Service Instance Shut Down Due to Violation
All dynamically learned MAC addresses in the MAC address table are removed, and all the other MAC
security state values are left unchanged. The only change is that no traffic is forwarded, and therefore no
learning can take place.
Interface Service Instance Down Linecard OIR Removed
The MAC tables of all the affected bridge domains are cleared of all the entries attributable to the service
instances that are down.
Interface Service Instance Re-activated Linecard OIR Inserted
The static and sticky address entries in the MAC tables of the affected bridge domains are re-created to the
service instances that are activated.
MAC Address Limit Decreased
When the value of the MAC address limit on the service instance is changed initially, a sanity check is
performed to ensure that the new value of <n> is greater than or equal to the number of permitted entries. If
not, the command is rejected. The MAC table is scanned for addresses that are attributable to this service
instance, and dynamically learned MAC addresses are removed when the new MAC address limit is less than
the old MAC address limit.
Sticky Addresses Added or Removed on a Service Instance
Existing dynamically learned MAC addresses remain unchanged. All new addresses learned become
“
sticky
”
addresses.
Disabling sticky addresses causes all sticky secure MAC addresses on the service instance to be removed
from the MAC address table. All new addresses learned become dynamic addresses on the service instance
and are subject to aging.
How to Configure MAC Address Limiting on Service Instances
Bridge Domains and EVC Port Channels
Enabling MAC Security on a Service Instance
Perform this task to enable MAC address security on a service instance.
Layer 2 Configuration Guide for Cisco NCS 4200 Series
43
Configuring MAC Address Security on Service Instances and EVC Port Channels
How to Configure MAC Address Limiting on Service Instances Bridge Domains and EVC Port Channels
