VMware ESXi and vSphere Cluster Management

Configure Static MAC Address Entries on a Cisco Switch

Learn how to add, verify, remove, and troubleshoot permanent static MAC address entries on a Cisco switch.

A Cisco Layer 2 switch uses a MAC address table to decide where to forward Ethernet frames. The table associates a MAC address with a VLAN and an outgoing switch interface. It is also commonly called the CAM table, after the Content Addressable Memory commonly used for hardware-based lookups.

This lesson shows how to configure a permanent static MAC address entry, verify it, remove it, and troubleshoot incorrect mappings.

How a Switch Uses the MAC Address Table

A MAC address identifies a network interface at Layer 2. A VLAN is a logical Layer 2 broadcast domain, and the VLAN is part of the switch's forwarding decision.

When a switch receives an Ethernet frame, it performs source MAC learning: it records the frame's source MAC address, VLAN, and ingress interface. This creates a dynamic MAC entry.

If the destination MAC address is known in the same VLAN, the switch forwards the frame only through the associated interface.
If the destination is unknown, the switch floods the frame within the VLAN, excluding the interface on which it arrived.
If the destination is associated with the incoming interface, the switch filters the frame instead of sending it back out that interface.

A switch interface is a physical or logical switch port, such as FastEthernet0/2 or GigabitEthernet1/0/12.

Dynamic and Static MAC Entries Compared

Characteristic	Dynamic Entry	Static Entry
How the entry is created	Learned automatically from the source MAC of a received frame.	Created manually by an administrator.
Whether the entry ages out	Normally ages out after a period without traffic.	Does not age out as an ordinary dynamic entry.
Behavior after restart	Must be learned again from received frames.	Remains after a restart when the configuration is saved in startup configuration.
Typical administrative use	Normal endpoint discovery and Layer 2 forwarding.	Pinning an expected endpoint to a specific VLAN and interface.
Effect of endpoint movement	The switch can learn the new location, subject to its forwarding and security behavior.	The mapping must be updated or deleted manually.

A static entry is appropriate only when the endpoint is expected to remain on the configured VLAN and physical port. It is not a substitute for understanding the physical topology or VLAN assignment.

Cisco IOS Static MAC Address Syntax

Static MAC table commands are entered in global configuration mode. The standard Cisco IOS command structure is:

mac address-table static <mac-address> vlan <vlan-id> interface <interface-id>

Parameter	Purpose	Example
MAC address	The destination endpoint's Layer 2 address, written in Cisco dotted hexadecimal notation.	`1111.1111.1111`
VLAN ID	The VLAN in which the switch should perform the MAC table lookup.	`1` or `20`
Interface identifier	The switch port where the endpoint is expected to be connected.	`fastethernet0/2`

For example, this command maps MAC address 1111.1111.1111 to VLAN 1 and FastEthernet0/2:

mac address-table static 1111.1111.1111 vlan 1 interface fastethernet0/2

Important syntax note: Cisco IOS uses mac address-table with a space between mac and address-table. Do not replace it with mac-address-table.

Configure a Static MAC Entry

Example 1: Endpoint in VLAN 1 on FastEthernet0/2

Assume the endpoint has MAC address 1111.1111.1111, is connected to FastEthernet0/2, and belongs to VLAN 1.

Switch> enable
Switch# configure terminal
Switch(config)# mac address-table static 1111.1111.1111 vlan 1 interface fastethernet0/2
Switch(config)# end
Switch# copy running-config startup-config

enable enters privileged EXEC mode. configure terminal enters global configuration mode, where the static MAC command is entered. The save command copies the active running configuration to startup configuration so the intended mapping is retained across a restart.

Example 2: Endpoint in VLAN 20 on a GigabitEthernet port

This example binds MAC address 00aa.11bb.22cc to VLAN 20 and GigabitEthernet1/0/12:

Switch> enable
Switch# configure terminal
Switch(config)# mac address-table static 00aa.11bb.22cc vlan 20 interface gigabitethernet1/0/12
Switch(config)# end
Switch# copy running-config startup-config

Before applying either example, verify that the endpoint is physically connected to the selected interface and that the interface is assigned to the selected access VLAN. A static table entry does not correct a wrong port mode or VLAN configuration.

Verify the Static Entry

Use the following privileged EXEC command to display the complete MAC address table:

Switch# show mac address-table

To locate one address, use an address filter:

Switch# show mac address-table address 1111.1111.1111

You can also filter by interface:

Switch# show mac address-table interface fastethernet0/2

Some IOS versions support additional filtering options, such as filtering by VLAN. You can also use the terminal's filtering features when available, but the exact output and filter syntax can vary by switch platform and IOS release.

A successful verification should identify the configured VLAN, MAC address, entry type, and destination port. The entry type should be STATIC and the port should match the configured interface.

          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    1111.1111.1111    STATIC      Fa0/2

Field	What to Confirm
VLAN	The entry is in the VLAN expected by the endpoint.
MAC address	The displayed address exactly matches the endpoint's address.
Entry type	The entry is shown as static, not merely dynamic.
Port or interface	The destination port is the interface where the endpoint is connected.

Remove a Static MAC Entry

To remove an entry, return to global configuration mode and prefix the original static command with no:

Switch# configure terminal
Switch(config)# no mac address-table static 1111.1111.1111 vlan 1 interface fastethernet0/2
Switch(config)# end
Switch# show mac address-table address 1111.1111.1111

Confirm that the specified static entry no longer appears. After removal, traffic for that destination may be flooded until the switch receives a frame from the endpoint and dynamically learns a valid MAC-to-port mapping, if applicable.

Moving the Endpoint to Another Port

If the endpoint moves from FastEthernet0/2 to FastEthernet0/5 while remaining in VLAN 1, delete the old association and create the new one:

Switch# configure terminal
Switch(config)# no mac address-table static 1111.1111.1111 vlan 1 interface fastethernet0/2
Switch(config)# mac address-table static 1111.1111.1111 vlan 1 interface fastethernet0/5
Switch(config)# end
Switch# copy running-config startup-config

Operational Considerations

Do not assign the same MAC address to multiple static interfaces within the same VLAN. Conflicting mappings can produce inconsistent or incorrect forwarding.
An incorrect static port can cause traffic loss or misdelivery because the switch follows the configured mapping rather than learning a different location for that static entry.
An incorrect VLAN is also significant: MAC lookups are VLAN-aware, so an entry in VLAN 1 does not provide the same forwarding result as an entry in VLAN 20.
When an endpoint is relocated, update or delete its static mapping before relying on the new connection.
Save the running configuration if the mapping must survive a switch restart.

Static MAC Entries Versus Port Security

A static MAC table entry tells the switch where to forward traffic for a particular MAC address in a VLAN. Port security is a separate feature that controls which MAC addresses are allowed on an interface and what the switch should do when a violation occurs.

Port security can restrict, learn, or sticky-learn permitted MAC addresses and can define violation actions such as protect, restrict, or shutdown, depending on the configuration. A static MAC entry by itself does not provide those port-security controls.

Troubleshooting

The static entry is absent

Confirm that the command was entered from global configuration mode.
Check the MAC address formatting and confirm that the address is correct.
Confirm the VLAN ID and interface name.
Use the running configuration to check whether the command exists, then save the configuration if persistence across reload is expected.

Switch# show running-config

The connected device cannot receive traffic

Verify that the static MAC address belongs to the attached endpoint.
Verify that the endpoint is actually connected to the configured interface.
Verify that the interface is assigned to the same VLAN specified in the static entry.
Remove or correct the entry if the device has moved.

The MAC address appears on an unexpected port

Look for a stale static entry that still points to the old interface.
Determine whether the endpoint was moved or whether another device is using the same address.
Investigate duplicate MAC address use caused by virtualization, bridging, or a downstream switch.

Two static mappings cause inconsistent forwarding

Ensure that one MAC address has only one valid location in a given VLAN.
Delete conflicting static entries.
Confirm the physical topology and VLAN path before applying the correct mapping.

Exam-Relevant Notes

Dynamic learning records the source MAC address and ingress port of a received Ethernet frame.
A known unicast destination is forwarded through the interface associated with its MAC address in the relevant VLAN.
A static MAC entry is manually configured and does not age out like an ordinary dynamic entry.
Static entries remain after a restart only when the configuration containing them is retained in startup configuration.
The correct Cisco IOS syntax is mac address-table static.
A static MAC entry is different from switch port security.

For related Layer 2 configuration guidance, see static MAC address configuration on a Cisco switch.