This article helps to explain MAC move limiting features on ELS switches.

During the mac address movements, we would be observing the following issues:

• Unexpected MAC address flooding on switch interfaces.
• Frequent MAC address movements between interfaces.
• Network instability due to MAC spoofing or loops.
• Interfaces being shut down due to excessive MAC activity.

MAC Move Limiting tracks how often a MAC address changes its associated interface within a VLAN. If the number of moves exceeds a configured threshold (e.g., 10 moves per second), the switch can take predefined actions such as:

• drop: Discards the packet silently.
• drop-and-log: Drops the packet and logs the event (EX2300, EX3400, EX4300).
• log: Logs the event without dropping the packet (EX4300, EX9200).
• none: No action; the MAC move is allowed.
• shutdown: Disables the interface in the VLAN and logs the event.
• vlan-member-shutdown: Blocks the interface based on VLAN membership (EX9200 only).

This behavior is configured per VLAN, allowing fine-grained control over where and how the policy is enforced.

Configure the mac move limit in the cli as below:

{master:0}[edit]
user@switch# set vlans V20 vlan-id 20 switch-options mac-move-limit 10 packet-action drop >>>>> Example configuration for mac-move limit

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/task/port-security-mac-move-limiting-cli-els.html