MAC Configuration on Asterfusion Enterprise SONiC Distribution Switch

1 Purpose

This article mainly explains the MAC configuration on Asterfusion enterprise SONiC switches.
By reading this article, users can quickly master the configuration method of MAC on Asterfusion SONiC switch.

2 Model and Version

Model:
CX-N series switches
CX-M series switches
Version:
AsterNOSv3.1

3 Basic MAC configuration instructions

MAC configuration is a basic function. MAC (Media Access Control) address, also called physical address or hardware address. The MAC address is written inside the network card by the network equipment manufacturer during production and can uniquely identify a user. The MAC address consists of a 48-bit long, 12-bit hexadecimal number. Starting from left to right, 0 to 23 bits are the codes applied by the manufacturer to IETF and other organizations to identify the manufacturer. 24 to 47 bits are assigned by the manufacturer.
Asterfusion Enterprise SONiC Distribution CX-N series switches MAC address table entries are divided into static MAC, dynamic MAC and blackhole MAC.

3.1 Default MAC configuration description

3.2 Configure static MAC

mac-address static HH:HH:HH:HH:HH:HH vlan vlan-id interface-type interface-name

# Configure a static MAC, and the interface type can be ethernet or link-aggregation

Example:

sonic(config)# mac-address static vlan 100 22:33:44:55:66:77 ethernet 0/1

3.3 Configure blackhole MAC

mac-address static HH:HH:HH:HH:HH:HH vlan vlan-id blackhole

# Configure blackhole MAC

Example:

sonic(config)# mac-address static A0:1B:5E:47:C9:08 vlan 100 blackhole

3.4 Configure the aging time of dynamic MAC

mac-address timer aging seconds

# Configure the aging time of dynamic MAC

Example:

sonic(config)# mac-address timer aging 600

3.5 Configure to disable MAC address learning based on the interface

interface interface-type interface-name
no mac-address learning

# Enter interface view.
# Disable MAC address learning.

Example:

sonic(config)# interface ethernet 0/5
sonic(config-if-0/5)# no mac-address learning

Note：When a device receives a large number of forged packets with different source MAC addresses, the capacity of the MAC address table may be exceeded, resulting in the inability to perform MAC learning. MAC configuration function of turning off the MAC address learning can effectively prevent this attack.

3.6 Configure to turn off MAC address learning based on vlan

vlan vlan-id
no mac-address learning

# Enter vlan view.
# Disable MAC address learning.

Example:

sonic(config)# vlan 100
sonic(config-vlan-100)# no mac-address learning

3.7 Configure MAC table parameters

interface interface-type interface-name

mac-limit number number

# Enter interface view, interface type can be ethernet or vlan.
# Configure the MAC table parameters of the interface, range:1~131072.

Example:

sonic(config)# interface vlan 100
sonic(config-vlan-100)#mac-limit number 100

3.8 Configure the MAC address of the Layer 3 interface

interface interface-type interface-name[.subinterface-number]
mac-address HH:HH:HH:HH:HH:HH

# Enter interface view, interface type can be ethernet、vlan or link-aggregation.
# Configure the MAC address of the interface.

Example:

sonic(config)# interface vlan 100
sonic(config-vlan-100)#mac-address 22:33:44:55:66:77

4 MAC configuration case

4.1 Requirements

There are two user hosts PC1 and PC2. The MAC address of PC1 is E2:8C:56:85:4A:11, which belongs to VLAN100. It is connected to the switch port Ethernet 0/1. It is required to add an entry for PC1 in the MAC table of the device. Static entry. The MAC address of PC2 is A0:1B:5E:47:C9:08, which belongs to VLAN 100 and is connected to the device port Ethernet 0/2. Due to illegal operations, a blackhole MAC entry is required to be added to the switch, making PC2 unable to access the Internet. Configure the device’s dynamic MAC table entry aging time to 600s. use MAC configuration to do this.

4.2 Topology

4.3 Configuration steps

Step 1

sonic# configure terminal
sonic(config)# vlan 100
sonic(config-vlan-100)# exit
sonic(config)# interface ethernet 0/1
sonic(config-if-0/1)# switchport access vlan 100
sonic(config-if-0/1)# exit
sonic(config)# interface ethernet 0/2
sonic(config-if-0/2)# switchport access vlan 100
sonic(config-if-0/2)# exit
sonic(config)# interface vlan 100
sonic(config-vlanif-100)# ip address 10.0.10.1/24
sonic(config-vlanif-100)# end
sonic# configure terminal
sonic(config)# mac-address static E2:8C:56:85:4A:11 vlan 100 ethernet 0/1
sonic(config)# mac-address static blackhole A0:1B:5E:47:C9:08 vlan 100 blackhole
sonic(config)# mac-address timer aging 600

Step 2

PC-1
[root@localhost ~]# ifconfig eth0 10.0.10.11/24
[root@localhost ~]# route add default gw 10.0.10.1

PC-2
[root@localhost ~]# ifconfig eth0 10.0.10.12/24
[root@localhost ~]# route add default gw 10.0.10.1

4.4 Verify network configuration

PC1 can ping the gateway, but PC2 cannot ping the gateway.

Asterfusion CX-N & CX-M SONiC switches as the links below

CX-N series switches
CX-M series switches

If you have more technical questions, feel free to propose a ticket on our  https://help.cloudswit.ch/portal/en/signin