Static MAC Address Table Entry

Lessons Discussion
43

Hi Laz,

One thing i want to know suppose we have single router through which 3 switches connected directly to the router with different port on router so i want to know that switches learn the mac address and would learned mac-address be the same or different b/c i want to know that mac address is specific to the port or device(router or switch) , same thing on router ?

44

Hello Pradyumna

A router has a different MAC address for each of its ports. In other words, you can consider each port of the router to be like a host or a PC. Switch1 would learn the MAC address of port1 of the router that is connected to it, Switch2, would learn the MAC address of port2 of the router, and Switch3 would learn the MAC address of port3 of the router.

So the MAC address of each port is indeed different.

I hope this has been helpful!

Laz

45

I am having a weird situation. Running some test lab in EVE on the Below SW version.
I tried to add Static Entries and It is giving the option to add the same MAC on multiple. Ports?

Switch#
Switch#sh ver
Cisco IOS Software, Solaris Software (I86BI_LINUXL2-ADVENTERPRISEK9-M), Experimental Version 15.1(20140814:053243) [mmen 112]
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Thu 14-Aug-14 08:28 by mmen

ROM: Bootstrap program is Linux

Switch uptime is 1 day, 1 hour, 46 minutes
System returned to ROM by reload at 0
System image file is "unix:/opt/unetlab/addons/iol/bin/L2-ADVENTERPRISE-M-15.1-20140814.bin"
Last reload reason: Unknown reason
As shown in the image, I am able to add two Ports with static MAC Address Entry?
I used the below command
Switch(config)#mac add stat 4444.4444.4444 vlan 1 int e0/0 e0/1

Can you explain what does this command does how will switch behave ?

S

MAC-Address
MAC-Address696×493 84 KB

46

Hello Haris

After doing a bit of research I have found that some platforms do allow MAC addresses to be statically assigned to multiple ports while others do not. But no switch allows a MAC address to be dynamically assigned to multiple ports.

There are situations in which you do require this such as when you use some load balancing techniques used by some servers such as Microsoft’s Network Load Balancing. in this feature, the MAC address of the NICs used by the server are actually changed so they are the same for multiple NICs, thus requiring a switch to accept them.

I hope this has been helpful!

Laz

47

Hi,
What is the use case for static mac address

Thanks

48

Hello Sims

Assigning a static MAC address on a switch can be a quick and easy way of allowing a particular host to use only one specific port of a switch. If you configure a static MAC address, then that host will only be able to use the port configured in that static entry.

This can quickly be done for two or three devices, but as the number of devices grows, it becomes more difficult to manage. In such a case, port security should be used instead.

I hope this has been helpful!

Laz

49

“Note: You can also put multicast MACs into CAM assuming IGMP snooping is disabled for that VLAN. Can be used to control where multicast is flooded (useful to control where link-local messages go, since IGMP snooping does not control these) or simply to drop it.”

Can this work coexisting with IGMP Snooping enabled? @ReneMolenaar @lagapidis

50

Hello Trenton

Adding a static multicast MAC address table entry manually will not be affected by IGMP snooping, as the static entry will remain in the table regardless of IGMP messages. However, you should be cautious when manually configuring multicast MAC address table entries, as it can interfere with the automatic operation of IGMP snooping and may cause unexpected results.

Unless there is a very good reason for it, and unless it’s done very carefully, it’s usually best practice to allow IGMP snooping to optimize multicast traffic forwarding in the network.

I hope this has been helpful!

Laz

51

Hello, everyone.

A quick question

obrázok
obrázok537×158 3.51 KB

If I configure a static entry for the same MAC, specifying two different exit interfaces, which one will be used?

My switch is always using the last interface I’ve configured, so is that how it’s supposed to work? I don’t know whether it’s even possible to do this on a real switch as this was all done in Cisco CML, could someone please confirm this?

Kind regards,
David

52

Hello David

That is indeed interesting behavior. I would not have thought that a MAC address can be assigned statically to two ports, but I was able to reproduce your results in CML.

I tried this out on my old 2950. After trying to add the same MAC address in a static entry to a second interface, I got this:

SW-2950(config)#mac address-table static 0000.0000.0001 vlan 1 interface fastEthernet 0/2
MAC address could not be added

As expected, the MAC address could not be added.

I just remembered that I have access to a production 9500. I just tried it and (to my surprise) I was able to assign the same static MAC address to multiple ports. :crazy_face:

All of my experience tells me that it should not be possible but there you go. And actually, the command in the 9500 lets you add multiple ports on the same command:

AND-DRB-CORA(config)#mac address-table static 0000.0000.0001 vlan 1 interface twentyFiveGigE 1/0/10 twentyFiveGigE 1/0/11 ?
  GigabitEthernet  GigabitEthernet IEEE 802.3z
  HundredGigE      Hundred Gigabit Ethernet
  Port-channel     Ethernet Channel of interfaces
  TwentyFiveGigE   Twenty Five Gigabit Ethernet
  <cr>             <cr>

AND-DRB-CORA(config)#mac address-table static 0000.0000.0001 vlan 1 interface twentyFiveGigE 1/0/10 twentyFiveGigE 1/0/11

To be honest, I can’t think of a reasonable use case for this behavior. I’ll have to give it some more thought and pass it by Rene as well. Thanks for this interesting conundrum!

I hope this has been helpful!

Laz

53

Hello Laz.

I understand, thank you very much! Apart from that, I have one more question.

When would we want to statically configure a MAC address for our table? Since I can only see the dynamic method being used 99.99% of the time. And in case we want to prevent MAC flooding attacks, we can just configure port security instead of disabling dynamic learning and configuring an entry statically.

Thank you.

David

54

unless we manually change the static entry

56

Hello Sathish

In response to this post:

… you are indeed correct that static MAC entries will only change if you manually make the change. Otherwise, they are persistent, even after a reboot of the switch, since it is something configured in the configuration of the device.

I hope this has been helpful!

Laz

1 Like
57

Hello David

Static MAC address assignments in the MAC Address table is not something that should be done often. There are cases where it can be helpful, but typically there are other better methods to achieve what you need. Some reasons for using it include:

  • Security: In environments with specific security requirements, you might want to manually indicate the MAC address that should correspond with the port you want. This can help prevent unauthorized devices from connecting to your network. But port security would be a better solution.
  • Persistent Connectivity: In some cases, you might want to ensure that a specific device always retains its connectivity, even after a switch reboots. Dynamic entries are removed when a switch is rebooted, but static entries persist.
  • MAC Flooding: While port security is an effective way to prevent MAC flooding attacks, in some cases, you might want to use static MAC address entries as an additional layer of security.
  • Troubleshooting: In some troubleshooting scenarios, you might want to manually set a MAC address to isolate issues or test certain network behaviors.

I have never used a static entry in a production network in over 20 years of experience. That’s not to say it is not used, but it is indeed rare.

I hope this has been helpful!

Laz