1.3 Layer 2 Bridging Mechanics & Packet Forwarding

Layer 2 Bridging Mechanics & Packet Forwarding

Ethernet switching at Layer 2 establishes local connectivity across enterprise campus LANs. Within Junos OS, bridging operates directly in hardware inside the Packet Forwarding Engine (PFE). Understanding how frames are parsed, how the Ethernet switching table learns and ages MAC entries, and how the Junos CLI configures and monitors bridge domains is fundamental to the JNCIS-ENT curriculum.

1. The 5 Core Operations of Junos Layer 2 Bridging

When Ethernet frames traverse an EX Series switch or enterprise MX bridge domain, the PFE executes five distinct operations:

+---------------------------------------------------------------------------------------------------+
| THE FIVE CORE BRIDGING OPERATIONS                                                                 |
+-------------+-------------------------------------------------------------------------------------+
| Operation   | Functional Description                                                              |
+-------------+-------------------------------------------------------------------------------------+
| 1. Learning | PFE inspects Source MAC & Ingress VLAN. Updates Ethernet switching table in ASIC.   |
| 2. Forward  | PFE matches Destination MAC in switching table; transmits out unique egress port.   |
| 3. Flooding | Unknown unicast, broadcast, or multicast frames are replicated to all ports in VLAN.|
| 4. Filtering| Packets violating MAC limits, storm control, or firewall filters are dropped.      |
| 5. Aging    | Inactive dynamic MAC entries expire after 300 seconds (default) to clear stale paths.|
+-------------+-------------------------------------------------------------------------------------+

1. Learning

When an Ethernet frame arrives on a switchport, the PFE reads the frame header and extracts the Source MAC address and the Ingress VLAN ID. The PFE checks its hardware Ethernet switching table:

• If the MAC address does not exist for that VLAN, the PFE creates a new dynamic entry binding the MAC address to the ingress physical port, logical unit, and VLAN ID, initializing an aging timer.
• If the MAC address already exists on that port, the PFE resets the aging timer.
• If the MAC address exists on a different port within the same VLAN, the PFE detects a station move, updates the entry to the new ingress port, resets the timer, and triggers internal logging if MAC move limits are configured.

2. Forwarding (Known Unicast)

The PFE extracts the frame's Destination MAC address. If the destination MAC is a known unicast address present in the Ethernet switching table for that VLAN, the PFE looks up the associated egress interface. The frame is placed into the egress port queue and transmitted exclusively out that single physical interface.

3. Flooding (Unknown Unicast, Broadcast & Multicast)

If the destination MAC address cannot be resolved to a specific egress port:

• Unknown Unicast: If the destination MAC is not present in the Ethernet switching table, the PFE replicates the frame and floods it out all active interfaces participating in that VLAN, except the ingress port on which the frame arrived.
• Broadcast (FF:FF:FF:FF:FF:FF): The frame is flooded out all member ports of that VLAN (excluding the ingress port). If an irb interface is active on that VLAN, a copy is punted across the internal link to the Routing Engine for local protocol processing (e.g., ARP resolution).
• Multicast (01:00:5E:xx:xx:xx for IPv4 / 33:33:xx:xx:xx for IPv6): If IGMP snooping is disabled, multicast frames are flooded across the VLAN identical to broadcast frames. If IGMP snooping is enabled, the PFE constrains multicast delivery strictly to ports that have registered active IGMP membership reports or connected multicast routers (mrouter ports).

4. Filtering

Before transmitting or forwarding a frame, the PFE evaluates multiple Layer 2 policy and protection controls:

• Spanning Tree Protocol State: If the egress port is in an STP Discarding or Blocking state, user data frames are dropped.
• Port Security & MAC Limiting: If a port exceeds its configured maximum MAC address limit, newly arriving frames with unknown source MACs are dropped, and the interface may be placed into an error-disabled state.
• Storm Control: If incoming broadcast, unknown unicast, or multicast traffic exceeds the configured bandwidth threshold (e.g., 80% or 10,000 pps), excess frames are dropped.
• Layer 2 Firewall Filters: Custom packet filter terms applied under family ethernet-switching filter can match on MAC addresses, EtherTypes, or IP headers and apply supported actions such as accept, count, or discard; Layer 2 action support differs from family inet.

5. Aging

Dynamic entries in the Ethernet switching table cannot remain indefinitely; otherwise, disconnected workstations or decommissioned servers would consume finite ASIC table capacity and cause blackholing. Junos applies a hardware countdown timer to every learned dynamic entry.

• Default Aging Interval: 300 seconds (5 minutes) on EX Series switches.
• Every time a frame arrives with a matching source MAC, the timer resets to 300 seconds.
• If no frames arrive from that source MAC before the timer reaches 0, the PFE purges the entry.

2. Ethernet Switching Table Architecture & Tuning

The Ethernet switching table is maintained in high-speed hardware memory (TCAM or specialized hash tables) within the PFE, with a synchronized shadow table maintained in the Routing Engine's kernel memory.

Modifying the MAC Aging Timer

Network administrators can adjust ELS global aging under protocols l2-learning. The documented global range is 10 through 1,000,000 seconds; zero is not an ELS global no-aging setting.

[edit]
set protocols l2-learning global-mac-table-aging-time 600

Per-VLAN controls vary by platform. Check the supported hierarchy instead of copying a non-ELS mac-table-aging-time command into an ELS VLAN. Persistent learning or supported no-aging controls solve a different requirement from increasing the inactivity timer.

3. Enhanced Layer 2 Software (ELS) vs Legacy Non-ELS

A central theme on the JNCIS-ENT exam is distinguishing between modern Enhanced Layer 2 Software (ELS) and legacy non-ELS configuration syntax. ELS was introduced to standardize Layer 2 CLI terminology with Junos routing and carrier platforms.

• ELS Platforms: EX2300, EX3400, EX4300, EX4400, EX4600, EX4650, QFX Series, and MX Series switches.
• Legacy Non-ELS Platforms: EX2200, EX3200, EX3300, EX4200, and EX8200 switches.

4. Verification and Diagnostic CLI Commands

Operating and troubleshooting Junos Layer 2 networks requires familiarity with operational commands that interrogate the PFE forwarding table.

show ethernet-switching table

Displays the active MAC addresses learned or statically configured on the device:

user@EX4300> show ethernet-switching table
MAC flags (count):
       S - static MAC, D - dynamic MAC, L - locally learned, P - persistent MAC,
       DR - remote dynamic MAC, DC - do not clear, R - remote PE MAC, O - ovsdb MAC
Routing Instance : default
Vlan                MAC                 MAC      Logical                Active
name                address             flags    interface              source
DATA                00:50:56:a1:b2:c3   D        ge-0/0/10.0
VOIP                00:04:f2:11:22:33   D        ge-0/0/11.0
MGMT                00:1c:73:99:88:77   S        ge-0/0/47.0

show ethernet-switching table detail

Provides granular diagnostic information for individual entries, including hit counts, precise remaining aging time, and learning domain:

user@EX4300> show ethernet-switching table detail
Routing Instance : default
Vlan name : DATA, VLAN ID : 10
  MAC address : 00:50:56:a1:b2:c3
    Status : Active
    Logical interface : ge-0/0/10.0
    MAC type : Dynamic
    Age : 42 seconds
    Remaining aging time : 258 seconds
    Hit count : 1420

show ethernet-switching table count

Displays total counts of learned MAC entries per VLAN and per routing instance. This command is an engineer's first line of defense when investigating MAC table exhaustion attacks or bridge loop broadcast storms.

Clearing MAC Table Entries

To manually purge stale entries or force re-learning during topology migrations, use the clear operational command:

• clear ethernet-switching table: Flushes all dynamic MAC addresses across all VLANs and interfaces.
• clear ethernet-switching table vlan DATA: Flushes dynamic MAC addresses strictly within the specified VLAN.
• clear ethernet-switching table interface ge-0/0/10.0: Purges entries learned on a specific logical interface.

Output note: Command output shown here is a schematic teaching example, not a captured device session. Field names and feature support depend on platform and Junos release.

Official references checked 2026-10-18: ELS aging controls.