3

JUNOS has functions for either limiting the number of mac addresses on a port or locking a port to particular mac addresses. I know that I can set filters as:

user@switch# set interface all allowed-mac 00:05:85:3A:82:80
user@switch# set interface all allowed-mac 00:05:85:3A:82:81
user@switch# set interface all allowed-mac 00:05:85:3A:82:83

But how can I list these via a show command?

6

You can use show ethernet switching table.

The following is taken from, Configuring MAC Limiting (Official Juniper Documentation).

Configure:

[edit ethernet-switching-options secure-access-port]
user@host# set interface all allowed-mac 00:05:85:3A:82:80
user@host# set interface all allowed-mac 00:05:85:3A:82:81
user@host# set interface all allowed-mac 00:05:85:3A:82:83

Verify:

user@host> show ethernet-switching table
Ethernet-switching table: 7 entries, 6 learned
VLAN MAC address Type Age Interfaces
employee-vlan * Flood - ge-0/0/2.0
employee-vlan 00:05:85:3A:82:77 Learn 0 ge-0/0/1.0
employee-vlan 00:05:85:3A:82:79 Learn 0 ge-0/0/1.0
employee-vlan 00:05:85:3A:82:80 Learn 0 ge-0/0/2.0
employee-vlan 00:05:85:3A:82:81 Learn 0 ge-0/0/2.0
employee-vlan 00:05:85:3A:82:83 Learn 0 ge-0/0/2.0
employee-vlan 00:05:85:3A:82:85 Learn 0 ge-0/0/2.0

Also too, since you're configuring the MAC's to be allowed on any of the interfaces in that VLAN, if you wanted to know which interface had a specific MAC entry - you'd use:

show ethernet switching table | match "$mac-address"

Obviously replacing $mac-address with the appropriate MAC.

If you want to view the configured MAC addresses vs. what is actually being learned (or not learned) by each interface, you would have to use (as @ParlorTricks mentioned):

show configuration | display set | match allowed-mac
  • Are you certain that allowed-mac installs the mac address into the ethernet-switching table? – Ryan Foley Jun 15 '15 at 13:55
  • It still has to be learned. – Jordan Head Jun 15 '15 at 13:57
-2

ctote, i haven't restricted MAC before but you could check in your configuration like the following:

show configuration | display set | match allowed-mac

That would show all configuration lines with their complete stanza location that has allowed-mac, which in this instance would list all allowed MAC you have configured.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.