Configure Layer 2 Learning and Forwarding for Bridge Domains Functioning as Switches
Understanding Layer 2 Learning and Forwarding for Bridge Domains Functioning as Switches with Layer 2 Trunk Ports
Layer 2 learning is enabled by default. A set of bridge domains, configured to function as a switch with a Layer 2 trunk port, learns unicast media access control (MAC) addresses to avoid flooding packets to the trunk port.
Traffic is not flooded back onto the interface on which
it was received. However, because this “split horizon”
occurs at a late stage, the packet statistics displayed by commands
such as show interfaces queue will include flood traffic.
You can optionally disable Layer 2 learning for the entire set of bridge domains as well as modify the following Layer 2 learning and forwarding properties:
Limit the number of MAC addresses learned from the Layer 2 trunk port associated with the set of bridge domains
Modify the size of the MAC address table for the set of bridge domains
Enable MAC accounting for the set of bridge domains
Configuring Bridge Domains as Switches for Layer 2 Trunk Ports
You can configure a set of bridge domains that are associated with a Layer 2 trunk port. The set of bridge domains function as a switch. Packets received on a trunk interface are forwarded within a bridge domain that has the same VLAN identifier. A trunk interface also provides support for IRB, which provides support for Layer 2 bridging and Layer 3 IP routing on the same interface.
To configure a Layer 2 trunk port and set of bridge domains, include the following statements:
[edit interfaces]
interface-name {
unit number {
family bridge {
interface-mode access;
vlan-id number;
}
}
}
interface-name {
native-vlan-id number;
unit number {
family bridge {
interface-mode trunk;
vlan-id-list [ vlan-id-numbers ];
}
}
}
[edit bridge-domains]
bridge-domain-name {
vlan-id number;
vlan-id-list [ vlan-id-numbers ];
. . . .
}
For interface-mode trunk, you can include the vlan-id-list statement.
You must configure a bridge domain and VLAN identifier for each
VLAN associated with the trunk interface. You can configure one or
more trunk or access interfaces at the [edit interfaces] hierarchy level. An access interface enables you to accept packets
with no VLAN identifier. For more information about configuring trunk
and access interfaces, see the Interfaces User Guide for Security Devices.
Limiting MAC Addresses Learned from a Layer 2 Trunk Port
You can configure a limit on the number of MAC addresses learned from a trunk port or from a specific trunk or access interface.
To limit the number of MAC addresses learned through
a trunk port associated with a set of bridge domains, include the interface-mac-limit limit statement at
the [edit switch-options] hierarchy level:
[edit] switch-options { interface-mac-limit limit; }
To limit the number of MAC addresses learned from a specific
logical interface configured as an access interface or a trunk interface,
include the interface-mac-limit limit statement at the [edit switch-options interface interface-name] hierarchy level:
[edit] switch-options { interface interface-name { interface-mac-limit limit; } }
The default value for the number MAC addresses that can be learned from a logical interface is 1024. You can specify a limit either for a set of bridge domains or for a specific logical interface in the range from 1 through 131,071. The value you configure for a specific logical interface overrides any value you specify for the set of bridge domains.
After the specified MAC address limit is reached, the
default is for any incoming packets with a new source MAC address
to be forwarded. You can specify that the packets be dropped for the
entire virtual switch after the MAC address limit is reached by including
the packet-action drop statement at the [edit switch-options
interface-mac-limit limit] hierarchy level:
[edit switch-options interface interface-name interface-mac-limit limit] packet-action drop;
To specify that the packets be dropped from a specific
logical interface in a set of bridge domains with a trunk port after
the MAC address limit is reached, include the packet-action drop statement at the [edit routing-instances routing-instance-name interface interface-name interface-mac-limit limit] hierarchy level:
[edit routing-instances routing-instance-name interface interface-name interface-mac-limit limit] packet-action drop;
Configuring the Size of the MAC Address Table for a Set of Bridge Domains
You can modify the size of the MAC address table for a set of bridge domains. The minimum you can configure is 16 addresses, and the maximum is 1,048,575 addresses. The default table size is 5120 addresses.
If the MAC table limit is reached, new addresses can no longer be added to the table. Unused MAC addresses are removed from the MAC address table automatically. This frees space in the table, allowing new entries to be added to the table.
To modify the size of the MAC table for a set of bridge
domains, include the mac-table-size statement at the [edit switch-options] hierarchy level:
[edit switch-options] mac-table-size limit;
Enabling MAC Accounting for a Set of Bridge Domains
By default, MAC accounting is disabled. You can enable packet counting for a set of bridge domains. After you enable packet accounting, the Junos OS maintains packet counters for each MAC address learned on the trunk port associated with the set of bridge domains.
To enable MAC accounting for a set of bridge domains,
include the mac-statistics statement at the [edit
switch-options] hierarchy level:
[edit switch-options] mac-statistics;
Disabling MAC Learning for a Set of Bridge Domains
By default, MAC learning is enabled for a set of bridge domains. You can disable MAC learning for a set of bridge domains. Disabling dynamic MAC learning prevents the Layer 2 trunk port associated with the set of bridge domains from learning source and destination MAC addresses. When you disable MAC learning, source MAC addresses are not dynamically learned, and any packets sent to these source addresses are flooded into the switch.
To disable MAC learning for a set of bridge domains,
include the no-mac-learning statement at the [edit
switch-options] hierarchy level:
[edit switch-options] no-mac-learning;