Showing results for 
Search instead for 
Did you mean: 

Cisco Nexus9000 many mac issue

Dear Concern,


I face some issue for replace my switch. Here i share some log. 



2020 Dec 31 03:49:55 cisco-9000 %L2FM-2-L2FM_MAC_FLAP_DISABLE_LEARN: Disabling learning in vlan 1949

for 120s due to too many mac moves


sh mac address-table  notification mac-move

AM MAC Registration/Deletion Notifications: 3

  Number of MAC Addresses added: 16109

  Number of MAC Addresses moved: 10855

  Number of MAC Addresses removed: 8




BIOS: version 05.38
NXOS: version 7.0(3)I7(9)
cisco Nexus9000







4 Replies 4

VIP Mentor VIP Mentor
VIP Mentor


 Ref :


  Error Message  L2FM-2-L2FM_MAC_FLAP_DISABLE_LEARN: Disabling learning in vlan [dec] for 120s due to too many mac moves


Explanation  MAC(s) in vlan [dec] have moved too many times. Disabling learning for 120s.

Recommended Action  No action is required.


   - So Cisco seems rather optimistic on this message, I would advice however to check your network for loops (e.g.). In  that context use a syslog server to collect messages from the device in a continuous manner. Review the logs from the device at regular times.                                    Perhaps a broader problem such as a loop can be detected.



Georg Pauwen
VIP Master VIP Master
VIP Master



in addition to the other post, the document linked below explains why these MAC move messages occur. I don't think you can disable this control plane protection, as the 'no mac address-table loop-detect port-down' command just "reverts to the default action of disabling MAC learning for 180 seconds."


Nexus 9000 Mac move troubleshooting and preventive methods

Christopher Hart
Cisco Employee
Cisco Employee


This syslog indicates that one or more MACs in a VLAN are rapidly moving between two interfaces, which is typically indicative of a loop. As a self-protection mechanism, the switch will disable dynamic MAC learning in that VLAN for 120 seconds to reduce the impact the loop has on the switch.

When troubleshooting these issues, it can usually be helpful to know which MAC addresses are moving, as well as between which two interfaces the MAC is moving. A syslog can expose this information after increasing the logging level for the L2FM (Layer 2 Forwarding Manager) to a level of 5 through the below command:

switch# configure terminal
switch(config)# logging level l2fm 5
switch(config)# end

When the issue happens again, you should see syslogs similar to the following:

2018 Nov 14 16:04:23.881 N9K %L2FM-4-L2FM_MAC_MOVE2: Mac 0000.117d.e02e in vlan 741 has moved between Po6 to Eth1/3
2018 Nov 14 16:04:23.883 N9K %L2FM-4-L2FM_MAC_MOVE2: Mac 0000.117d.e02e in vlan 741 has moved between Po6 to Eth1/3

This will help you troubleshoot the issue further by identifying which specific MAC addresses are moving, as well as between what two ports the MACs are moving between. This will help you isolate the issue and determine where the loop may be coming from.

These commands are documented in the Nexus 9000 MAC Move Troubleshooting and Preventive Methods Troubleshooting TechNote.

I hope this helps - thank you!


Christopher - Thank you for sharing these commands.  They are very usefull.



Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers