Cisco ASR 920 series, Руководство по настройке Ethernet-маршрутизатора

Страница: 103 / 438

Static and Dynamic MAC Addresses
A static MAC address is specified as permitted on a service instance, by a mac security permit command. A
dynamic MAC address is a source MAC address encountered by the service instance that is not present in the
MAC table but is allowed into and learned by the MAC address table.
Dynamic MAC Address Learning
Dynamic MAC address learning occurs when the bridging data path encounters an ingress frame whose source
address is not present in the MAC address table for the ingress secured service instance.
The MAC security component is responsible for permitting or denying the addition of the new source address
into the MAC table. The following constraints apply:
• If a MAC address is to be learned, a check is performed to determine whether the number of secured
MAC addresses exceed the maximum number that are permitted to be learned on the individual service
instance and on the bridge domain.
• A check is performed to determine if the MAC address on an another service instance is learned on a
secured service instance in the same bridge domain.
• A check is performed to verify if the new dynamic MAC address is in a deny list.
MAC Address Limiting on Service Instances
The user can configure the maximum number of MAC addresses that can exist in the MAC table that is
associated with a service instance. This number includes statically configured and dynamically learned
(including sticky) addresses.
On a service instance that has MAC security enabled and that does not have the maximum number of MAC
addresses configured, the number of addresses allowed is one. This means that if the service instance has an
associated permit list, that permit list can have only one address, and no addresses are learned dynamically.
If the service instance does not have an associated permit list, one MAC address may be learned dynamically.
MAC Address Limiting for Bridge Domains
An upper limit for the number of MAC addresses that can reside in the MAC address table of a bridge domain
can be set. This is set independently of the upper limit of secured MAC addresses on the service instance. An
attempted violation of this bridge domain MAC address limit will cause the MAC address learn attempt to
fail, and the frame to be dropped.
If the bridge domain MAC address limit is not configured, then by default, the maximum number of MAC
addresses allowed on a bridge domain is the maximum number that can be supported by that platform.
Relationship Between the MAC Address Limit on a Bridge Domain and on a Service Instance
You can specify the maximum count of MAC table entries on a bridge domain and on a service instance
simultaneously. However, there are no restrictions on the count that is configured on the service instance.
The table below shows an example of an initial configuration where three service instances are configured
on a bridge domain:
Carrier Ethernet Configuration Guide (Cisco ASR 920 Series)
85
Configuring MAC Address Limiting on Service Instances Bridge Domains and EVC Port Channels
MAC Address Limiting and Learning