2

I am facing a situation where on the core network I have around 15k MAC addresses, and on the edge switches (Access Layer), I am finding switches with 27k MAC addresses. Access switches are configured to allow one MAC address per interface, and if there is VoIP, two MAC addresses per interface.

Since this is a layer 2 network, I don't understand why I have more MAC addresses on the Access switches. I was able to find out that some MAC addresses are on two VLANs at the same time, mainly MAC addresses that belong to VoIP phones, but so far I'm unable to find why this is happening.

Has anyone experienced a similar situation? If so, what was the reason or causes of such situation?

Improve this question
2
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 11, 2017 at 5:09
  • Some (at least) switches separate the MAC address table per VLAN. I'm not sure whether it is standard.
    – user20574
    Commented Jul 22, 2020 at 10:29

2 Answers 2

Reset to default
2

VoIP phones are actually switches, too, if they allow you to connect a PC. Limiting a switch interface to two MAC addresses when using a VoIP phone can be problematic because some VoIP phones use more than one MAC address for themselves (one for the phone itself, and one or two for the switch interfaces), then you have a MAC address for the PC connected to the phone, so it could use three or more MAC addresses on the switch interface.

As a switch, the phone negotiates a trunk to the switch to which it is connected, and a VoIP phone MAC address could appear on more than one VLAN.

Improve this answer
5
  • how do you tackle a problem like this?
    – Gngogh
    Commented Mar 21, 2017 at 16:27
  • Why do you think it is a problem? A MAC address is only significant or seen on the LAN where the host with that MAC address is connected. MAC addresses for devices connected to trunks can be seen on every VLAN for that trunk, and it does not create problems.
    – Ron Maupin ♦
    Commented Mar 21, 2017 at 16:29
  • its a prob because on some switches the size of the mac address table is on the limit and the switch starts to behave weird, untill I reboot it.
    – Gngogh
    Commented Mar 21, 2017 at 17:20
  • If your VLAN (broadcast domain) is so large that a switch is running out of space for the VLAN MAC address table, it is time to reduce the number of switch interfaces in the VLAN. The current best practice is to limit a VLAN to a single access switch. You can have multiple VLANs on the switch, but those VLANs should not be on any other access switch. Also, access switches should only connect to the distribution switches, not other access switches. This prevents STP problems, and it should limit the size of VLAN MAC address tables. Another option is to run layer-3 to the access switches.
    – Ron Maupin ♦
    Commented Mar 21, 2017 at 17:47
  • 1
    ...or invest in switches with larger CAM tables!
    – rnxrx
    Commented Mar 22, 2017 at 5:27
0

First of all, you shouldn't have so big broadcast domains to have even 15k MAC addresses on access switches. Either separate them by VLANs (with connectivity at L3, with routing), or at least with any kind of traffic segmentation (if the endpoints don't have to communicate with each other).

The problem itself looks like VLAN misconfiguration (or device malfunction) - I guess you don't attach VoIP phones to 802.1q tagged interfaces, but plug them into untagged ports. There are switches that allow to set multiple untagged VLANs on a single port, with the traffic being passed into PVID of that port ...but learning MACs and passing incoming broadcast frames. There are switches that won't allow to disable default VLAN (VID=1) despite using other PVID on the port.

The second cause happening in the wild is a single device malfunction or misconfiguration, effectively "bouncing" (usually broadcast) frames into another VLAN that is available to that device. This happens even without asymetric VLAN configurations and is not a big surprise when it happens on low-cost SOHO devices. Smaller broadcast domains make it easier to pinpoint such misbehaving device, by looking if the specific MAC address doesn't ocasionally pop up on a wrong port of a switch.

The only question you need to ask yourself is - what is the path of the VoIP phone to a different VLAN? How is it leaking? Very easy to check on a one-switch one-phone testbed.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.