GE1/0/2. The MAC address of the PC is statically bound to GE1/0/1 to ensure secure communication between the PC and server.

Figure 3-70 Networking for configuring static MAC address entries

Configuration Roadmap

The configuration roadmap is as follows:

1. Create a VLAN on the switch and add an interface to the VLAN to implement Layer 2 forwarding.

2. Configure the static MAC address entry of the server on the switch.

3. Configure the static MAC address entry of the PC on the switch.

Overview

Blackhole MAC address entries can be used to prevent attacks from unauthorized users. The switch discards packets from or destined to blackhole MAC addresses.

Configuration Notes

This example applies to all versions of all S series switches.

Networking Requirements

As shown in Figure 3-71, the switch receives a packet from an unauthorized PC whose MAC address is 0005-0005-0005 and belongs to VLAN 3. This MAC address can be configured as a blackhole MAC address to filter packets from the unauthorized user.

Figure 3-71 Networking for configuring blackhole MAC address entries

Configuration Roadmap

The configuration roadmap is as follows:

1. Create a VLAN to implement Layer 2 forwarding.

2. Configure a blackhole MAC address to block packets from this MAC address.

Overview

The switch limits the number of MAC address entries based on VLANs or interfaces. In offices where clients seldom change, you can configure MAC address limiting to control user access. This can protect against certain attacks. For example, if an attacker forges a large number of packets with different source MAC addresses and sends the packets to the device, finite MAC address entries in the MAC address table of the device may be exhausted. When the MAC address table is full, the device cannot learn source MAC addresses of valid packets. As a result, the device broadcasts the valid packets, wasting bandwidth resources.

MAC address limiting in a VLAN can limit the number of MAC address entries on multiple interfaces in a VLAN.

Configuration Notes

• After the port-security enable command is configured on an interface, MAC address limiting cannot take effect on the interface. Do not configure port security and MAC address limiting on the same interface simultaneously.
• This example applies to all versions of all S series switches.
• After the number of learned MAC address entries reaches the limit, SA cards of S series and F series cards of chassis devices and box devices (excluding the S5720-EI) cannot discard packets with nonexistent source MAC addresses.

Networking Requirements

In Figure 3-72, user network 1 is connected to GE1/0/1 of the switch through LSW1, user network 2 is connected to GE1/0/2 of the switch through LSW2, and GE1/0/1 and GE1/0/2 belong to VLAN 2. To control the number of access users, configure MAC address limiting in VLAN 2.

Figure 3-72 Networking of MAC address limiting in a VLAN

Configuration Roadmap

The configuration roadmap is as follows:

1. Create a VLAN and add interfaces to the VLAN to implement Layer 2 forwarding.

2. Configure MAC address limiting in a VLAN to prevent MAC address attacks and control the number of access users.

Overview

The switch limits the number of MAC address entries based on VLANs or interfaces. In offices where clients seldom change, you can configure MAC address limiting to control user access. This can protect against certain attacks. For example, if an attacker forges a large number of packets with different source MAC addresses and sends the packets to the device, finite MAC address entries in the MAC address table of the device may be exhausted. When the MAC address table is full, the device cannot learn source MAC addresses of valid packets. As a result, the device broadcasts the valid packets, wasting bandwidth resources.

MAC address limiting on an interface can be used in scenarios where users connected to an interface in small and medium-sized enterprises are fixed and seldom change.

Configuration Notes

• After port-security enable is configured on an interface, MAC address limiting cannot be configured on the interface.
• This example applies to all versions of all S series switches.

Networking Requirements

In Figure 3-73, user network 1 and user network 2 connect to the switch through the LSW, and GE1/0/1 of the switch connects to the LSW. User network 1 and user network 2 belong to VLAN 10 and VLAN 20 respectively. On the switch, MAC address limiting can be configured on GE1/0/1 to control the number of access users.

Figure 3-73 Networking of MAC address limiting on an interface

Configuration Roadmap

The configuration roadmap is as follows:

1. Create VLANs and add interfaces to the VLANs to implement Layer 2 forwarding.

2. Configure MAC address limiting on an interface to control the number of access users.