mac-learning priority allow-flapping
Function
The mac-learning priority allow-flapping command allows MAC address flapping between interfaces with the same priority.
The undo mac-learning priority allow-flapping command prevents MAC address flapping between interfaces with the same priority.
By default, MAC address flapping between interfaces with the same priority is allowed.
Only the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6730-H, S6730S-H, S6730-S, and S6730S-S support this configuration.
Format
mac-learning priority priority-id allow-flapping
undo mac-learning priority priority-id allow-flapping
Parameters
Parameter |
Description |
Value |
|---|---|---|
priority priority-id |
Specifies the MAC address learning priority of an interface. |
The value is an integer that ranges from 0 to 3. A larger value indicates a higher priority. |
Usage Guidelines
Usage Scenario
An uplink interface of the switch is connected to a server, and downlink interfaces are connected to users. To prevent unauthorized users from using the server MAC address to connect to the switch, you can run the undo mac-learning priority allow-flapping command to forbid MAC address flapping between interfaces with the same priority. MAC address then will not be learned by multiple interfaces. This prevents attackers from using the MAC addresses of valid devices to attack the switch.
Both the mac-learning priority command and the undo mac-learning priority allow-flapping command can prevent MAC address flapping. The difference between the two commands is as follows:
- The undo mac-learning priority allow-flapping command prevents MAC address flapping between interfaces with the same priority. If an attacker uses the server MAC address to connect to the switch after the server is powered off, the switch learns the MAC address of the forged server. After the real server is powered on, the switch cannot learn the correct server MAC address.
- The mac-learning priority command prevents MAC address flapping between interfaces with different priorities. If an attacker uses the server MAC address to connect to the switch after the server is powered off, the switch learns the MAC address of the forged server. After the real server is powered on, the switch can learn the correct server MAC address.
Precautions
The function is not supported for the MAC address entries in a VSI.