Re: VLAN membership MAC limit

Thank you all for sharing your insight

First of all mac-limit can be applied to access ports only and is usually done with:

set ethernet-switching-options secure-access-port interface ge-0/0/1 mac-limit 1

My question was about a version of above that allow you to set mac-limit per port per VLAN

set ethernet-switching-options secure-access-port interface ge-0/0/1 vlan 100 mac-limit 1

I did some tests and was able to use it on voip port where instead to setting MAC limit to 2 I was able to set the limit  to 1 for data and 1 for voice.  This way I was unable to use 2 PCs only or 2 Phones only but with 1 PC and 1 Phone it worked fine.

vlans {
    data {
        vlan-id 100;
        l3-interface vlan.100;
    }
    voice {
        vlan-id 200;
        l3-interface vlan.200;
    }
}
interfaces {
    ge-0/0/1 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members data;
                }
            }
        }
    }
}
ethernet-switching-options {
    secure-access-port {
        interface ge-0/0/1.0 {
            vlan data {
                mac-limit 1 action drop;
            }
            vlan voice {
                mac-limit 1 action drop;
            }
        }
    }
    voip {
        interface ge-0/0/1.0 {
            vlan voice;
            forwarding-class expedited-forwarding;
        }
    }
}

When the limit was exceeded switch logged:

Mar 22 16:33:54  exA-1 eswd[1318]: ESWD_VMEMBER_MAC_LIMIT_DROP: vlan data mac 00:26:88:00:00:02 (tag 100) interface ge-0/0/1.0, per port per vlan limit exceeded
Mar 22 16:33:56  exA-1 last message repeated 2 times
Mar 22 16:37:54  exA-1 eswd[1318]: ESWD_VMEMBER_MAC_LIMIT_DROP: vlan voip mac 00:26:88:00:00:04 (tag 200) interface ge-0/0/1.0, per port per vlan limit exceeded
Mar 22 16:37:57  exA-1 last message repeated 2 times