H3C core switch obtains a single MAC address

An H3C core switch learns a MAC address dynamically from incoming frames and associates it with a specific port and VLAN, or it can be statically bound to a port using configuration commands.

Dynamic MAC Address Learning

H3C switches maintain a MAC address table that maps each MAC address to an outgoing interface and VLAN ID. When a frame arrives, the switch checks the source MAC address:

1. If the MAC address is already in the table, the switch updates the entry with the current port.
2. If the MAC address is not in the table, the switch adds a new entry associating the MAC with the incoming port and VLAN. Frames destined for a known MAC address are forwarded out of the corresponding port. If the MAC is unknown, the switch floods the frame within the VLAN. This learning process continues for each incoming frame until the table is populated. Dynamic learning does not distinguish between legitimate and illegitimate frames, so MAC spoofing can overwrite entries and redirect traffic ( ).

Static MAC Address Binding

To ensure a single MAC address is associated with a specific port, H3C switches support static MAC binding:

• Port binding: You can bind a MAC address to a specific port so that only that device can access the network through that port. Example commands:

  mac-address static 00e0-fc22-f8d3 interface Ethernet 0/1 vlan 1mac-address max-mac-count 0 This prevents other devices from learning or using the port ( ).

• IP and MAC binding: You can bind both the IP and MAC address to a port for stricter control:

  am user-bind ip-address 10.1.1.2 mac-address 00e0-fc22-f8d3 interface Ethernet 0/1 This ensures that only the specified device with the correct IP and MAC can access the network through that port ( ).

Viewing Learned MAC Addresses

To check which MAC addresses the switch has learned, use the CLI command:

display mac-address | include

This shows the interface and VLAN associated with the MAC address. LLDP can also help locate the connected access switch and port if the MAC is learned on a core switch ( ).

Security Considerations

Dynamic MAC learning can be vulnerable to MAC spoofing, where an attacker sends frames with a legitimate MAC address to a different port, potentially intercepting traffic. Using static MAC binding and limiting the number of MAC addresses per port mitigates this risk ( ). By combining dynamic learning for normal operation and static binding for security, an H3C core switch can reliably manage a single MAC address per port while maintaining network integrity.