106MAC-based VLAN configurationIntroduction to MAC-based VLANThe MAC-based VLAN feature assigns hosts to a VLAN based on their MAC addresses. The followingapproaches are available for configuring MAC-based VLANs:Approach 1: Static MAC-based VLAN assignmentStatic MAC-based VLAN assignment applies to networks containing a small number of VLAN users. Insuch a network, you can create a MAC address-to-VLAN map containing multiple MACaddress-to-VLAN entries on a port, enable the MAC-based VLAN feature on the port, and assign the portto MAC-based VLANs.With static MAC-based VLAN assignment configured on a port, the switch processes received frames byusing the following guidelines:• When the port receives an untagged frame, the switch looks up the MAC address-to-VLAN mapbased on the source MAC address of the frame for a match. The switch first performs a fuzzy match.In the fuzzy match, the switch searches the MAC address-to-VLAN entries whose masks are notall-Fs and performs a logical AND operation on the source MAC address and each mask. If theresult of an AND operation matches the corresponding MAC address, the switch tags the framewith the corresponding VLAN ID. If the fuzzy match fails, the switch performs an exact match. In theexact match, the switch searches the MAC address-to-VLAN entries whose masks are all-Fs. If theMAC address of a MAC address-to-VLAN entry matches the source MAC address of the untaggedframe, the switch tags the frame with the corresponding VLAN ID. If no match is found, the switchassigns a VLAN to the frame by using the following criteria in turn: IP addresses, protocols, andports.• When the port receives a tagged frame, the port forwards the frame if the VLAN ID of the frame ispermitted by the port, or otherwise drops the frame.Approach 2: Dynamic MAC-based VLAN assignmentWhen you cannot determine the target MAC-based VLANs of a port, you can use dynamic MAC-basedVLAN assignment on the port. To do that, you can create a MAC address-to-VLAN map containingmultiple MAC address-to-VLAN entries, enable the MAC-based VLAN feature and dynamic MAC-basedVLAN assignment on the port. When the port receives a frame that matches a MAC address-to-VLANentry configured on the port, the port dynamically joins the corresponding MAC-based VLAN.The following workflows apply:1. When the port receives a frame, the port first determines whether the frame is tagged.• If yes, the port reports the source MAC address of the frame.• If not, the port selects a VLAN for the frame in the order of MAC-based VLAN, protocol-basedVLAN, and port-based VLAN, tags the untagged frame with the selected VLAN tag, and obtainsthe tag. Then, the port reports the source MAC address of the frame.2. After reporting the source MAC address of the frame, the port looks up the source MAC addressin the MAC-to-VLAN map, and processes the frame as follows:• If the source MAC address of the frame matches a MAC address-to-VLAN entry configured on theport, the port checks whether the VLAN ID of the frame is the same as the VLAN in theMAC-to-VLAN entry.{ If yes, the port dynamically joins the VLAN and forwards the frame.
