HP VPN Firewall Appliances Network Management Configuration Guide

Configuring the MAC address table

This document covers only the configuration of unicast MAC address entries, including static, dynamic,

and destination blackhole MAC address entries. The MAC address table configuration tasks can be

performed in any order.

The MAC address table can contain only Layer 2 Ethernet ports (excluding Layer 2 subinterfaces) and

Layer 2 aggregate interfaces.

Overview

To reduce single-destination packet flooding in a switched LAN, an Ethernet device uses a MAC address

table for forwarding frames. This table describes from which port a MAC address (or host) can be

reached. When forwarding a single-destination frame, the device first looks up the destination MAC

address of the frame in the MAC address table for a match. If the device finds an entry, it forwards the

frame out of the outgoing port in the entry. If the device does not find an entry, it floods the frame out of

all but the incoming port.

To view MAC address table information, use the display mac-address command, as follows:

<Sysname> display mac-address

MAC ADDR VLAN ID STATE PORT INDEX AGING TIME(s)

000f-e201-0101 1 Learned GigabitEthernet0/1 AGING

--- 1 mac address(es) found ---

How a MAC address entry is created

The device automatically learns entries in the MAC address table, or you can add them manually.

MAC address learning

The device can automatically populate its MAC address table by learning the source MAC addresses of

incoming frames on each port.

When a frame arrives at a port, Port A, for example, the device performs the following tasks:

1. Verifies the source MAC address (for example, MAC-SOURCE) of the frame.

2. Looks up the source MAC address in the MAC address table.

3. Updates an entry if it finds one. If the device does not find an entry, it adds an entry for

MAC-SOURCE and Port A.

The device performs this learning process each time it receives a frame from an unknown source MAC

address, until the MAC address table is fully populated.

After learning a source MAC address, when the device receives a frame destined for MAC-SOURCE, the

device finds the MAC-SOURCE entry in the MAC address table and forwards the frame out of Port A.

Manually configuring MAC address entries

With dynamic MAC address learning, a device does not distinguish between illegitimate and legitimate

frames. For example, when a hacker sends frames with a forged source MAC address to a port different