mac-limit
Function
The mac-limit command configures a rule to limit the number of MAC addresses that can be learned.
The undo mac-limit command deletes the rule.
By default, the number of learned MAC addresses is not limited.
Format
(Interface view) mac-limit { action { discard | forward } | alarm { disable | enable } | maximum max-num }*
(VLAN view) mac-limit { alarm { disable | enable } | maximum max-num }*
undo mac-limit
Parameters
Parameter |
Description |
Value |
|---|---|---|
action { discard | forward } |
Indicates the action performed when the number of learned MAC address entries reaches the limit.
NOTE:
This parameter cannot be specified in the VLAN view. |
If no action is specified in the command, the default action discard is used. |
alarm { disable | enable } |
Indicates whether the system generates an alarm when the number of learned MAC address entries reaches the limit.
|
If you do not set this parameter in the command, the alarm function is enabled by default. |
maximum max-num |
Sets the maximum number of MAC addresses that can be learned. NOTE:
If maximum is not set, you must run the mac-limit command with maximum specified. If you have run the mac-limit command to set the maximum number of MAC addresses that can be learned, you do not need to set maximum max-num when running this command again. |
The value is a decimal integer ranging from 0 to 4096. The value 0 indicates that the highest rate of MAC address learning is not limited. |
Usage Guidelines
Usage Scenario
The mac-limit command limits the number of access users and prevents attacks to the MAC address tables. You can enable the function to improve network security.
Precautions
The mac-limit and port-security enable commands cannot be used on the same interface.
The action cannot be set in the VLAN view.
Example
- The maximum number of learned MAC addresses is 30.
- When the number of learned MAC addresses exceeds the maximum, and an alarm is generated.
<AC6605> system-view [AC6605] interface GigabitEthernet 0/0/1 [AC6605-GigabitEthernet0/0/1] mac-limit maximum 30 alarm enable
