MAC address limits issue, indicated by log messages 'L2ALD_MAC_LIMIT_REACHED_IFBD.'
 

l2ald[PID]: L2ALD_MAC_LIMIT_REACHED_IFBD: Limit on learned MAC addresses reached for ifbd:0x3f11610 flags [0x  6b] state [0x       0]bd:(0x45f5410:VID-1010+1010)\ifl:(0x45a3a10:ae1.0); current count is 1024

l2ald[PID]: L2ALD_MAC_LIMIT_REACHED_IFBD: Limit on learned MAC addresses reached for ifbd:0x3f11610 flags [0x  6b] state [0x       0]bd:(0x45f5410:VID-1010+1010)\ifl:(0x45a3a10:ae1.0); current count is 1024

l2ald[PID]: L2ALD_MAC_LIMIT_RESET_IF: Resumed adding MAC addresses learned by ifbd:0x3f1f410 flags [0x  6b] state [0x       0]bd:(0x45f5410:VID-1010+1010)\ifl:(0x45a4410:ae2.0); current count is 1021

l2ald[PID]: L2ALD_MAC_LIMIT_REACHED_IFBD: Limit on learned MAC addresses reached for ifbd:0x3f1f410 flags [0x  6b] state [0x       0]bd:(0x45f5410:VID-1010+1010)\ifl:(0x45a4410:ae2.0); current count is 1024

Log message is observed on the switch/router where the interface is not learning anymore MAC addresses as it states it has reached its limit:

Sep 26 01:57:37 SWITCH-NAME l2ald[PIID]: L2ALD_MAC_LIMIT_REACHED_IFBD: Limit on learned MAC addresses reached for ifbd:0x4875210 flags [0x 6b] state [0x    0]bd:(0x4308810:v977+977)\ifl:(0x32f0010:ae50.0); current count is 1024

Users will experience outages and disconnections from Wifi controllers although they may see IP address they might not be able to reach the gateway.

Interface MAC limit can be modified based on need. On most platforms the default MAC limit is 1024, therefore if the switch/router receives more than the default amount, the 1025th MAC won't be learned and a similar log like the one above will be generated.

The log will indicate the vlan and the interface where the limitation was reached. Let's review the log:
Sep 26 01:57:37 SWITCH l2ald[20418]: L2ALD_MAC_LIMIT_REACHED_IFBD: Limit on learned MAC addresses reached for ifbd:0x4875210 flags [0x 6b] state [0x    0]bd:(0x4308810:v977+977)\ifl:(0x32f0010:ae50.0); current count is 1024

0x4308810:v977+977 ===> this indicates the impacted vlan is 977

0x32f0010:ae50.0 ===> this indicates the impacted interface is ae50.0

MAC address limit can be modified using the following configuration (this is an example, you can adjust it based on needs):

show configuration switch-options
interface-mac-limit {
  128000;
  packet-action drop;
}

interface ae1.0 {
  interface-mac-limit {
    128000;
    packet-action drop;
  }
}

The above configuration will modify the default allowed number of MACs that can be learned on that interface at the physical level ,default instance only. To modify the limit per vlan you must change it at the vlan level, otherwise the limit won't increase.

Looking at the show commands, the IFL shows 128,000, but each tag on the vlan only has max of 1024 and they’re still running into the 1024 limit.

show ethernet-switching interface ae50.0  
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
             LH - MAC limit hit, DN - interface down,
             MMAS - Mac-move action shutdown,
             SCTL - shutdown by Storm-control )


Logical      Vlan      TAG    MAC      STP      Logical       Tagging
interface     members         limit     state     interface flags
ae1.0                  128000           AD         tagged  
          DATA      333    1024     Forwarding            tagged  
          WIFI      977    1024     Forwarding            tagged

There is no default MAC address limit for the mac-table-size statement at the [edit switch-options] hierarchy level. The number of MAC addresses that can be learned is only limited by the platform, 65,535 MAC addresses for EX Series switches and 1,048,575 MAC addresses for other devices.

The interface-mac-limit option can also be edited at the following hierarchies:

[edit vlans vlan-name switch-options],
[edit vlans vlan-name switch-options interface interface-name]

For example set vlans v977 switch-options interface ae50.0 interface-mac-limit 4096 will correct the behavior, increasing the number of permitted MACs on that interface for that vlan and will also clear the log:

show ethernet-switching interface ae50.0  
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
            LH - MAC limit hit, DN - interface down,
             MMAS - Mac-move action shutdown,
             SCTL - shutdown by Storm-control )
Logical      Vlan      TAG    MAC      STP      Logical       Tagging
interface     members         limit     state     interface flags
ae1.0                  128000           AD         tagged  
          DATA      333    1024     Forwarding            tagged  
          WIFI      977    4096     Forwarding            tagged

NOTE: If you specify a MAC limit and packet action for all interfaces in the VLAN and a specific interface in the VLAN, the MAC limit and packet action specified at the specific interface level takes precedence. Also, at the VLAN interface level, only the drop and drop-and-log options are supported.


This was also seen on MX routers specifically on MX304 where the following commands resolved the issue:

set routing-instances <RI-name> bridge-domains VID-1010 bridge-options mac-table-size 128000
set routing-instances <RI-name> bridge-domains VID-1010 bridge-options mac-table-size packet-action drop
set routing-instances <RI-name> bridge-domains VID-1010 bridge-options interface-mac-limit 128000
set routing-instances <RI-name> bridge-domains VID-1010 bridge-options interface-mac-limit packet-action drop

set routing-instances <RI-name> switch-options interface ae1.0 interface-mac-limit 64000
set routing-instances <RI-name> switch-options interface ae1.0 interface-mac-limit packet-action drop
set routing-instances <RI-name> switch-options interface ae2.0 interface-mac-limit 64000
set routing-instances <RI-name> switch-options interface ae2.0 interface-mac-limit packet-action drop



Further information can be found on the next documentation: https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/topic-map/configuring-mac-limiting.html

10/03/2023