MAC

Context

Each switch maintains a MAC address table. A MAC table records learned MAC addresses, VLAN IDs, and outbound interfaces. To forward data, the switch searches the MAC table based on destination MAC addresses and VLAN IDs carried in packets to determine the outbound interfaces for the packets. Therefore, broadcast traffic is reduced. Configure the following MAC address types and functions:

The interface obtains dynamic entries based on the learning of source MAC addresses. The dynamic entries can be aged.
Static MAC entries are manually configured and never age. For details, see Configuring a static user.
Blackhole MAC entries are used to discard data frames with the specified source or destination MAC addresses. Blackhole MAC entries are manually configured and never age. For details, see Configuring a blackhole MAC address entry.
ARP entry fixing can be configured to defend against ARP address spoofing attacks. For details, see Configuring ARP entry fixing.
Port security makes MAC addresses learned on an interface become secure MAC addresses to allow only hosts with secure MAC addresses and static MAC addresses to communicate with the switch through the interface, improving switch security. For details, see Configuring port security.

Procedure

Configure MAC or IP address security and set the aging time of dynamic MAC addresses.

Choose Configuration > Advanced Services > MAC.

Table 1 describes the parameters on the page.

**Table 1** Configuring MAC address aging and MAC address flapping detection
Parameter		Description
MAC/IP address security		Specifies whether to enable the ARP gateway anti-collision function.
Dynamic MAC address aging		Specifies whether to configure the aging time of MAC address entries.
Dynamic MAC address aging time(s)		Specifies the aging time of dynamic MAC address entries.
MAC address flapping detection		Specifies whether to configure global MAC address flapping detection.
MAC address flapping aging time(s)		Specifies the aging time of flapping MAC address entries.

Set parameters.
Click Apply.

Query MAC address entries.
1. Choose Configuration > Advanced Services > MAC.
2. Click the MAC Address tab to access the MAC Address page and select the interface to be queried in the interface selection area.
3. Click Refresh to refresh the MAC address list.
4. Select a search item from the drop-down list box. Entries can be queried based on the MAC address, type, outbound interface, and VLAN ID.
5. Click . The queried entries are displayed in the area.
Create static MAC addresses.
1. Choose Configuration > Advanced Services > MAC.
2. Click the MAC Address tab to access the MAC Address page and select the interface to be configured in the interface selection area.
3. Click Create Static MAC to access the Create Static MAC page.
4. Set parameters.
5. Click OK.
Create secure MAC addresses.
1. Choose Configuration > Advanced Services > MAC.
2. Click the MAC Address tab to access the MAC Address page and select the interface to be configured in the interface selection area.
  NOTE:
  Enable port security according to Configuring Port Security before creating secure MAC addresses.
  After port security is enabled, a green shield identifier is displayed next to the interface.
3. Click Create Secure MAC to access the Create Secure MAC page.
4. Set parameters.
5. Click OK.
Delete MAC addresses.
1. Choose Configuration > Advanced Services > MAC.
2. Click the MAC Address tab to access the MAC Address page and select the interface to be configured in the interface selection area.
3. Select an entry to be deleted in the MAC/IP address list and click Delete MAC. The system asks you whether to delete the entry.
4. Click OK.
Configure a blackhole MAC address.
1. Choose Configuration > Advanced Services > MAC.
2. Click the MAC Address tab to access the MAC Address page and select the interface to be configured in the interface selection area.
3. Select an entry to be configured in the MAC/IP address list and click Convert to Blackhole MAC. The system asks you whether to convert the MAC address to a blackhole one.
  NOTE:
  Only dynamic MAC addresses can be converted into blackhole MAC addresses.
  
  After a dynamic MAC address is converted into a blackhole MAC address, select Select all interfaces so that the converted MAC address can be displayed.
4. Click OK.
Configure ARP entry fixing.
1. Choose Configuration > Advanced Services > MAC.
2. Click the MAC Address tab to access the MAC Address page and select the interface to be configured in the interface selection area.
3. Select an entry to be configured in the MAC address list and click Fix MAC. The system asks you whether to configure ARP entry fixing.
  NOTE:
  Only dynamic MAC addresses can be converted into fixed MAC addresses.
4. Click OK.

Configure port security.

Choose Configuration > Advanced Services > MAC.
Click the MAC Security tab to access the MAC Security page.

Select the interface to be configured.

Table 2 describes the parameters on the MAC Security page.

**Table 2** Description of parameters on the **MAC Security** page
Parameter		Description
Interface Name		-
Interface Security		You can configure port security on networks demanding high access security. Port security enables the switch to convert MAC addresses learned by an interface into secure dynamic MAC addresses or sticky MAC addresses and to stop learning new MAC addresses after the maximum number of learned MAC addresses is reached. In this case, the switch can only communicate with devices with learned MAC addresses. This prevents devices with untrusted MAC addresses from accessing these interfaces, improving security of the device and the network.
MAC Address Limit (1-1024)		Maximum number of MAC addresses that can be learned by an interface.
Sticky MAC		Sticky MAC addresses will not be aged out and will exist after the configuration is saved and the switch restarts.
Port Security Aging Time		The aging time of secure dynamic MAC addresses on an interface.

Set parameters.
Click Apply.

Configure MAC address learning.
1. Choose Configuration > Advanced Services > MAC.
2. Click the MAC Address Learning tab to access the MAC Address Learning page and select the interface to be configured in the interface selection area.
3. Click Enable or Disable to enable or disable MAC address learning on the interface.
Check MAC address flapping information.
1. Choose Configuration > Advanced Services > MAC.
2. Click the MAC Flapping tab to access the MAC Flapping page.
3. Click Refresh to refresh MAC address flapping information.