This article explains how we can configure mac limiting on ELS devices.

To secure a port, you can set the maximum number of MAC addresses that can be learned by an interface. Set the MAC limit on an interface, and specify an action that the device takes after the specified limit is exceeded.

If you want to set the MAC limit on an interface that is part of the default routing instance:

[edit switch-options] 
user@switch# set interface <interface-name> interface-mac-limit <limit> packet-action <action>  

If you want to set the MAC limit on an interface that is part of a routing instance:

[edit routing-instances] 
user@switch# set <routing-instance-name> switch-options interface interface-name interface-mac-limit <limit> 


You can choose to have one of the following actions performed when the MAC limit or the MAC move limit is exceeded:

• drop - Drop the packet, but do not generate an alarm.

• drop-and-log —Drop the packet and generate an alarm, an SNMP trap, or system log entry.

• log —Do not drop the packet but generate an alarm, an SNMP trap, or a system log entry.

• none —Forward packets with new source MAC addresses, and learn the new source MAC address.

• shutdown —Disable the interface in the VLAN and generate an alarm, an SNMP trap, or a system log entry.

• vlan-member-shutdown —(EX9200 only) Starting in Junos OS Release 15.1 for MAC Limiting and MAC Move Limiting on EX9200 Switches, this statement is supported to block an interface on the basis of its membership in a specific VLAN and generate an alarm, an SNMP trap, or a system log entry.

If you want to set the MAC limit on all interfaces that are part of the default routing instance:

[edit switch-options] 
user@switch# set interface-mac-limit <limit> 

If you want to set the MAC limit on all interfaces that are part of a routing instance:

[edit routing-instances] 
user@switch# set <routing-instance-name> switch-options interface-mac-limit <limit> 

After you set a new MAC limit for the interface, the system clears existing entries in the MAC address forwarding table associated with the interface.

To limit the number of MAC addresses learned by an interface in a VLAN, perform the following steps:

• Set the maximum number of MAC addresses that can be learned by an interface in a VLAN, and specify an action that the device takes after the specified limit is exceeded:

[edit vlans] 
user@switch# set <vlan-name> switch-options interface-mac-limit <limit> packet-action <action> 

• Set the maximum number of MAC addresses that can be learned by one or all interfaces in the VLAN, and specify an action that the device takes after the specified limit is exceeded: (NOTE: If you specify a MAC limit and packet action for all interfaces in the VLAN and a specific interface in the VLAN, the MAC limit and packet action specified at the specific interface level takes precedence. Also, at the VLAN interface level, only the drop and drop-and-log options are supported.)

[edit vlans] 
user@switch# set <vlan-name> switch-options interface <interface-name> interface-mac-limit <limit> packet-action <action> 

[edit vlans] 
user@switch# set <vlan-name> switch-options interface-mac-limit <limit> packet-action <action>  

After you set new MAC limits for a VLAN by using the mac-table-size statement or for interfaces associated with a VLAN by using the interface-mac-limit statement, the system clears the corresponding existing entries in the MAC address forwarding table.

Note: On a QFX Series Virtual Chassis, if you include the shutdown option at the [edit vlans vlan-name switch-options interface interface-name interface-mac-limit packet-action] hierarchy level and issue the commit operation, the system generates a commit error. The system does not generate an error if you include the shutdown option at the [edit switch-options interface interface-name interface-mac-limit packet-action] hierarchy level.

For information on configuring an interface to automatically recover from a shutdown caused by MAC limiting, see Configuring Autorecovery for Port Security Events. If you do not configure the device for autorecovery from the disabled condition, you can bring up the disabled interfaces by running the clear ethernet-switching recovery-timeout command.

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/topic-map/configuring-mac-limiting.html

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/concept/port-security-mac-limiting-and-mac-move-limiting.html