Description

The mac-learning-log has limited space and can get overwritten pretty fast in a dynamic environment.

The article illustrates how to configure the MAC Notification feature under the SNMP hierarchy in EX/QFX switches such that a summary of all MAC addresses learned or unlearned during a specified interval is collected by a trap.

 

Solution

The minimum needed configuration is given below:

Under the Simple Network Management Protocol (SNMP) hierarchy 

set snmp trap-options source-address <switch's IP>
set snmp trap-group test targets <NMS/SNMPtarget IP address>

Under switch-options  (ELS Junos) 

set switch-options mac-notification notification-interval 10

Under ethernet-switching-options (Non-ELS legacy Junos) 

set ethernet-switching-options mac-notification notification-interval 10

Verification 

> show ethernet-switching mac-notification
Notification Status         : Enabled
Notification Interval       : 10  
Notifications Sent          : 5   
Notifications Table Maxsize : 256

These will be sent on the SNMP target as below:

tcpdump output 

10:24:40.284340 IP 10.85.157.172.51075 > localhost.localdomain.snmptrap: C="test" Trap(132) E:2636.3.48.1 10.85.157.172 enterpriseSpecific s=5 34071703 E:2636.3.48.1.2.1.8.1.2.5=01_00_03_00_10_00_00_00_aa_10_14_01_91_01_00_04_00_20_00_00_00_aa_10_00_01_92_01_00_03_00_10_00_00_00_bb_10_1e_01_91_01_00_04_00_20_00_00_00_bb_10_1f_01_92 E:2636.3.48.1.2.1.8.1.3.5=866277448

More information on the MIB sent in the trap can be found here .