4.3 Port Security, MAC Limiting & Persistent MAC Learning

Ethernet switches forward frames efficiently by maintaining a Layer 2 forwarding database known as the Media Access Control (MAC) address table or Content Addressable Memory (CAM) table. As frames arrive at switch interfaces, the switch inspects the ingress frame's source MAC address and binds that address to the receiving physical port and VLAN ID. Subsequent unicast traffic destined for that MAC address is forwarded solely out of the associated port rather than flooded across the entire broadcast domain.

However, because standard Ethernet bridges learn source MAC addresses dynamically and without verification, CAM tables represent a prime target for malicious exploitation and network anomalies.

---

The CAM Table Exhaustion Attack (MAC Flooding)

Switch CAM tables have finite hardware capacity—typically ranging from 16,000 to 64,000 entries on enterprise campus access switches (such as the Juniper EX2300, EX3400, and EX4300). In a MAC flooding attack (commonly executed using penetration tools like macof), an attacker connected to an access port generates tens of thousands of bogus Ethernet frames per second, each stamped with a randomized, spoofed source MAC address.

Within milliseconds, the flood of randomized addresses fills the switch CAM table to maximum capacity. When the CAM table exhausts its available space:

1. Learning Halts: The switch can no longer learn legitimate MAC addresses from authorized endpoints.
2. Fail-Open Behavior: When legitimate unicast frames arrive destined for hosts whose entries have been aged out or displaced, the switch cannot find a matching forwarding entry in the CAM table.
3. Ubiquitous Unicast Flooding: By the fundamental rules of Ethernet bridging, unknown unicast frames must be flooded out of every active interface in the broadcast domain.
4. Traffic Interception: The switch effectively degrades into a legacy, unswitched hub. The attacker's network interface card (operating in promiscuous mode) captures sensitive user traffic traversing the VLAN, including unencrypted passwords, HTTP sessions, and VoIP streams.

Beyond malicious attacks, unmanaged switches or hubs connected to access ports can introduce dozens of unauthorized devices into a port intended for a single workstation, multiplying broadcast traffic and complicating IP inventory management.

---

MAC Limiting Architecture in Junos OS

MAC Limiting enforces access security by establishing a strict numerical ceiling on the number of MAC addresses that can be dynamically learned on a specific physical interface or VLAN. Once the learned count reaches the configured threshold, Junos enforces a deterministic security policy on all subsequent frames originating from unlearned source MACs.

Junos CLI Syntax: ELS vs. Non-ELS Platforms

Juniper switches running Enhanced Layer 2 Software (ELS)—including the EX2300, EX3400, EX4300, EX4400, EX4600, and QFX series—configure MAC limiting under the [edit switch-options] hierarchy. Legacy non-ELS platforms (such as the EX2200, EX3300, and EX4200) configure MAC limiting under [edit ethernet-switching-options secure-access-port]:

Modern ELS Configuration (Recommended for JNCIS-ENT):

[edit switch-options interface ge-0/0/10.0]
user@EX4300# set interface-mac-limit 2
user@EX4300# set interface-mac-limit 2 packet-action drop-and-log

Legacy Non-ELS Configuration:

[edit ethernet-switching-options secure-access-port interface ge-0/0/10.0]
user@EX4200# set mac-limit 2 action drop-and-log

Evaluation of Common Violation Actions

When a frame arrives with a new, unlearned source MAC address on an interface that has already reached its MAC limit, Junos can execute a supported action, including these four examples:

1. drop: The switch silently discards ingress frames from any new, unlearned source MAC address. Previously learned authorized MAC addresses continue to transmit and receive frames without disruption. No syslog message or SNMP trap is generated.
2. log: The switch forwards traffic from the unlearned source without using drop enforcement; learning behavior and action support depend on the platform but generates an immediate syslog message and SNMP trap notifying administrators of the threshold breach. This action is ideal during initial deployment baselining.
3. shutdown: The switch takes drastic defensive action: it immediately disables the entire physical interface and places it in an err-disabled state. Physical link drops, and all devices connected to the port (authorized and unauthorized alike) lose connectivity. The port remains disabled until cleared manually or re-enabled by an automatic recovery timer.
4. drop-and-log: The industry standard enterprise best practice: Junos silently drops frames from unauthorized new MAC addresses while preserving uninterrupted connectivity for legitimate, already-learned MACs. Simultaneously, Junos generates a detailed syslog message and SNMP notification recording the violation, the offending MAC address, and the ingress interface.

Output note: Command output shown here is a schematic teaching example, not a captured device session. Field names and feature support depend on platform and Junos release.

MAC Move Limiting

Under normal campus network operations, an end-host MAC address remains anchored to a single access port. If the exact same source MAC address is observed rapidly moving between two or more switch ports, it typically indicates one of three critical conditions:

1. Layer 2 Forwarding Loop: An unmanaged switch or miswired patch cable has created an active switching loop, causing identical frames to circulate and enter multiple switch ports alternately.
2. MAC Spoofing Attack: An attacker is transmitting forged packets claiming the identity of an authorized client or the default gateway to hijack active sessions.
3. Host Roaming / Flapping: A misconfigured virtual machine hypervisor or wireless access point is improperly bridging virtual interfaces across physical uplinks.

Left unchecked, rapid MAC migration causes severe CAM table thrashing, where the switch control plane expends excessive CPU cycles repeatedly updating forwarding table pointers thousands of times per second.

Configuration and Operation

MAC move limiting tracks how frequently a specific MAC address relocates between interfaces. Junos monitors MAC transitions across a one-second sliding window:

[edit switch-options]
user@EX4300# set mac-move-limit interface ge-0/0/10.0 limit 2 packet-action drop-and-log

In this configuration, if a MAC address moves between interfaces more than 2 times within a 1-second period, Junos triggers the configured action (drop, log, shutdown, or drop-and-log) on the interface receiving the migrating MAC.

---

Persistent MAC Learning (Sticky MAC)

In standard Ethernet switching, dynamically learned MAC addresses are stored exclusively in volatile system RAM and are governed by the MAC aging timer (default 300 seconds in Junos). If an authorized workstation goes into low-power sleep mode, disconnects during a lunch break, or is powered down over the weekend, its MAC entry ages out and is purged from the CAM table.

This aging behavior introduces a security window: an unauthorized visitor or rogue device could connect to the vacated wall jack and register its MAC address as the authorized device for that port.

Furthermore, if the switch undergoes a scheduled reload or power outage, all dynamically learned MAC addresses are erased, requiring the switch to relearn all addresses from scratch upon boot.

Persistent MAC Learning (commonly referred to as Sticky MAC) resolves both vulnerabilities:

1. Dynamic Learning to Persistent Storage: The switch dynamically learns MAC addresses up to the configured MAC limit and immediately commits them to persistent, non-volatile database storage on the switch flash memory.
2. Aging Suppression: Persistent MAC entries never age out. They remain permanently bound to the interface regardless of how long the host remains idle or powered down.
3. Reboot Survival: Because entries are saved in persistent storage, all learned MAC bindings are immediately restored following a switch reboot or power failure without waiting for endpoints to transmit traffic.

Configuration in Junos OS

Persistent MAC learning is configured on a per-interface basis under [edit switch-options]:

[edit switch-options interface ge-0/0/10.0]
user@EX4300# set persistent-learning

Persistent learning complements a MAC limit but is not cryptographic endpoint authentication. A host that spoofs an allowed MAC can still evade a MAC-only identity check. Clear or update saved entries through the supported persistent-learning operational commands when an authorized endpoint is replaced; otherwise stale bindings can block the replacement device.

Verification and Operational Commands

Junos provides comprehensive operational commands to monitor MAC learning, inspect port security violations, and manage recovery timers.

1. Inspecting the Forwarding Table: show ethernet-switching table

To view learned MAC addresses and distinguish dynamic, static, and persistent entries:

user@EX4300> show ethernet-switching table interface ge-0/0/10.0

Ethernet-switching table: 2 entries, 2 learned
  VLAN              MAC address       Type         Age Interfaces
  VLAN_DATA         00:05:85:11:22:33 Persistent     - ge-0/0/10.0
  VLAN_DATA         00:05:85:44:55:66 Persistent     - ge-0/0/10.0

Notice that the Type column explicitly identifies the addresses as Persistent and the Age is listed as - (indicating aging is disabled).

2. Inspecting Configuration and Violations

Compare the configured limit with the learned entries, then inspect interface state and logs:

show configuration switch-options | display set
show ethernet-switching table interface ge-0/0/10.0
show interfaces ge-0/0/10 extensive
show log messages | match "MAC|mac|limit"

Counters, saved-entry displays, supported actions and recovery commands vary across EX/QFX releases. Use the CLI help for the actual switch. Resolve the offending source or cabling fault before clearing a shutdown; an automatic recovery timer can repeatedly reintroduce the same problem.

Official references checked 2026-10-18: MAC limit actions, Persistent learning.