Example for Configuring MAC Address Learning in a VLAN
Networking Requirements
As shown in Figure 2-11, user network 1 is connected to Switch on the 10GE1/0/1 through an LSW. User network 2 is connected to Switch on the 10GE1/0/2 through another LSW. Both 10GE1/0/1 and 10GE1/0/2 belong to VLAN 2. To prevent MAC address attacks and limit the number of access users on the device, limit MAC address learning on all the interfaces in VLAN 2.
Configuration Roadmap
The configuration roadmap is as follows:
Create a VLAN and add an interface to the VLAN to implement Layer 2 forwarding.
Limit MAC address learning on all the interfaces in the VLAN to prevent MAC address attacks and limit the number of access users.
Procedure
- Limit MAC address learning.
# Add 10GE1/0/1 and 10GE1/0/2 to VLAN 2.
<HUAWEI> system-view [~HUAWEI] sysname Switch [*HUAWEI] commit [~Switch] vlan 2 [*Switch-vlan2] quit [*Switch] interface 10ge 1/0/1 [*Switch-10GE1/0/1] port link-type trunk [*Switch-10GE1/0/1] port trunk allow-pass vlan 2 [*Switch-10GE1/0/1] quit [*Switch] interface 10ge 1/0/2 [*Switch-10GE1/0/2] port link-type trunk [*Switch-10GE1/0/2] port trunk allow-pass vlan 2 [*Switch-10GE1/0/2] quit [*Switch] commit
# Configure the following MAC address limiting rule in VLAN 2: A maximum of 100 MAC addresses can be learned. When the number of learned MAC addresses reaches the limit, the device sends an alarm.
[~Switch] vlan 2 [~Switch-vlan2] mac-address limit maximum 100 alarm enable [*Switch-vlan2] quit [*Switch] commit
- Verify the configuration.
# Run the display mac-address limit command in any view to check whether the MAC address limiting rule is successfully configured.
[~Switch] display mac-address limit MAC Address Limit is enabled Total MAC Address limit rule count : 1 Port VLAN/VSI/SI/BD Slot Maximum Action Alarm ------------------------------------------------------------------- -- 2 -- 100 forward enable