How to block the Dynamically learned MAC address from switch

[R Manjunatha]

Helloo,

How can I block a dynamically learned MAC address on the switch? I need to block a specific MAC address that has been learned by the switch.

[Leo Laohoo]

And what if the owner of the client enables Random MAC Address?

Does this target MAC address always appear in the same switchport?  If it does, what happens if that particular switchport is assigned to a "null" VLAN (a VLAN that does not appear in the VLAN database) or a VLAN that is not allowed in the Trunk?

[R Manjunatha]

My question is very simple and straightforward:
How can I block a specific user's MAC address on the switch? I don't want that particular MAC address to appear in my switch's MAC address table. what command do I need to use? 

[R Manjunatha]

My question is straightforward:
How can I block a specific user's MAC address on the switch? I don't want that particular MAC address to appear in my switch's MAC address table. what command do I need to use? 

[Leo Laohoo]

---

@R Manjunatha wrote:

My question is very simple and straightforward:
How can I block a specific user's MAC address on the switch? I don't want that particular MAC address to appear in my switch's MAC address table. what command do I need to use? 

---

Why?

What is the business or use case for this?  What are you trying to achieve?

The only logical reason that I can only surmise is a MAC address flooding the logs with MAC flapping error messages. 

[MHM Cisco World]

mac address-table static xxxx.xxxx.xxxx  vlan x drop <<- this as workaround' note if you want to can repeat command for each vlan.

MHM

[R Manjunatha]

Thanks for the update. I configured the command as mentioned, and I believe this only applies to static MAC addresses, not dynamically learned ones. Am I correct?

[MHM Cisco World · Accepted solution]

Befor mac add to table

You can use 802.1x  which make SW prevent add mac into table until this mac is authc 

You cqn use port-secuirty add static mac to any unuse port and make all other port run port secuirty with violation restrictions.

After mac add to table 

You can use command I share above to drop traffic to this mac.

MHM

[Joshqun Ismayilov]

@R Manjunatha  

yes, it is possible / https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/configuration/guide/sy_swcg/mac_traffic_blocking.pdf

Thanks !