Static MAC Address Table Entry

Hello Laz,
Yes, there is no dynamic mac address in the entire mac address table. Unfortunately, this switch is in production and therefore, no experiment is allowed on this switch :grin:.

Thank you so much.

Azm

Hello Azm

That’s too bad. Doing a bit more research, is there any port security configuration on any of the ports where the static addresses are showing up? If so, try to temporarily remove any port security configs and bounce the interface and see what happens. Also, can you share the IOS version you are using? It would be worth checking out the possibility of a bug.

Let us know!

Laz

So the switch used in this lesson (SW1). This layer 2 switch has its own MAC address - 001d.a18b.36d0 ? This MAC address represents all aspects of the switch (all its interfaces – and any VLANS I create) ? ? ?

Hello Jason

The MAC addresses on a switch will differ depending on the platform you use. Some Cisco switches such as the 3560 series will have a primary MAC address, also known as the “master” MAC address. This is the one used for spanning tree and other mechanisms that require a MAC address. Now if you do a “show interface” for various ports of the switch, you will see that each port has its own unique MAC address and they are all sequential to each other. This is used as the destination MAC for traffic that is destined to that port itself. Examples of such traffic include CDP, or STP BPDUs. Now on such platforms, you have a series of reserved MAC addresses that are used for SVIs. These are dynamically assigned as SVIs are created.

Other platforms such as the 6500 series will have the same MAC address configured on all switch ports as well as the master MAC address and SVI MACs.

I hope this has been helpful!

Laz

what are the few scenarios where we need to use static mac addresses?

Hello Vinay

Static MAC addresses can be implemented for several reasons. The first involves MAC addresses that are assigned for the CPU, which can be seen below:
image
These are used for traffic that is destined for the switch itself as opposed to transient traffic.

Secondly, static MAC addresses can be assigned as multicast addresses. Mutlicast MAC addresses can be assigned to more than one interface.

Finally static MAC address can be manually assigned in order to apply a rudimentary security, allowing specific devices to only use a single port on the switch. Although not as secure as port security, it verifies that specific devices will only be connected to a single port.

I hope this has been helpful!

Laz

1 Like

thank you, Laz. It makes sense.

1 Like

Hi Laz .

i too see similar static mac entries . Still i don’t understand . Can you please clarify ?
How CPU can be a Port ?
What is the need to map CPU entry for so many static mac entries ?

Switch2-7000#show mac address-table
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 All    0100.0ccc.cccc    STATIC      CPU
 All    0100.0ccc.cccd    STATIC      CPU
 All    0180.c200.0000    STATIC      CPU
 All    0180.c200.0001    STATIC      CPU
 All    0180.c200.0002    STATIC      CPU
 All    0180.c200.0003    STATIC      CPU
 All    0180.c200.0004    STATIC      CPU
 All    0180.c200.0005    STATIC      CPU
 All    0180.c200.0006    STATIC      CPU
 All    0180.c200.0007    STATIC      CPU
 All    0180.c200.0008    STATIC      CPU
 All    0180.c200.0009    STATIC      CPU
 All    0180.c200.000a    STATIC      CPU
 All    0180.c200.000b    STATIC      CPU
 All    0180.c200.000c    STATIC      CPU
 All    0180.c200.000d    STATIC      CPU
 All    0180.c200.000e    STATIC      CPU
 All    0180.c200.000f    STATIC      CPU
 All    0180.c200.0010    STATIC      CPU
 All    ffff.ffff.ffff    STATIC      CPU
  1    189c.5d48.3685    DYNAMIC     Fa0/5

Hello Sameer

A switch can have transverse traffic, and traffic that is sent or destined to the switch itself.

Transverse traffic is traffic with source and destination MAC addresses that don’t belong to the switch. In other words, this is traffic that comes from and goes to a host other than the switch itself. This is the vast majority of traffic that a switch will service, and this fulfills the fundamental function of the switch. This can generally be called user traffic, or data plane traffic. Transverse traffic automatically creates entries in the MAC address table, allowing MAC addresses to correspond to particular interfaces.

Now traffic that is sourced or destined to or from the switch itself is different. The actual physical MAC addresses of the switch and of its interfaces do not actually appear in the MAC address table. However, what does appear is a list of multicast MAC addresses. When a frame enters a switch with a multicast MAC address as the destination, it must know what to do with it. It looks in the MAC address and sends it to the CPU.

What does that mean? Well the CPU isn’t a port in the normal sense. It’s not even a virtual port, but it is the processing center of the switch that will take the frame and decide what to do with it. It is important to note here that the MAC addresses you see in the list above, are statically assigned, because they are “well known” or preconfigured addresses for use with particular internal processes. Here is a short list of some of these that appear in your output as well:

0100.0ccc.cccc CDP, VTP, and UDLD
0100.0ccc.cccd Cisco Shared Spanning Tree Protocol Address
0180.c200.0000 Spanning Tree Protocol (for bridges) IEEE 802.1D
0180.C200.0002 LACP and others
0180.C200.0003 LLDP
0180.C200.0008 STP for providers 802.1ad
ffff.ffff.ffff All nodes multicast address

So all of these are used for the internal operations and data plane communications with other switches and devices on the network.

I hope this has been helpful! Stay safe, and healthy!

Laz

3 Likes

Thanks alot Laz . Ok so this is basically control plane multicast traffic intended for switch itself .

1 Like

Laz,This is really very helpful discussion .I had confusion as well but now I am clear.Thanks again for your prompt and fruitful respond.

1 Like

Hi dears,
I bought a new cisco 2960 switch for practice which has no configuration.
When I consoled to the switch and then typed in enable mode show mac address-table, then it shows the below mad address that itself as learned as static, my question is in here that yet I did not assigned any mac address to any port of switch as static and also did not plug any PC or device so what are the below mac address that itself has learned as static?

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 All    0100.0ccc.cccc    STATIC      CPU
 All    0100.0ccc.cccd    STATIC      CPU
 All    0180.c200.0000    STATIC      CPU
 All    0180.c200.0001    STATIC      CPU
 All    0180.c200.0002    STATIC      CPU
 All    0180.c200.0003    STATIC      CPU
 All    0180.c200.0004    STATIC      CPU
 All    0180.c200.0005    STATIC      CPU
 All    0180.c200.0006    STATIC      CPU
 All    0180.c200.0007    STATIC      CPU
 All    0180.c200.0008    STATIC      CPU
 All    0180.c200.0009    STATIC      CPU
 All    0180.c200.000a    STATIC      CPU
 All    0180.c200.000b    STATIC      CPU
 All    0180.c200.000c    STATIC      CPU
 All    0180.c200.000d    STATIC      CPU
 All    0180.c200.000e    STATIC      CPU
 All    0180.c200.000f    STATIC      CPU
 All    0180.c200.0010    STATIC      CPU
 All    ffff.ffff.ffff    STATIC      CPU
Total Mac Addresses for this criterion: 20

Hello Ajmal

These MAC address entries are multicast entries that are used by various control plane network processes, and exist in all Cisco switches. Take a look at the following post that further explains these entries.

I hope this has been helpful!

Laz

Thanks Sir,
Appreciated.

Regards,
Ajmal" Ahmadi"

1 Like

I had an instance on an access switch with Router 1 configured to be the default gateway. Another user had plugged in a device on a trunk port that was spoofing the MAC address of the default gateway (nothing nefarious, just a lab gone wrong) and prevented users from reaching the internet. Would a static mac address assignment prevent this?

Hello Lawrence

Although a static MAC assignment in the MAC address table of the same MAC address will take precedence over a dynamically learned one, the most effective way of dealing with spoofed MAC addresses is to use mechanisms such as port security. You can find out more about it here:


Port security will ensure that if a MAC address is spoofed on a port where that address is not expected, that port can be automatically shutdown (put into an err-disable state) to prevent further network access to that device. Take a look at the lesson, and if you have further questions, let us know!

I hope this has been helpful!

Laz

Hi Laz,

One thing i want to know suppose we have single router through which 3 switches connected directly to the router with different port on router so i want to know that switches learn the mac address and would learned mac-address be the same or different b/c i want to know that mac address is specific to the port or device(router or switch) , same thing on router ?

Hello Pradyumna

A router has a different MAC address for each of its ports. In other words, you can consider each port of the router to be like a host or a PC. Switch1 would learn the MAC address of port1 of the router that is connected to it, Switch2, would learn the MAC address of port2 of the router, and Switch3 would learn the MAC address of port3 of the router.

So the MAC address of each port is indeed different.

I hope this has been helpful!

Laz

I am having a weird situation. Running some test lab in EVE on the Below SW version.
I tried to add Static Entries and It is giving the option to add the same MAC on multiple. Ports?

Switch#
Switch#sh ver
Cisco IOS Software, Solaris Software (I86BI_LINUXL2-ADVENTERPRISEK9-M), Experimental Version 15.1(20140814:053243) [mmen 112]
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Thu 14-Aug-14 08:28 by mmen

ROM: Bootstrap program is Linux

Switch uptime is 1 day, 1 hour, 46 minutes
System returned to ROM by reload at 0
System image file is "unix:/opt/unetlab/addons/iol/bin/L2-ADVENTERPRISE-M-15.1-20140814.bin"
Last reload reason: Unknown reason
As shown in the image, I am able to add two Ports with static MAC Address Entry?
I used the below command
Switch(config)#mac add stat 4444.4444.4444 vlan 1 int e0/0 e0/1

Can you explain what does this command does how will switch behave ?

S

Hello Haris

After doing a bit of research I have found that some platforms do allow MAC addresses to be statically assigned to multiple ports while others do not. But no switch allows a MAC address to be dynamically assigned to multiple ports.

There are situations in which you do require this such as when you use some load balancing techniques used by some servers such as Microsoft’s Network Load Balancing. in this feature, the MAC address of the NICs used by the server are actually changed so they are the same for multiple NICs, thus requiring a switch to accept them.

I hope this has been helpful!

Laz