as a static address does the same thing. When sticky MAC addressing is enabled by the
mac security sticky
command, the dynamically learned addresses are marked as sticky and a
mac security sticky address
mac-address
command is automatically generated and saved in the running configuration for each learned
MAC address on the service instances.
Aging for Sticky Addresses
MAC addresses learned on a service instance that has the sticky behavior enabled are subject to aging as
configured by the
mac security aging time
and
mac security aging sticky
commands. In other words, for
the purpose of aging functionality, sticky addresses are treated the same as dynamically learned addresses.
Transitions
This section contains a description of the expected behavior of the different MAC security elements when
various triggers are applied; for example, configuration changes or link state transitions.
MAC Security Enabled on a Service Instance
When MAC security is enabled on a service instance, all existing MAC table entries for the service instance
are purged. Then, permitted MAC address entries and sticky addresses are added to the MAC table, subject
to the prevailing MAC address limiting constraints on the bridge domain.
If MAC address limits are exceeded, any MAC address that fails to get added is reported via an error message
to the console, the attempt to enable MAC security on the service instance fails, and the already added permitted
entries are backed out or removed.
The aging timer for all entries is updated according to the secure aging rules.
MAC Security Disabled on a Service Instance
The existing MAC address table entries for this service instance are purged.
Service Instance Moved to a New Bridge Domain
This transition sequence applies to all service instances, whether or not they have MAC security configured.
All the MAC addresses on this service instance in the MAC address table of the old bridge domain are removed.
The count of dynamically learned addresses in the old bridge domain is decremented. Then, all the MAC
security commands are permanently erased from the service instance.
Service Instance Removed from a Bridge Domain
All the MAC addresses in the MAC address table that attributable to this service instance are removed, and
the count of dynamically learned addresses in the bridge domain is decremented. Since MAC security is
applicable only on service instances that are members of a bridge domain, removing a service instance from
a bridge domain causes all the MAC security commands to be erased permanently.
Layer 2 Configuration Guide for Cisco NCS 4200 Series
42
Configuring MAC Address Security on Service Instances and EVC Port Channels
Transitions
