7.7.1 Establishing the Configuration Task
Before limiting the number of learned MAC addresses, familiarize yourself with the applicable
environment, complete the pre-configuration tasks, and obtain the data required for the
configuration. This will help you complete the configuration task quickly and accurately.
Applicable Environment
As shown in Figure 7-3, an insecure residential network or enterprise often receives packets
with bogus MAC addresses. The capacity of a MAC address table is limited; therefore, if hackers
forge a large number of packets with different source MAC addresses and send the packets to
the Switch, the MAC address table of the Switch becomes full quickly. When the MAC address
table is full, the Switch cannot learn source MAC addresses of valid packets. A limit can be set
for the number of learned MAC addresses. When the number of learned MAC addresses reaches
the limit, the Switch stops learning MAC addresses. When the Switch receives packets with
unknown source MAC addresses, it can be configured to discard the packets or generate an
alarm. This protects the network from MAC address attacks.
Figure 7-3 Limiting the number of MAC addresses on an insecure network
VLAN2
Switch
LSW1
LSW2
Internet
VLAN2 VLAN2
MAC- Limit
Pre-configuration Tasks
Before limiting the number of learned MAC addresses, complete the following task:
l Deleting the existing MAC address entries from the interface, VLAN, slot, or VSI where
you want to limit the number of learned MAC addresses
Data Preparation
To limit the number of learned MAC addresses, you need the following data.
Quidway S7700 Smart Routing Switch
Configuration Guide - Ethernet 7 MAC Address Table Configuration
Issue 01 (2011-07-15) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
353
To Next Page
Loading...
