34
•
Blackhole
entries
—A blackhole entry is manually configured and never ages out. A blackhole
entry is configured for filtering out frames with a specific source or destination MAC address.
For example, to block all frames destined for or sourced from a user, you can configure the
MAC address of the user as a blackhole MAC address entry.
•
Security
entries
—
A security entry can be manually configured or dynamically learned to
forward frames with a specific MAC address out of the associated interface. A security entry
never ages out.
Aging timer for dynamic MAC address entries
For security and efficient use of table space, the MAC address table uses an aging timer for dynamic
entries learned on all interfaces. If a dynamic MAC address entry is not updated before the aging
timer expires, the device deletes the entry. This aging mechanism ensures that the MAC address
table can promptly update to accommodate latest network topology changes.
A stable network requires a longer aging interval, and an unstable network requires a shorter aging
interval.
An aging interval that is too long might cause the MAC address table to retain outdated entries. As a
result, the MAC address table resources might be exhausted, and the MAC address table might fail
to update its entries to accommodate the latest network changes.
An interval that is too short might result in removal of valid entries, which would cause unnecessary
floods and possibly affect the device performance.
To reduce floods on a stable network, set a long aging timer or disable the timer to prevent dynamic
entries from unnecessarily aging out. Reducing floods improves the network performance. Reducing
flooding also improves the security because it reduces the chances for a data frame to reach
unintended destinations.
MAC address learning
MAC address learning is enabled by default. To prevent the MAC address table from being saturated
when the device is experiencing attacks, disable MAC address learning. For example, you can
disable MAC address learning to prevent the device from being attacked by a large amount of frames
with different source MAC addresses.
When global MAC address learning is enabled, you can disable MAC address learning on a single
interface.
You can also configure the MAC learning limit on an interface to limit the MAC address table size. A
large MAC address table will degrade forwarding performance. When the limit is reached, the
interface stops learning any MAC addresses. You can also configure whether to forward frames
whose source MAC address is not in the MAC address table.
STP
Spanning tree protocols perform the following tasks:
•
Prune the loop structure into a loop-free tree structure for a Layer 2 network by selectively
blocking ports.
•
Maintain the tree structure for the live network.
Spanning tree protocols include STP, RSTP, and MSTP:
•
STP
—Defined in IEEE 802.1d.
•
RSTP
—Defined in IEEE 802.1w. RSTP achieves rapid network convergence by allowing a
newly elected root port or designated port to enter the forwarding state much faster than STP.
