mac-vlan enable

Function

The mac-vlan enable command enables MAC address-based VLAN assignment on an interface.

The undo mac-vlan enable command disables MAC address-based VLAN assignment on an interface.

By default, MAC address-based VLAN assignment is disabled on an interface.

Format

mac-vlan enable

undo mac-vlan enable

Parameters

None

Views

Ethernet interface view, GE interface view, XGE interface view, 40GE interface view, 100GE interface view, MultiGE interface view, port group view, Eth-Trunk interface view, 25GE interface view

Default Level

2: Configuration level

Usage Guidelines

Usage Scenario

If user devices move frequently on a network, you can use the mac-vlan mac-address command to associate MAC addresses with VLANs. When a user moves, you do not need to assign a VLAN to the user again. This improves security and access flexibility on the network. To enable an interface to forward packets based on associations between MAC addresses and VLANs, you must run the mac-vlan enable command to enable MAC address-based assignment on the interface.

If MAC address-based assignment is enabled on an interface:

When receiving an untagged packet, the interface searches for the VLAN entry matching the source MAC address of the packet. If a matching entry is found, the interface forwards the packet using the VLAN ID and priority in the entry. If no matching entry is found, the interface uses other matching rules to forward the packet.
When receiving a tagged packet, the interface forwards the packet based on the port-based VLAN configuration.

Precautions

On access and trunk interfaces, MAC address-based VLAN assignment can be used only when the MAC address-based VLAN is the same as the PVID. It is recommended that MAC address-based VLAN assignment be configured on hybrid interfaces.

The MUX VLAN function and MAC address-based VLAN assignment cannot be enabled on the same interface.

MAC address-based VLAN assignment and MAC address authentication cannot be enabled on the same interface.

When multiple VLAN assignment methods are configured on the switch, the switch assigns VLANs based on priorities of these methods.

MAC address-based VLAN assignment on an interface and NAC conflict on an interface; therefore, the mac-vlan enable and mac-authen, dot1x enable, web-auth-server or authentication-profile commands cannot be used on the same interface.

Example

# Enable MAC address-based VLAN assignment on GE0/0/1.

<HUAWEI> system-view
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] port link-type hybrid
[HUAWEI-GigabitEthernet0/0/1] mac-vlan enable