This article explains how to configure mac limiting on non-ELS devices.

The different ways of setting a MAC limit on non-ELS devices are:

1. Limiting the Number of MAC Addresses That Can be Learned on Interfaces
2. Specifying MAC Addresses That Are Allowed
3. Configuring MAC Limiting for VLANs

Limiting the Number of MAC Addresses That Can be Learned on Interfaces

To configure MAC limiting for port security by setting a maximum number of MAC addresses that can be learned on interfaces.

• Apply the MAC limit on a single interface:

[edit ethernet-switching-options secure-access-port]
user@switch# set interface <interface-name> mac-limit <limit> 

When no action is specified for configuring the MAC limit on an interface, the device performs the default action drop if the limit is exceeded.

• Apply the MAC limit on a single access interface, on the basis of its membership within a specific VLAN (here, the interface is ge-0/0/1 and the VLAN is v1.

[edit ethernet-switching-options secure-access-port]
user@switch# set interface <interface-name> vlan <vlan-name> mac-limit <limit>

With this type of configuration, the device drops any additional packets if the limit is exceeded, and also logs a message.

• Apply the limit to all access interfaces:

[edit ethernet-switching-options secure-access-port]
user@switch# set interface all mac-limit <limit>

When no action is specified for configuring the MAC limit on all interfaces, the device performs the default action drop if the limit is exceeded:

Specifying MAC Addresses That Are Allowed

You must clear existing entries in the MAC address forwarding table prior to changing the MAC address limit. To configure MAC limiting for port security by specifying allowed MAC addresses:

• On a single interface:

[edit ethernet-switching-options secure-access-port]
user@switch# set interface <interface-name> allowed-mac xx:xx:xx:xx:xx:xx
user@switch# set interface <interface-name> allowed-mac yy:yy:yy:yy:yy:yy
user@switch# set interface <interface-name> allowed-mac zz:zz:zz:zz:zz:zz

• On all interfaces:

[edit ethernet-switching-options secure-access-port]
user@switch#set interface all allowed-mac xx:xx:xx:xx:xx:xx
user@switch#set interface all allowed-mac yy:yy:yy:yy:yy:yy
user@switch#set interface all allowed-mac zz:zz:zz:zz:zz:zz

Configuring MAC Limiting for VLANs

You must clear existing entries in the MAC address forwarding table before you can change the MAC address limit. MAC limiting for a VLAN restricts the MAC addresses that can be learned for that VLAN, but does not drop the packet. Therefore, setting the MAC limit on a VLAN is not considered a port-security feature. The configuration of specific allowed MAC addresses does not apply to VLANs.

Limit the number of dynamic MAC addresses on a VLAN: If the MAC limit on a specific VLAN is exceeded, the device logs the MAC addresses of packets that cause the limit to be exceeded. No other action is possible.

[edit vlans]
user@switch# set <vlan-name> mac-limit <limit>

Note: When you are applying a MAC limit on a VLAN, do not set mac-limit to 1 for a VLAN composed of Routed VLAN Interfaces (RVIs) or a VLAN composed of aggregated Ethernet bundles using LACP. In these cases, setting the mac-limit to 1 prevents the device from learning MAC addresses other than the automatic addresses:

• For RVIs, the first MAC address inserted into the forwarding database is the MAC address of the RVI.
• For aggregated Ethernet bundles using LACP, the first MAC address inserted into the forwarding database in the forwarding table is the source address of the protocol packet.

If the VLAN is composed of regular access or trunk interfaces, you can set the mac-limit to 1 if you choose to do so.

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/topic-map/configuring-mac-limiting.html

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/topic-map/configuring-mac-limiting.html#d96e126