Inside the switch: static MAC entries, CEF, SDM templates and unicast flooding

Static MAC address entries

A switch normally learns addresses by itself, as explained in How switches work. You can also add static entries. They never age out and the switch will not move them to another port, even if it sees the same address elsewhere. Use them sparingly: for a device that must always be reached through one port, or to drop all traffic to an address.

mac address-table static 0050.56aa.0101 vlan 10 interface GigabitEthernet1/0/5
mac address-table static 0050.56aa.0bad vlan 10 drop
show mac address-table static

Static entries are easy to forget. If the device moves to another port, it silently stops working, so document them well.

From process switching to CEF

Early routers sent every packet to the CPU, which looked up the routing table and the ARP cache before forwarding it. This process switching is slow. Cisco Express Forwarding (CEF) solves the problem by preparing two tables before any traffic arrives:

• The FIB (forwarding information base): a copy of the best routes from the routing table, arranged for very fast lookups.
• The adjacency table: the ready-made Layer 2 header for each next hop, built from ARP and similar sources.

On a router CEF runs in software but is still far quicker than process switching. On a multilayer switch the FIB and adjacencies are written into special hardware memory called TCAM (ternary content-addressable memory), so routing between VLANs happens at line rate. Traffic still goes to the CPU for things such as packets addressed to the switch itself, packets with options, or destinations whose ARP entry is not yet resolved. Useful commands are show ip cef, show ip cef 10.1.1.0 detail and show adjacency detail.

SDM templates: sharing out hardware memory

TCAM is fast but limited, and the same memory must hold MAC addresses, IPv4 and IPv6 routes, ACL entries and QoS entries. The Switching Database Manager (SDM) template decides how much of each the switch can hold. A template tuned for access switching gives more space to MAC addresses; a routing template gives more to routes. On some smaller switches the default template does not allow routing at all until you change it.

show sdm prefer
configure terminal
 sdm prefer lanbase-routing
end
reload

Template names vary by platform and software version, and a change only applies after a reload, so plan it for a maintenance window. If a switch logs that it cannot program more routes or ACL entries in hardware, check the SDM template first.

Unicast flooding caused by asymmetric routing

A switch floods a unicast frame when it does not know which port the destination lives on. This usually lasts only a moment, but asymmetric routing can make it continuous. The cause is a mismatch between two timers: on Cisco devices an ARP entry lasts four hours by default, while a MAC address table entry ages out after five minutes of silence.

Imagine two distribution switches, each acting as gateway for different VLANs. Traffic towards a server leaves through switch A, but the replies return through switch B. Switch A keeps sending frames to the server using its cached ARP entry, but it never sees frames from the server, so its MAC entry ages out. From then on, switch A floods every frame for that server to all ports in the VLAN. Links fill up and other hosts receive traffic they should never see.

Fixes include lowering the ARP timeout below the MAC aging time on the gateway SVIs (for example arp timeout 270), raising the MAC aging time to match ARP, or making the paths symmetric by aligning the active first-hop gateway with the spanning tree root for each VLAN.

Real-world example: a university's backup server VLAN became slow every night. A capture on a lecture theatre PC showed backup traffic arriving that had nothing to do with it. The network team found that the HSRP active gateway and the spanning tree root were on different core switches, so traffic was asymmetric and one switch was flooding. They moved the HSRP priority to match the root bridge and set the ARP timeout on the SVIs to 270 seconds. The flooding stopped and the backup window shrank by an hour.