CCNA online course

Assign a Static MAC Address on a Cisco Switch

Learn how to configure, verify, troubleshoot, change, and remove a static MAC address-table entry on a Cisco IOS switch.

A static MAC address-table entry is an administrator-created mapping between an Ethernet MAC address, a VLAN, and a switch interface. Cisco switches normally learn these mappings automatically, but a static entry provides predictable Layer 2 forwarding for a selected device.

This lesson assumes familiarity with OSI layers, Ethernet addressing, Cisco IOS command modes, interfaces, and VLANs. For general networking background, see computer networking concepts.

What a Static MAC Entry Does

A MAC address is a Layer 2 hardware address used by Ethernet switches to identify endpoints. A switch records learned MAC addresses in its MAC address table, also called the CAM table. The table tells the switch which interface should receive frames destined for a particular MAC address within a particular VLAN.

Normally, the switch examines the source MAC address of each received frame and learns that the source is reachable through the receiving interface. This is called dynamic learning. Dynamic entries are subject to MAC address aging: if an address is inactive for the configured aging period, the switch can remove the entry and learn it again when traffic returns.

A static entry is configured manually. It binds a MAC address to a VLAN and an outbound interface. Static entries normally do not age out under normal MAC-table aging behavior. They remain until an administrator removes or changes them, or until platform-specific behavior affects the configuration.

• Predictable forwarding: the switch has a predetermined destination interface.
• Restricted device placement: the table can identify the expected location of a device, although this alone does not block another device from transmitting.
• Limited traffic control: some platforms support a static entry with a drop action rather than a forwarding interface. Syntax and support vary by platform.

MAC Address-Table Fundamentals

For each relevant VLAN, the switch looks up the destination MAC address in its table. A known unicast is sent only through the interface associated with the matching MAC and VLAN. If the destination is not known in that VLAN, the switch performs unknown-unicast flooding: it sends the frame out appropriate ports in the VLAN, except the port on which the frame arrived.

The exact display labels can differ between Cisco IOS, IOS XE releases, Catalyst models, and simulators. A static entry is VLAN-specific: the same MAC value in another VLAN represents a separate table lookup.

Requirements Before Configuration

1. Identify the device MAC address. Obtain it from the endpoint, an existing switch-table entry, DHCP or inventory information, or another trusted source. Cisco commonly displays MAC addresses in dotted hexadecimal notation, such as 0011.2233.4455.
2. Identify the VLAN. The VLAN must be the Layer 2 broadcast domain in which the device communicates.
3. Identify the physical interface. Confirm the switch port to which the device is connected.
4. Validate the access-port configuration. For a typical endpoint, the interface should operate as an access port in the intended VLAN.
5. Check for duplicate addresses. Two devices must not use the same MAC address in the same VLAN.

The MAC address, VLAN, and interface must agree. A correct MAC address assigned to the wrong VLAN or wrong interface can cause traffic to be forwarded incorrectly or not reach the endpoint.

Configure the Access Port

The following example prepares FastEthernet0/10 for a workstation in VLAN 20. Interface naming varies by switch model; a modern Catalyst might use a GigabitEthernet or TenGigabitEthernet identifier instead.

configure terminal
interface fastethernet0/10
 switchport mode access
 switchport access vlan 20
end

switchport mode access makes the port an access port, and switchport access vlan 20 assigns its untagged endpoint traffic to VLAN 20. Ensure that VLAN 20 exists and that the interface is not administratively shut down.

Configure a Static MAC Address

Use global configuration mode, not interface configuration mode, to create the table entry:

configure terminal
mac address-table static 0011.2233.4455 vlan 20 interface fastethernet0/10
end

This example maps workstation MAC address 0011.2233.4455 to VLAN 20 and FastEthernet0/10. The switch uses that information when forwarding frames destined for the MAC address in VLAN 20.

Use the platform's command help to inspect available forms:

mac address-table static ?

Verify the Entry and Port

First search for the specific address:

show mac address-table address 0011.2233.4455
show mac address-table static

A successful result should show the MAC address, VLAN 20, a static entry type, and FastEthernet0/10. The exact columns and capitalization vary, but the essential facts are the same.

Also validate the physical and VLAN state:

show interfaces fastethernet0/10 status
show interfaces fastethernet0/10 switchport
show vlan brief

• show interfaces ... status helps confirm that the port is connected and not disabled.
• show interfaces ... switchport shows the administrative and operational switchport mode and access VLAN.
• show vlan brief confirms that the VLAN exists and that the interface is listed in the expected VLAN.

If the static entry is present but connectivity fails, do not assume the table entry is sufficient. Check the endpoint's actual MAC address, cable and link state, port shutdown status, VLAN assignment, spanning-tree or other Layer 2 blocking conditions, and the endpoint's own IP configuration.

Example: Verify a Printer Entry

Suppose a printer is connected to GigabitEthernet1/0/12 in VLAN 30. After configuring its static entry, run:

show mac address-table address 00aa.bbcc.ddee
show mac address-table static
show interfaces gigabitethernet1/0/12 status
show interfaces gigabitethernet1/0/12 switchport

Confirm that the printer's MAC appears as static, belongs to VLAN 30, and points to GigabitEthernet1/0/12. The port should be operational and assigned to VLAN 30.

Remove or Change a Static Entry

To remove the workstation mapping, negate the original command:

configure terminal
no mac address-table static 0011.2233.4455 vlan 20 interface fastethernet0/10
end

When moving an endpoint from FastEthernet0/10 to FastEthernet0/11 in the same VLAN, use a controlled sequence:

1. Confirm the endpoint's new physical connection and target VLAN.
2. Remove the old static mapping.
3. Configure the mapping for the new interface.
4. Verify the table and port state.

configure terminal
no mac address-table static 0011.2233.4455 vlan 20 interface fastethernet0/10
mac address-table static 0011.2233.4455 vlan 20 interface fastethernet0/11
end
show mac address-table address 0011.2233.4455

Leaving the obsolete entry in place can direct frames toward the old port. The replacement mapping can also fail if it is configured for the wrong VLAN or interface.

Static MAC Entries Versus Port Security

Port security restricts which source MAC addresses may use an interface and defines what happens when an unauthorized source appears. A static MAC-table entry only supplies destination forwarding information. It does not normally prevent a different device from sending frames through the port.

For an approved endpoint that must be the only device using an access port, port security is usually the relevant feature:

configure terminal
interface fastethernet0/10
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address 0011.2233.4455
end

This is a port-security configuration, not a static MAC address-table forwarding entry. Sticky MAC is also separate: the switch dynamically learns a source MAC and can record the learned value in the running configuration for port-security use.

Troubleshooting

Design and Operational Considerations

• Static entries create administrative overhead. Every device move, replacement, or interface change may require a configuration update.
• An incorrect VLAN or interface can cause silent forwarding failures.
• Duplicate MAC addresses can produce unpredictable behavior and should be investigated rather than hidden with static entries.
• Static entries should be documented with the device owner, MAC address, VLAN, interface, purpose, and change date.
• Use them selectively for specific operational requirements, not as a replacement for normal dynamic switching.
• Command options and behavior can differ among Cisco IOS, IOS XE, Catalyst models, and network simulators.
• Use port security when the requirement is to control which source devices may access an endpoint port.

Exam-Ready Summary

• A dynamic MAC entry is learned from a source frame and can age out.
• A static MAC entry is manually mapped to a MAC address, VLAN, and interface and normally does not age out.
• Known unicast traffic uses the matching VLAN-specific table entry; unknown unicast traffic is flooded within the VLAN.
• The static MAC command is entered in global configuration mode: mac address-table static <mac> vlan <vlan-id> interface <interface>.
• Verify with show mac address-table address <mac>, then check interface status, switchport details, and VLAN membership.
• Remove an entry by negating the complete static command.
• A static forwarding entry is not the same as a secure MAC configured under port security.