HPE FlexNetwork 10500 SERIES User manual

HPE FlexNetwork 10500 Switch Series
Layer 2—LAN Switching Configuration Guide
Part number: 5200
-1896
Software
version: 10500-CMW710-R7524
Document version: 6W100-20161230

© Copyright 2016 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Configuring the MAC address table································································1
Overview····························································································································································1
How a MAC address entry is created·········································································································1
Types of MAC address entries···················································································································1
MAC address table configuration task list··········································································································2
Configuring MAC address entries······················································································································3
Configuration guidelines·····························································································································3
Adding or modifying a static or dynamic MAC address entry globally ·······················································3
Adding or modifying a static or dynamic MAC address entry on an interface············································3
Adding or modifying a blackhole MAC address entry ················································································4
Adding or modifying a multiport unicast MAC address entry ·····································································4
Disabling MAC address learning························································································································5
Disabling global MAC address learning·····································································································6
Disabling MAC address learning on interfaces··························································································6
Disabling MAC address learning on a VLAN ·····························································································6
Setting the aging timer for dynamic MAC address entries·················································································7
Setting the MAC learning limit····························································································································7
Configuring the unknown frame forwarding rule after the MAC learning limit is reached ··································8
Assigning MAC learning priority to interfaces ····································································································8
Enabling MAC address synchronization ············································································································9
Configuring MAC address move notifications and suppression·······································································11
Enabling ARP fast update for MAC address moves ························································································12
Disabling static source check···························································································································12
Enabling SNMP notifications for the MAC address table·················································································13
Displaying and maintaining the MAC address table ························································································13
MAC address table configuration example ······································································································14
Network requirements······························································································································14
Configuration procedure···························································································································14
Verifying the configuration························································································································14
Configuring MAC Information········································································16
Enabling MAC Information·······························································································································16
Configuring the MAC Information mode···········································································································16
Setting the MAC change notification interval ···································································································17
Setting the MAC Information queue length······································································································17
MAC Information configuration example··········································································································17
Network requirements······························································································································17
Configuration restrictions and guidelines·································································································18
Configuration procedure···························································································································18
Configuring Ethernet link aggregation···························································20
Basic concepts·················································································································································20
Aggregation group, member port, and aggregate interface·····································································20
Aggregation states of member ports in an aggregation group·································································20
Operational key········································································································································21
Configuration types··································································································································21
Link aggregation modes···························································································································22
Aggregating links in static mode ······················································································································22
Choosing a reference port························································································································22
Setting the aggregation state of each member port·················································································22
Aggregating links in dynamic mode ·················································································································23
LACP························································································································································24
How dynamic link aggregation works·······································································································25
Edge aggregate interface·································································································································27
Load sharing modes for link aggregation groups·····························································································27
Ethernet link aggregation configuration task list ······························································································27
Configuring an aggregation group ···················································································································28

ii
Configuration restrictions and guidelines·································································································28
Configuring a Layer 2 aggregation group·································································································29
Configuring a Layer 3 aggregation group·································································································30
Configuring an aggregate interface··················································································································32
Configuring the description of an aggregate interface ·············································································32
Specifying ignored VLANs for a Layer 2 aggregate interface··································································32
Setting the MTU for a Layer 3 aggregate interface··················································································33
Setting the minimum and maximum numbers of Selected ports for an aggregation group ·····················33
Setting the expected bandwidth for an aggregate interface·····································································34
Configuring an edge aggregate interface·································································································34
Shutting down an aggregate interface ·····································································································35
Restoring the default settings for an aggregate interface ········································································36
Configuring load sharing for link aggregation groups ······················································································36
Setting load sharing modes for link aggregation groups··········································································36
Enabling local-first load sharing for link aggregation················································································37
Enabling link-aggregation traffic redirection·····································································································38
Configuration restrictions and guidelines·································································································38
Configuration procedure···························································································································39
Displaying and maintaining Ethernet link aggregation·····················································································39
Ethernet link aggregation configuration examples···························································································40
Layer 2 static aggregation configuration example····················································································40
Layer 2 dynamic aggregation configuration example···············································································42
Layer 2 aggregation load sharing configuration example ········································································43
Layer 2 edge aggregate interface configuration example········································································46
Layer 3 static aggregation configuration example····················································································47
Layer 3 dynamic aggregation configuration example···············································································48
Layer 3 aggregation load sharing configuration example ········································································50
Layer 3 edge aggregate interface configuration example········································································52
Configuring port isolation··············································································54
Assigning a port to an isolation group··············································································································54
Displaying and maintaining port isolation·········································································································54
Port isolation configuration example················································································································55
Network requirements······························································································································55
Configuration procedure···························································································································55
Verifying the configuration························································································································55
Configuring VLANs ·······················································································57
Overview··························································································································································57
VLAN frame encapsulation ······················································································································57
Protocols and standards ··························································································································58
Configuring basic VLAN settings ·····················································································································58
Configuring VLAN interfaces····························································································································59
Configuring port-based VLANs ························································································································60
Introduction ··············································································································································60
Assigning an access port to a VLAN········································································································61
Assigning a trunk port to a VLAN·············································································································62
Assigning a hybrid port to a VLAN···········································································································62
Configuring MAC-based VLANs ······················································································································63
Introduction ··············································································································································63
General configuration restrictions and guidelines····················································································66
Configuring static MAC-based VLAN assignment····················································································66
Configuring dynamic MAC-based VLAN assignment···············································································66
Configuring server-assigned MAC-based VLAN······················································································68
Configuring IP subnet-based VLANs ···············································································································68
Configuring protocol-based VLANs··················································································································69
Configuring a VLAN group·······························································································································70
Enabling packet statistics for a VLAN··············································································································70
Displaying and maintaining VLANs··················································································································71
VLAN configuration examples··························································································································71
Port-based VLAN configuration example·································································································71
MAC-based VLAN configuration example································································································73

iii
IP subnet-based VLAN configuration example ························································································75
Protocol-based VLAN configuration example ··························································································76
Configuring super VLANs ·············································································80
Overview··························································································································································80
Super VLAN configuration task list ··················································································································80
Creating a sub-VLAN·······································································································································80
Configuring a super VLAN ·······························································································································80
Configuring a super VLAN interface ················································································································81
Displaying and maintaining super VLANs········································································································82
Super VLAN configuration example·················································································································82
Network requirements······························································································································82
Configuration procedure···························································································································82
Verifying the configuration························································································································83
Configuring the private VLAN ·······································································85
Configuration task list·······································································································································85
Configuration restrictions and guidelines·········································································································86
Configuration procedure ··································································································································86
Displaying and maintaining the private VLAN··································································································88
Private VLAN configuration examples ·············································································································88
Promiscuous port configuration example·································································································88
Trunk promiscuous port configuration example·······················································································91
Trunk promiscuous and trunk secondary port configuration example······················································94
Secondary VLAN Layer 3 communication configuration example···························································98
Configuring voice VLANs············································································101
Overview························································································································································101
Methods of identifying IP phones···················································································································101
Identifying IP phones through OUI addresses ·······················································································101
Automatically identifying IP phones through LLDP················································································102
Advertising the voice VLAN information to IP phones ···················································································102
IP phone access methods······························································································································102
Connecting the host and the IP phone in series ····················································································102
Connecting the IP phone to the device··································································································103
Voice VLAN assignment modes ····················································································································103
Automatic mode·····································································································································103
Manual mode ·········································································································································104
Cooperation of voice VLAN assignment modes and IP phones ····························································104
Security mode and normal mode of voice VLANs ·························································································105
Voice VLAN configuration task list·················································································································106
Configuring the QoS priority settings for voice traffic·····················································································106
Configuring a port to operate in automatic voice VLAN assignment mode····················································107
Configuration restrictions and guidelines·······························································································107
Configuration procedure·························································································································107
Configuring a port to operate in manual voice VLAN assignment mode ·······················································108
Configuration restrictions and guidelines·······························································································108
Configuration procedure·························································································································108
Enabling LLDP for automatic IP phone discovery··························································································109
Configuration restrictions and guidelines·······························································································109
Configuration procedure·························································································································109
Configuring LLDP to advertise a voice VLAN ································································································109
Configuring CDP to advertise a voice VLAN··································································································110
Displaying and maintaining voice VLANs ······································································································111
Voice VLAN configuration examples··············································································································111
Automatic voice VLAN assignment mode configuration example··························································111
Manual voice VLAN assignment mode configuration example······························································113
Configuring MVRP······················································································115
MRP·······························································································································································115
MRP implementation······························································································································115
MRP messages······································································································································115

iv
MRP timers ············································································································································117
MVRP registration modes······························································································································118
Protocols and standards ································································································································118
MVRP configuration task list··························································································································118
Configuration restrictions and guidelines·······································································································118
Configuration prerequisites····························································································································119
Enabling MVRP··············································································································································119
Setting an MVRP registration mode···············································································································119
Setting MRP timers········································································································································120
Enabling GVRP compatibility·························································································································121
Displaying and maintaining MVRP·················································································································121
MVRP configuration example ························································································································121
Network requirements····························································································································121
Configuration procedure·························································································································122
Verifying the configuration······················································································································125
Configuring QinQ························································································131
Overview························································································································································131
How QinQ works····································································································································131
QinQ implementations····························································································································132
Protocols and standards ························································································································133
Restrictions and guidelines····························································································································133
Enabling QinQ················································································································································133
Configuring transparent transmission for VLANs···························································································133
Configuring the TPID for VLAN tags··············································································································134
Configuring the TPID for CVLAN tags····································································································135
Configuring the TPID for SVLAN tags····································································································135
Setting the 802.1p priority in SVLAN tags······································································································135
Displaying and maintaining QinQ···················································································································136
QinQ configuration examples·························································································································137
Basic QinQ configuration example·········································································································137
VLAN transparent transmission configuration example·········································································139
Configuring VLAN mapping ········································································141
Overview························································································································································141
VLAN mapping application scenarios ····································································································141
VLAN mapping implementations············································································································143
VLAN mapping configuration task list ············································································································146
Configuring one-to-one VLAN mapping·········································································································147
Configuring many-to-one VLAN mapping ······································································································148
Configuring many-to-one VLAN mapping in a network with dynamic IP address assignment···············148
Configuring many-to-one VLAN mapping in a network with static IP address assignment····················150
Configuring one-to-two VLAN mapping ·········································································································152
Configuring zero-to-two VLAN mapping ········································································································153
Configuring two-to-two VLAN mapping··········································································································154
Displaying and maintaining VLAN mapping···································································································154
VLAN mapping configuration examples·········································································································155
One-to-one and many-to-one VLAN mapping configuration example ···················································155
One-to-two and two-to-two VLAN mapping configuration example ·······················································160
Configuring loop detection··········································································163
Overview························································································································································163
Loop detection mechanism····················································································································163
Loop detection interval···························································································································164
Loop protection actions··························································································································164
Port status auto recovery·······················································································································164
Loop detection configuration task list·············································································································165
Enabling loop detection··································································································································165
Enabling loop detection globally·············································································································165
Enabling loop detection on a port···········································································································165
Setting the loop protection action···················································································································166
Setting the global loop protection action································································································166

v
Setting the loop protection action on a Layer 2 Ethernet interface or S-channel interface····················166
Setting the loop protection action on a Layer 2 aggregate interface or S-channel aggregate interface 166
Setting the loop detection interval··················································································································167
Displaying and maintaining loop detection·····································································································167
Loop detection configuration example ···········································································································167
Network requirements····························································································································167
Configuration procedure·························································································································168
Verifying the configuration······················································································································169
Configuring spanning tree protocols···························································170
STP································································································································································170
STP protocol frames ······························································································································170
Basic concepts in STP···························································································································172
Calculation process of the STP algorithm······························································································173
RSTP ·····························································································································································179
RSTP protocol frames····························································································································179
Basic concepts in RSTP·························································································································179
How RSTP works···································································································································180
RSTP BPDU processing························································································································180
PVST······························································································································································181
PVST protocol frames····························································································································181
Basic concepts in PVST·························································································································182
How PVST works···································································································································182
MSTP·····························································································································································182
MSTP features·······································································································································182
MSTP protocol frames ···························································································································183
MSTP basic concepts ····························································································································184
How MSTP works···································································································································187
MSTP implementation on devices··········································································································188
Rapid transition mechanism···················································································································188
Protocols and standards ································································································································190
Configuration restrictions and guidelines·······································································································191
Spanning tree configuration task lists ············································································································191
STP configuration task list······················································································································191
RSTP configuration task list···················································································································192
PVST configuration task list···················································································································193
MSTP configuration task list···················································································································193
Setting the spanning tree mode·····················································································································194
Configuring an MST region····························································································································195
Configuring the root bridge or a secondary root bridge ·················································································196
Configuring the device as the root bridge of a specific spanning tree····················································196
Configuring the device as a secondary root bridge of a specific spanning tree·····································196
Configuring the device priority ·······················································································································197
Configuring the maximum hops of an MST region·························································································197
Configuring the network diameter of a switched network ··············································································198
Setting spanning tree timers ··························································································································198
Configuration restrictions and guidelines·······························································································199
Configuration procedure·························································································································199
Setting the timeout factor·······························································································································199
Configuring the BPDU transmission rate ·······································································································200
Configuring edge ports···································································································································200
Configuration restrictions and guidelines·······························································································200
Configuration procedure·························································································································201
Configuring path costs of ports ······················································································································201
Specifying a standard for the device to use when it calculates the default path cost ····························201
Configuring path costs of ports ··············································································································203
Configuration example···························································································································204
Configuring the port priority····························································································································204
Configuring the port link type ·························································································································205
Configuration restrictions and guidelines·······························································································205
Configuration procedure·························································································································205
Configuring the mode a port uses to recognize and send MSTP frames ······················································205

vi
Enabling outputting port state transition information······················································································206
Enabling the spanning tree feature················································································································206
Enabling the spanning tree feature in STP/RSTP/MSTP mode·····························································207
Enabling the spanning tree feature in PVST mode················································································207
Performing mCheck ·······································································································································207
Configuration restrictions and guidelines·······························································································208
Performing mCheck globally··················································································································208
Performing mCheck in interface view·····································································································208
Disabling inconsistent PVID protection··········································································································208
Configuring Digest Snooping ·························································································································209
Configuration restrictions and guidelines·······························································································209
Configuration procedure·························································································································209
Digest Snooping configuration example·································································································210
Configuring No Agreement Check ·················································································································211
Configuration prerequisites····················································································································212
Configuration procedure·························································································································212
No Agreement Check configuration example·························································································212
Configuring TC Snooping·······························································································································213
Configuration restrictions and guidelines·······························································································213
Configuration procedure·························································································································214
Configuring protection features······················································································································214
Configuring BPDU guard························································································································214
Enabling root guard································································································································215
Enabling loop guard·······························································································································216
Configuring port role restriction··············································································································216
Configuring TC-BPDU transmission restriction······················································································217
Enabling TC-BPDU guard······················································································································217
Enabling BPDU drop······························································································································218
Enabling PVST BPDU guard··················································································································218
Enabling the device to log events of detecting or receiving TC BPDUs ························································218
Enabling SNMP notifications for new-root election and topology change events··········································219
Displaying and maintaining the spanning tree ·······························································································219
Spanning tree configuration example ············································································································220
MSTP configuration example·················································································································220
PVST configuration example··················································································································224
Configuring LLDP························································································228
Overview························································································································································228
Basic concepts·······································································································································228
Working mechanism·······························································································································233
Protocols and standards ························································································································234
LLDP configuration task list ···························································································································234
Performing basic LLDP configurations···········································································································235
Enabling LLDP·······································································································································235
Setting the LLDP bridge mode···············································································································235
Setting the LLDP operating mode··········································································································236
Setting the LLDP reinitialization delay····································································································236
Enabling LLDP polling····························································································································237
Configuring the advertisable TLVs·········································································································237
Configuring the management address and its encoding format·····························································239
Setting other LLDP parameters··············································································································240
Setting an encapsulation format for LLDP frames ·················································································241
Disabling LLDP PVID inconsistency check····························································································242
Configuring CDP compatibility ·······················································································································242
Configuration prerequisites····················································································································243
Configuration procedure·························································································································243
Configuring DCBX··········································································································································243
DCBX configuration task list···················································································································244
Enabling LLDP and DCBX TLV advertising···························································································245
Setting the DCBX version ······················································································································245
Configuring APP parameters ·················································································································246
Configuring ETS parameters··················································································································247

vii
Configuring PFC parameters ·················································································································249
Configuring LLDP trapping and LLDP-MED trapping ····················································································249
Setting the source MAC address of LLDP frames to the MAC address of a Layer 3 Ethernet subinterface ·250
Enabling the device to generate ARP or ND entries for received management address LLDP TLVs···········251
Displaying and maintaining LLDP··················································································································251
LLDP configuration examples························································································································252
Basic LLDP configuration example········································································································252
CDP-compatible LLDP configuration example·······················································································256
DCBX configuration example·················································································································258
Configuring L2PT························································································264
Overview························································································································································264
Background············································································································································264
L2PT operating mechanism···················································································································265
L2PT restrictions and guidelines····················································································································266
L2PT configuration task list····························································································································266
Enabling L2PT ···············································································································································266
Restrictions and guidelines····················································································································266
Enabling L2PT for a protocol··················································································································267
Setting the destination multicast MAC address for tunneled packets····························································267
Displaying and maintaining L2PT ··················································································································267
L2PT configuration examples ························································································································268
Configuring L2PT for STP······················································································································268
Configuring L2PT for LACP····················································································································269
Configuring service loopback groups··························································273
Overview························································································································································273
Configuration restrictions and guidelines·······································································································273
Configuring a service loopback group············································································································274
Displaying and maintaining service loopback groups ····················································································274
Service loopback group configuration example ·····························································································274
Network requirements····························································································································274
Configuration procedure·························································································································275
Document conventions and icons·······························································276
Conventions···················································································································································276
Network topology icons··································································································································277
Support and other resources ······································································278
Accessing Hewlett Packard Enterprise Support ····························································································278
Accessing updates·········································································································································278
Websites ················································································································································279
Customer self repair·······························································································································279
Remote support······································································································································279
Documentation feedback ·······················································································································279
Index···········································································································281

1
Configuring the MAC address table
Overview
An Ethernet device uses a MAC address table to forward frames. A MAC address entry includes a
destination MAC address, an outgoing interface, and a VLAN ID. When the device receives a frame,
it uses the destination MAC address of the frame to look for a match in the MAC address table.
•The device forwards the frame out of the outgoing interface in the matching entry if a match is
found.
•The device floods the frame in the VLAN of the frame if no match is found.
How a MAC address entry is created
The entries in the MAC address table include entries automatically learned by the device and entries
manually added.
MAC address learning
The device can automatically populate its MAC address table by learning the source MAC addresses
of incoming frames on each interface.
The device performs the following operations to learn the source MAC address of incoming packets:
1. Checks the source MAC address (for example, MAC-SOURCE) of the frame.
2. Looks up the source MAC address in the MAC address table.
The device updates the entry if an entry is found.
The device adds an entry for MAC-SOURCE and the incoming port if no entry is found.
When the device receives a frame destined for MAC-SOURCE after learning this source MAC
address, the device performs the following operations:
1. Finds the MAC-SOURCE entry in the MAC address table.
2. Forwards the frame out of the port in the entry.
The device performs the learning process for each incoming frame with an unknown source MAC
address until the table is fully populated.
Manually configuring MAC address entries
Dynamic MAC address learning does not distinguish between illegitimate and legitimate frames,
which can invite security hazards. When HostA is connected to port A, a MAC address entry will be
learned for the MAC address of Host A (for example, MAC A). When an illegal user sends frames
with MAC Aas the source MAC address to port B, the device performs the following operations:
1. Learns a new MAC address entry with port B as the outgoing interface and overwrites the old
entry for MAC A.
2. Forwards frames destined for MAC A out of port B to the illegal user.
As a result, the illegal user obtains the data of Host A. To improve the security for Host A, manually
configure a static entry to bind HostAto port A. Then, the frames destined for Host Aare always sent
out of port A. Other hosts using the forged MAC address of Host Acannot obtain the frames destined
for Host A.
Types of MAC address entries
A MAC address table can contain the following types of entries:

2
•Static entries—A static entry is manually added to forward frames with a specific destination
MAC address out of the associated interface, and it never ages out.A static entry has higher
priority than a dynamically learned one.
•Dynamic entries—A dynamic entry can be manually configured or dynamically learned to
forward frames with a specific destination MAC address out of the associated interface. A
dynamic entry might age out.Amanually configured dynamic entry has the same priority as a
dynamically learned one.
•Blackhole entries—Ablackhole entry is manually configured and never ages out. Ablackhole
entry is configured for filtering out frames with a specific source or destination MAC address.
For example, to block all frames destined for or sourced from a user, you can configure the
MAC address of the user as a blackhole MAC address entry.A blackhole entry has higher
priority than a dynamically learned one.
•Multiport unicast entries—A multiport unicast entry is manually added to send frames with a
specific unicast destination MAC address out of multiple ports, and it never ages out. Amultiport
unicast entry has higher priority than a dynamically learned one.
A static, blackhole, or multiport unicast MAC address entry can overwrite a dynamic MAC address
entry, but not vice versa. A static entry, a blackhole entry, and a multiport unicast entry cannot
overwrite one another.
MAC address table configuration task list
The configuration tasks discussed in the following sections can be performed in any order.
This document covers only the configuration of unicast MAC address entries, including static,
dynamic, blackhole, and multiport unicast MAC address entries. For information about configuring
static multicast MAC address entries, see IP Multicast Configuration Guide. For information about
MAC address table configuration in VPLS, see MPLS Configuration Guide.
To configure the MAC address table, perform the following tasks:
Tasks at a glance
(Optional.) Configuring MAC address entries
•Adding or modifying a static or dynamic MAC address entry globally
•Adding or modifying a static or dynamic MAC address entry on an interface
•Adding or modifying a blackhole MAC address entry
•Adding or modifying a multiport unicast MAC address entry
(Optional.) Disabling MAC address learning
(Optional.) Setting the aging timer for dynamic MAC address entries
(Optional.) Setting the MAC learning limit
(Optional.) Configuring the unknown frame forwarding rule after the MAC learning limit is reached
(Optional.) Assigning MAC learning priority to interfaces
(Optional.) Enabling MAC address synchronization
(Optional.) Configuring MAC address move notifications and suppression
(Optional.) Enabling ARP fast update for MAC address moves
(Optional.) Disabling static source check
(Optional.) Enabling SNMP notifications for the MAC address table

3
Configuring MAC address entries
Configuration guidelines
•You cannot add a dynamic MAC address entry if a learned entry already exists with a different
outgoing interface for the MAC address.
•The manually configured static, blackhole, and multiport unicast MAC address entries cannot
survive a reboot if you do not save the configuration. The manually configured dynamic MAC
address entries are lost upon reboot whether or not you save the configuration.
A frame whose source MAC address matches different types of MAC address entries is processed
differently.
Type
Description
Static MAC address entry Forwards the frame according to the destination MAC address regardless of
whether the frame's ingress interface is the same as that in the entry.
Multiport unicast MAC
address entry
•Learns the MAC address of the frame and generates a dynamic MAC
address entry, but the generated dynamic MAC address entry does not
take effect.
•Forwards the frame based on the multiport unicast MAC address entry.
Blackhole MAC address
entry Drops the frame.
Dynamic MAC address
entry
•Learns the MAC address of the frames received on a different interface
from that in the entry and overwrites the original entry.
•Forwards the frame received on the same interface as that in the entry
and updates the aging timer for the entry.
Adding or modifying a static or dynamic MAC address entry
globally
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Add or modify a static or
dynamic MAC address entry.
mac-address { dynamic |static }
mac-address interface
interface-type interface-number
vlan vlan-id
By default, no MAC address entry
is configured globally.
Make sure you have created the
VLAN and assigned the interface
to the VLAN.
Adding or modifying a static or dynamic MAC address entry
on an interface
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Enter interface view.
•Enter Layer 2 Ethernet
interface view:
interface interface-type
interface-number N/A

4
Step
Command
Remarks
•Enter Layer 2 aggregate
interface view:
interface
bridge-aggregation
interface-number
•Enter S-channel interface
view:
interface s-channel
interface-number.channel-id
•Enter S-channel aggregate
interface view:
interface
schannel-aggregation
interface-number:channel-id
3. Add or modify a static or
dynamic MAC address entry. mac-address { dynamic | static }
mac-address vlan vlan-id
By default, no MAC address entry
is configured on the interface.
Make sure you have created the
VLAN and assigned the interface
to the VLAN.
Adding or modifying a blackhole MAC address entry
Step
Command
Remarks
4. Enter system view. system-view N/A
5. Add or modify a blackhole
MAC address entry. mac-address blackhole
mac-address vlan vlan-id
By default, no blackhole MAC
address entry is configured.
Make sure you have created the
VLAN.
Adding or modifying a multiport unicast MAC address entry
You can configure a multiport unicast MAC address entry to associate a unicast destination MAC
address with multiple ports. The frame with a destination MAC address matching the entry is sent out
of multiple ports.
For example, in NLB unicast mode (see Figure 1):
•All servers within a cluster uses the cluster's MAC address as their own address.
•Frames destined for the cluster are forwarded to every server in the group.
In this case, you can configure a multiport unicast MACaddress entryon the device connected to the
server group. Then, the device forwards the frame destined for the server group to every server
through all ports connected to the servers within the cluster.

5
Figure 1 NLB cluster
You can configure a multiport unicast MAC address entry globally or on an interface.
Configuring a multiport unicast MAC address entry globally
Step
Command
Remarks
1. Enter system view.
system-view
N/A
2. Add or modify a multiport
unicast MAC address entry. mac-address multiport
mac-address interface
interface-list vlan vlan-id
By default, no multiport unicast
MAC address entry is configured
globally.
Make sure you have created the
VLAN and assigned the interface
to the VLAN.
Configuring a multiport unicast MAC address entry on an interface
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Enter interface view.
•Enter Layer 2 Ethernet
interface view:
interface interface-type
interface-number
•Enter Layer 2 aggregate
interface view:
interface
bridge-aggregation
interface-number
N/A
3. Add the interface to a
multiport unicast MAC
address entry. mac-address multiport
mac-address vlan vlan-id
By default, no multiport unicast
MAC address entry is configured
on the interface.
Make sure you have created the
VLAN and assigned the interface
to the VLAN.
Disabling MAC address learning
MAC address learning is enabled by default. To prevent the MAC address table from being saturated
when the device is experiencing attacks, disable MAC address learning. For example, you can
disable MAC address learning to prevent the device from being attacked by a largeamount of frames
with different source MAC addresses.
NLB cluster
Device

6
After MAC address learning is disabled, the device immediately deletes existing dynamic MAC
address entries.
Disabling global MAC address learning
After global MAC address learning is disabled, the device stops learning MAC addresses.
Global MAC address learning does not take effect on a TRILL network, S-channel, VPLS VSI, EVB
VSI, or VXLAN VSI. For information about TRILL, see TRILL Configuration Guide. For information
about VPLS VSIs, see MPLS Configuration Guide. For information about S-channels and EVB VSIs,
see EVB Configuration Guide.For information about VXLAN VSIs, see VXLAN Configuration Guide.
To disable global MAC address learning:
Step
Command
Remarks
1. Enter system view.system-view N/A
2. Disable global MAC address
learning. undo mac-address
mac-learning enable By default, global MAC address
learning is enabled.
Disabling MAC address learning on interfaces
When global MAC address learning is enabled, you can disable MAC address learning on a single
interface.
To disable MAC address learning on an interface:
Step
Command
Remarks
1. Enter system view.system-view N/A
2. Enter interface view.
•Enter Layer 2 Ethernet interface
view:
interface interface-type
interface-number
•Enter Layer 2 aggregate
interface view:
interface bridge-aggregation
interface-number
•Enter S-channel interface view:
interface s-channel
interface-number.channel-id
•Enter S-channel aggregate
interface view:
interface
schannel-aggregation
interface-number:channel-id
N/A
3. Disable MAC address
learning on the interface. undo mac-address mac-learning
enable
By default, MAC address
learning on the interface is
enabled.
Disabling MAC address learning on a VLAN
When global MAC address learning is enabled, you can disable MAC address learning on a
per-VLAN basis.
To disable MAC address learning on a VLAN:

7
Step
Command
Remarks
1. Enter system view.system-view N/A
2. Enable global MAC address
learning. mac-address mac-learning
enable By default, global MAC address
learning is enabled.
3. Enter VLAN view. vlan vlan-id N/A
4. Disable MAC address
learning on the VLAN. undo mac-address
mac-learning enable By default, MAC address learning
on the VLAN is enabled.
Setting the aging timer for dynamic MAC address
entries
For security and efficient use of table space, the MAC address table uses an aging timer for each
dynamic MAC address entry. If a dynamic MAC address entry is not updated before the aging timer
expires, the device deletes the entry. This aging mechanism ensures that the MAC address table can
promptly update to accommodate latest network topology changes.
A stable network requires a longer aging interval, and an unstable network requires a shorter aging
interval.
An aging interval that is too long might cause the MAC address table to retain outdated entries.As a
result, the MAC address table resources might be exhausted, and the MAC address table might fail
to update its entries to accommodate the latest network changes.
An interval that is too short might result in removal of valid entries, which would cause unnecessary
floods and possibly affect the device performance.
To reduce floods on a stable network, set a long aging timer or disable the timer to prevent dynamic
entries from unnecessarily aging out. Reducing floods improves the network performance. Reducing
flooding also improves the security because it reduces the chances for a data frame to reach
unintended destinations.
To set the aging timer for dynamic MAC address entries:
Step
Command
Remarks
1. Enter system view.
system-view
N/A
2. Set the aging timer for
dynamic MAC address
entries. mac-address timer { aging
seconds | no-aging }
The default setting is 300
seconds.
The no-aging keyword disables
the aging timer.
Setting the MAC learning limit
This feature limits the MAC address table size. A large MAC address table will degrade forwarding
performance.
Do not set the MAC learning limit on TRILL ports. The setting does not take effect on TRILL ports.
If you set the MAC learning limit on a member port of an aggregation group, the setting takes effect
only after the member port is removed from the aggregation group.
To set the MAC learning limit on an interface:

8
Step
Command
Remarks
1. Enter system view.system-view N/A
2. Enter Layer 2 Ethernet
interface view. interface interface-type
interface-number
N/A
3. Set the MAC learning limit on
the interface. mac-address max-mac-count
count
By default, the number of MAC
addresses that can be learned on
an interface is not limited.
Configuring the unknown frame forwarding rule
after the MAC learning limit is reached
You can enable or disable forwarding of unknown frames after the MAC learning limit is reached.
In this document,unknown frames refer to frames whose source MAC addresses are notin the MAC
address table.
To configure the device to forward unknown frames received on an interface after the MAC learning
limit on the interface is reached:
Step
Command
Remarks
1. Enter system view.
system-view
N/A
2. Enter interface view.
•Enter Layer 2 Ethernet
interface view.
interface interface-type
interface-number
•Enter Layer 2 aggregate
interface view.
interface
bridge-aggregation
interface-number
N/A
3. Configure the device to
forward unknown frames
received on the interface
after the MAC learning limit
on the interface is reached.
mac-address max-mac-count
enable-forwarding
By default, the device can forward
unknown frames received on an
interface after the MAC learning
limit on the interface is reached.
You cannot use the undo
mac-address max-mac-count
enable-forwarding command on
Layer 2 aggregate interfaces.
Assigning MAC learning priority to interfaces
The MAC learning priority mechanism assigns either low priority or high priority to an interface. An
interface with high priority can learn MAC addresses as usual. However, an interface with low priority
is not allowed to learn MAC addresses already learned on a high-priority interface.
The MAC learning priority mechanism can help defend your network against MAC address spoofing
attacks. In a network that performs MAC-based forwarding, an upper layer device MAC address
might be learned by a downlink interface because of a loop or attack to the downlink interface. To
avoid this problem, perform the following tasks:
•Assign high MAC learning priority to an uplink interface.
•Assign low MAC learning priority to a downlink interface.

9
To assign MAC learning priority to an interface:
Step
Command
Remarks
1. Enter system view.
system-view
N/A
2. Enter interface view.
•Enter Layer 2 Ethernet interface
view:
interface interface-type
interface-number
•Enter Layer 2 aggregate
interface view:
interface bridge-aggregation
interface-number
•Enter S-channel interface view:
interface s-channel
interface-number.channel-id
•Enter S-channel aggregate
interface view:
interface
schannel-aggregation
interface-number:channel-id
N/A
3. Assign MAC learning priority
to the interface. mac-address mac-learning priority
{ high | low } By default, low MAC learning priority is used.
Enabling MAC address synchronization
(In standalone mode.) To avoid unnecessary floods and improve forwarding speed, make sure all
cards have the same MAC address table. After you enable MAC address synchronization, each card
advertises learned MAC address entries to other cards.
(In IRF mode.) To avoid unnecessary floods and improve forwarding speed, make sure all cards
have the same MAC address table. After you enable MAC address synchronization, each card
advertises learned MAC address entries to other cards of all member devices.
As shown in Figure 2:
•Device A and Device B form an IRF fabric enabled with MAC address synchronization.
•Device A and Device B connect to AP C and AP D, respectively.
When Client A associates with AP C, Device A learns a MAC address entry for Client A and
advertises it to Device B.

10
Figure 2 MAC address tables of devices when Client A accesses AP C
When Client A roams to AP D, Device B learns a MAC address entry for Client A. Device B
advertises it to Device A to ensure service continuity for ClientA, as shown in Figure 3.
Figure 3 MAC address tables of devices when Client A roams to AP D
To enable MAC address synchronization:
Step
Command
Remarks
1. Enter system view.
system-view
N/A
2. Enable MAC address
synchronization. mac-address mac-roaming
enable By default, MAC address
synchronization is disabled.
IRF
Device A Device B
Client A
AP D
AP C
Port A1 Port B1
MAC address Port
MAC A A1
MAC address Port
MAC A A1
IRF
Device A Device B
Client A
AP D
AP C
Port A1 Port B1
MAC address Port
MAC A A1 B1
MAC address Port
MAC A B1

11
Configuring MAC address move notifications and
suppression
The outgoing interface for a MAC address entry learned on interface A is changed to interface B
when the following conditions exist:
•Interface B receives a packet with the MAC address as the source MAC address.
•Interface B belongs to the same VLAN as interface A.
In this case, the MAC address is moved from interface A to interface B, and a MAC address move
occurs.
The MAC address move notifications feature enables the device to output MAC address move logs
when MAC address moves are detected.
If a MAC address is continuously moved between the two interfaces, Layer 2 loops might occur. To
detect and locate loops, you can view the MAC address move information. To display the MAC
address move records after the device is started, use the display mac-address mac-move
command.
If the system detects that MAC address moves occur frequently on an interface, you can configure
MAC address move suppression to shut the interface down. The interface automatically goes up
after a suppression interval. Or, you can manually bring up the interface.
To configure MAC address move notifications and MAC address move suppression:
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Enable MAC address move
notifications and optionally
specify a MAC move
detection interval.
mac-address notification
mac-move [ interval interval ]
By default, MAC address move
notifications are disabled.
If you do not specify a detection
interval, the default setting of 1
minute is used.
After you execute this command, the
system sends only log messages to
the information center module. If the
device is also configured with the
snmp-agent trap enable
mac-address command, the
system also sends SNMP
notifications to the SNMP module.
3. (Optional.) Set MAC
address move suppression
parameters.
mac-address notification
mac-move suppression
{ interval interval | threshold
threshold }
By default, the suppression interval
is 30 seconds, and the suppression
threshold is 3.
4. Enter interface view.
•Enter Layer 2 Ethernet
interface view:
interface interface-type
interface-number
•Enter Layer 2 aggregate
interface view:
interface
bridge-aggregation
interface-number
N/A
5. Enable MAC address move
suppression. mac-address notification
mac-move suppression By default, MAC address move
suppression is disabled.