No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

S12700 V200R012C00 Configuration Guide - Ethernet Switching

This document describes the configuration of Ethernet services, including configuring MAC address table, link aggregation, VLANs, VLAN aggregation, MUX VLAN, VLAN termination, Voice VLAN, VLAN mapping, QinQ, GVRP, VCMP, STP/RSTP/MSTP, VBST, SEP, RRPP, ERPS, LBDT, and Layer 2 protocol transparent transmission.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Summary of MAC Address Table Configuration Tasks

Summary of MAC Address Table Configuration Tasks

Table 2-5  MAC address table configuration tasks
Scenario Description Task

MAC addresses and interfaces need to be bound statically.

Configure static MAC address entries to bind MAC addresses and interfaces, improving security of authorized users.

Configuring a Static MAC Address Entry

Attack packets from unauthorized users need to be filtered out.

Configure blackhole MAC address entries to filter out packets from unauthorized users, thereby protecting the system against attacks.

Configuring a Blackhole MAC Address Entry

Aging of dynamic MAC address entries needs to be flexibly controlled.

Set the aging time of dynamic MAC address entries according to your needs. Set the aging time to a large value or 0 (not to age dynamic MAC address entries) on a stable network; set a short aging time in other situations.

Setting the Aging Time of Dynamic MAC Address Entries

MAC address learning needs to be controlled.

Disable MAC address learning or limit the number of learned MAC address entries to prevent attacks from exhausting MAC address entries.

Disabling MAC Address Learning

Configuring the MAC Address Limiting Function

The MAC address table needs to be monitored.

Configure one or more of the following trap functions to monitor the usage of MAC address entries:

  • Configure an alarm threshold for MAC address usage. When the MAC address usage exceeds the upper threshold, the switch generates an alarm. When the MAC address usage falls below the lower threshold, the switch reports a clear alarm.
  • Enable the trap function for MAC address learning or aging. When a MAC address entry is learned or aged out, the switch sends an alarm.
  • Enable the trap function for MAC address hash conflicts. If the switch cannot learn MAC address entries while its MAC address table is not full, the switch reports an alarm about a MAC address hash conflict.

Enabling MAC Address Trap Functions

The outbound interfaces in ARP entries need to be updated quickly.

Enable the MAC address-triggered ARP entry update function to minimize the service interruption time caused when the outbound interface in a MAC address entry changes.

Enabling MAC Address-triggered ARP Entry Update

MAC address flapping needs to be prevented.

Use the following methods to prevent MAC address flapping:

  • Configure the MAC address learning priorities for interfaces. When the same MAC address is learned by two interfaces that have different priorities, the MAC address entries learned by the interface with a higher priority override the MAC address entries learned by the other interface.
  • Prevent MAC address entries from being overridden on interfaces with the same priority.

Configuring MAC Address Flapping Prevention

MAC address flapping needs to be detected.

Configure MAC address flapping detection so that the switch can check whether MAC addresses flap between interfaces and determine whether loops occur. If MAC address flapping occurs, the switch sends an alarm to the NMS. The network maintenance personnel can locate the loop based on the alarm information and historical records for MAC address flapping. This greatly improves network maintainability. If the network connected to the switch does not support loop prevention protocols, configure the switch to shut down the interfaces where MAC address flapping occurs to reduce the impact of MAC address flapping on the network.

MAC address flapping occurs when a MAC address is learned by two interfaces in the same VLAN and the MAC address entry learned later overrides the earlier one.

Configuring MAC Address Flapping Detection

The switch needs to discard packets with an all-0 source or destination MAC address.

Configure the switch to discard packets with an all-0 source or destination MAC address and send an alarm to the NMS. Such packets may be sent by a faulty host or device.

Configuring the Switch to Discard Packets with an All-0 MAC Address

The switch needs to discard packets in which destination MAC addresses do not match the MAC address table.

Configure the switch to discard packets that do not match any MAC address entry. The application scenario of this function is as follows:

After a DHCP user goes offline, the MAC address entry of the user ages out. If there are packets destined for this user, the system cannot find the MAC address entry. The system then broadcasts the packets to all interfaces in the VLAN. In this case, all users receive the packets, which brings security risks.

This function mitigates the burden on the switch and enhances security.

Configuring the Switch to Discard Packets That Do Not Match Any MAC Address Entry

An interface needs to forward packets whose source and destination MAC addresses are both learned on the interface.

Enable the port bridge function on an interface to allow the interface to forward packets whose source and destination MAC addresses are both learned on the interface. By default, an interface regards such a packet as an invalid packet and discards it. This function applies to a switch that connects to devices incapable of Layer 2 forwarding or functions as an access device in a data center.

Enabling Port Bridge

Translation
Download
Updated: 2019-01-18

Document ID: EDOC1100038103

Views: 124882

Downloads: 52

Average rating:
This Document Applies to these Products
Related Version
Related Documents
Share
Previous Next