MAC Address Anti-flapping

Security Policy

MAC address flapping occurs on a network when the network has a loop or undergoes certain attacks. The following methods can help prevent MAC address flapping:

Increase the MAC address learning priority of an interface.

Configure different MAC address learning priorities for interfaces. When two interfaces learn the same MAC address entry, the MAC address entry learned by the interface with a higher priority can override that learned by the other interface to prevent MAC address flapping.
Forbid MAC address flapping between interfaces with the same priority.

Uplink interfaces of switches are connected to servers, and downlink interfaces are connected to users. To prevent unauthorized users from using server MAC addresses to connect to switches, forbid MAC address flapping between interfaces with the same priority. Then a MAC address will not be learned by multiple interfaces, and malicious users cannot use network device MAC addresses to attack switches.

Configuration Method

Configure MAC address learning priorities for interfaces.

GE1/0/1 is a network-side interface, and GE1/0/2 is a user-side interface. Set the MAC address learning priority for GE1/0/1 to 3, which is higher than default priority 0 of GE1/0/2.
```
<HUAWEI> system-view
[HUAWEI] interface gigabitethernet 1/0/1
[HUAWEI-GigabitEthernet1/0/1] mac-learning priority 3
```
Forbid MAC address flapping between interfaces with the same priority. (By default, MAC address flapping is allowed on interfaces with the same priority.)

Forbid MAC address flapping between interfaces with priority 1.
```
[HUAWEI] undo mac-learning priority 1 allow-flapping
```