23
Manually configuring MAC address entries
With dynamic MAC address learning, a device does not distinguish between illegitimate and legitimate
frames, which can invite security hazards. For example, when a hacker sends frames with a forged
source MAC address to a port different from the one to which the real MAC address is connected, the
device creates an entry for the forged MAC address, and forwards frames destined for the legal user to
the hacker instead.
To improve port security, you can bind specific user devices to the port by manually adding MAC address
entries to the MAC address table of the switch.
Types of MAC address table entries
A MAC address table can contain the following types of entries:
•
Static entries
—Static entries are manually added in order to forward frames with specific
destination MAC addresses out of their associated ports and never age out.
•
Dynamic entries
—Dynamic entries can be manually added or dynamically learned in order to
forward frames with specific destination MAC addresses out of their associated ports and might
age out.
•
Blackhole entries
—Blackhole entries are manually configured and never age out. Blackhole entries
are configured for filtering out frames with specific source or destination MAC addresses. For
example, to block all packets destined for a specific user for security concerns, you can configure
the MAC address of this user as a blackhole MAC address entry.
A static or blackhole MAC address entry can overwrite a dynamic MAC address entry, but not vice
versa.
To adapt to network changes and prevent inactive entries from occupying table space, an aging
mechanism is adopted for dynamic MAC address entries. Each time a dynamic MAC address entry is
obtained or created, an aging time starts. If the entry has not updated when the aging timer expires, the
device deletes the entry. If the entry has updated before the aging timer expires, the aging timer restarts.
MAC address table-based frame forwarding
When forwarding a frame, the device adopts the following forwarding modes based on the MAC
address table:
•
Unicast mode
—If an entry is available for the destination MAC address, the device forwards the
frame out of the outgoing interface indicated by the MAC address table entry.
•
Broadcast mode
—If the device receives a frame with the destination address as all-ones, or no entry
is available for the destination MAC address, the device broadcasts the frame to all the interfaces
except the receiving interface.
Configuring static, dynamic, and blackhole MAC
address table entries
To prevent MAC address spoofing attacks and improve port security, you can manually add MAC
address table entries to bind ports with MAC addresses. You can also configure blackhole MAC address
entries to filter out packets with certain source or destination MAC addresses.
