Netgear XCM8806 Chassis User Manual - Page 439

NETGEAR 8800 User Manual Device A Hub Device B Device C EX_175 Figure 27. Switch Configured for Limit Learning MAC Address Lockdown In contrast to limiting learning on virtual ports, you can lockdown the existing dynamic FDB entries and prevent any additional learning using the lock-learning option from the following command: configure ports vlan [limit-learning {action [blackhole | stop-learning]} | lock-learning | unlimited-learning | unlock-learning] This command causes all dynamic FDB entries associated with the specified VLAN and ports to be converted to locked static entries. It also sets the learning limit to 0, so that no new entries can be learned. All new source MAC addresses are blackholed. Note: Blackhole FDB entries added due to MAC security violations on NETGEAR 8800 switches are removed after each FDB aging period regardless of whether the MAC addresses in question are still sending traffic. If the MAC addresses are still sending traffic, the blackhole entries will be re-added after they have been deleted. Locked entries do not get aged, but can be deleted like a regular permanent entry. For ports that have lock-down in effect, the following traffic still flows to the port: • Packets destined for the permanent MAC and other non-blackholed MAC addresses • Broadcast traffic Traffic from the permanent MAC still flows from the virtual port. To remove MAC address lockdown, use the unlock-learning option from the following command: Chapter 17. Security | 439