R3721-F3210-F3171-HP High-End Firewalls Network Management Configuration Guide-6PW101

54
Task Command Remarks
Display MAC address table
information.
display mac-address [ mac-address [ vlan vlan-id ] |
[ [ dynamic | static ] [ interface interface-type
interface-number ] | blackhole ] [ vlan vlan-id ]
[ count ] ] [ | { begin | exclude | include }
regular-expression ]
Available in any view
Display the aging timer for
dynamic MAC address
entries.
display mac-address aging-time [ | { begin |
exclude | include } regular-expression ]
Available in any view
MAC address table configuration example
Network requirements
As shown in Figure 38, Host A (000f-e235-dc71) belongs to VLAN 1, and is connected to
GigabitEthernet 0/1 of Firewall; Host B (000f-e235-abcd), which once behaved suspiciously on the
network, belongs to VLAN 1.
To prevent MAC address spoofing, add a static entry for Host A in the MAC address table of the firewall.
For security, add a destination blackhole MAC address entry for Host B’s MAC address, so that all
packets destined for Host B will be dropped.
Set the aging timer for dynamic MAC address entries to 500 seconds.
Figure 38 Network diagram
Configuration procedure
# Add a static MAC address entry.
<Firewall> system-view
[Firewall] mac-address static 000f-e235-dc71 interface gigabitethernet 0/1 vlan 1
# Add a destination blackhole MAC address entry.
[Firewall] mac-address blackhole 000f-e235-abcd vlan 1
# Set the aging timer for dynamic MAC address entries to 500 seconds.
[Firewall] mac-address timer aging 500
# Display the MAC address entry for port GigabitEthernet 0/1.
[Firewall] display mac-address interface gigabitethernet 0/1
MAC ADDR VLAN ID STATE PORT INDEX AGING TIME(s)
Host A
000f-e235-dc71
Host B
000f-e235-abcd
GE0/1
VLAN 1
GE0/2
VLAN 1
Firewall