Example for Configuring MAC Address Limiting in a VLAN
Networking Requirements
In Figure 2-16, user network 1 is connected to GE1/0/1 of the Switch through LSW1, and user network 2 is connected to GE1/0/2 of the Switch through LSW2. GE1/0/1 and GE1/0/2 belong to VLAN 2. To control the number of access users, configure MAC address limiting in VLAN 2.
Configuration Roadmap
The configuration roadmap is as follows:
Create a VLAN and add interfaces for Layer 2 forwarding.
Configure MAC address limiting in the VLAN to prevent MAC address attacks and control access users.
Procedure
- Configure MAC address limiting.
# Add GigabitEthernet1/0/1 and GigabitEthernet1/0/2 to VLAN 2.
<HUAWEI> system-view [HUAWEI] sysname Switch [Switch] vlan 2 [Switch-vlan2] quit [Switch] interface gigabitethernet 1/0/1 [Switch-GigabitEthernet1/0/1] port link-type hybrid [Switch-GigabitEthernet1/0/1] port hybrid pvid vlan 2 [Switch-GigabitEthernet1/0/1] port hybrid untagged vlan 2 [Switch-GigabitEthernet1/0/1] quit [Switch] interface gigabitethernet 1/0/2 [Switch-GigabitEthernet1/0/2] port link-type hybrid [Switch-GigabitEthernet1/0/2] port hybrid pvid vlan 2 [Switch-GigabitEthernet1/0/2] port hybrid untagged vlan 2 [Switch-GigabitEthernet1/0/2] quit
# Configure the following MAC address limiting rule in VLAN 2: In the following configuration, a maximum of 100 MAC addresses can be learned. When the number of learned MAC address entries reaches the limit, the Switch forwards packets with new source MAC address entries and sends an alarm, but does not add the MAC address entries to the MAC address table.
[Switch] vlan 2 [Switch-vlan2] mac-limit maximum 100 action forward alarm enable [Switch-vlan2] return
- Verify the configuration.
# Run the display mac-limit command in any view to check whether the MAC address limiting rule is successfully configured.
<Switch> display mac-limit MAC limit is enabled Total MAC limit rule count : 1 PORT VLAN/VSI SLOT Maximum Rate(ms) Action Alarm ---------------------------------------------------------------------------- - 2 - 100 - forward enable
Configuration Files
Switch configuration file
# sysname Switch # vlan batch 2 # vlan 2 mac-limit maximum 100 action forward # interface GigabitEthernet1/0/1 port link-type hybrid port hybrid pvid vlan 2 port hybrid untagged vlan 2 # interface GigabitEthernet1/0/2 port link-type hybrid port hybrid pvid vlan 2 port hybrid untagged vlan 2 # return