How to Add Static MAC Address on Cisco Switch

In an enterprise Ethernet local area network (LAN), Cisco switches make forwarding decisions at Layer 2 using a Content-Addressable Memory (CAM) table. Under standard operating conditions, this table is populated dynamically: the switch inspects the source Media Access Control (MAC) address of incoming frames, notes the physical port or Port-Channel on which the frame arrived, and records that mapping alongside its corresponding Virtual Local Area Network (VLAN).

While dynamic learning is sufficient for the vast majority of network traffic, certain operational scenarios require deterministic forwarding. Binding a static MAC address to a specific interface ensures that frames destined for a critical host—such as a default gateway, a dedicated database server, a network storage appliance, or legacy industrial automation equipment—are routed directly to the designated switchport without delay. Configuring static entries also hardens the network against Layer 2 spoofing and suppresses unknown unicast flooding.

This comprehensive guide covers how static MAC addresses operate within the CAM table, how to configure, verify, and delete them on Cisco IOS and IOS-XE platforms, how they compare to Port Security sticky MACs, how to apply them on data center Cisco Nexus (NX-OS) switches, and how to resolve common forwarding failures.

CAM Table Mechanics: Persistence, Aging Timers, and Flooding Prevention

Understanding how static MAC entries alter the standard forwarding logic of a Cisco switch requires examining how hardware CAM tables manage dynamic addresses, aging timers, and unknown destinations.

                     +---------------------------------------+
                     |        Ingress Ethernet Frame         |
                     +---------------------------------------+
                                         |
                                         v
                     +---------------------------------------+
                     |    Inspect Destination MAC & VLAN     |
                     +---------------------------------------+
                                         |
                    /--------------------\--------------------\
                   /                                           \
                  v                                             v
     +--------------------------+                 +--------------------------+
     | Static Entry in CAM      |                 | Dynamic Entry in CAM     |
     +--------------------------+                 +--------------------------+
     | • Permanent mapping      |                 | • 300-second timer active|
     | • Never ages out         |                 | • Flushed if inactive    |
     | • Immune to port moves   |                 | • Overwritten on move    |
     +--------------------------+                 +--------------------------+
                  \                                             /
                   \--------------------/----------------------/
                                        |
                                        v
                     +---------------------------------------+
                     |  Direct Forwarding to Specified Port  |
                     +---------------------------------------+

1. Dynamic CAM Table Population and the Aging Mechanism

When a host transmits an Ethernet frame, the switch records the source MAC address and ingress port into its CAM table. To prevent the table from filling up with inactive endpoints, Cisco switches apply a dynamic aging timer. The default aging time across Cisco Catalyst switches running IOS and IOS-XE is 300 seconds (5 minutes). If a connected device remains silent for longer than the configured aging interval, the switch purges the MAC entry from the CAM table.

2. Static Persistence Across Sessions and Reboots

A static MAC address entry completely bypasses the aging timer. Once entered into the switch configuration, the entry is flagged as permanent in hardware memory. It will never age out due to inactivity. Furthermore, because static entries are stored in the switch’s running configuration, saving the running configuration to NVRAM (startup-config) ensures that the static binding persists across switch reboots, power outages, and planned reload cycles.

3. Unknown Unicast Flooding Elimination

When a switch receives a frame destined for a host whose MAC address is not present in the CAM table, it falls back to unknown unicast flooding: it replicates and broadcasts the frame out of all ports within the same VLAN except the receiving port. In networks hosting quiet servers or telemetry devices that rarely transmit outbound frames, dynamic CAM entries frequently age out, causing ongoing unicast flooding that degrades bandwidth and poses a packet-sniffing security risk. Defining a static MAC entry guarantees that the destination interface is always known, completely eliminating unicast flooding for that host.

4. Overriding Dynamic Learning and Spoofing Protection

Static MAC entries hold administrative precedence over dynamically learned addresses. If an unauthorized machine connects to an alternate switchport and transmits frames spoofing a statically mapped MAC address, the switch ignores the rogue source frames for forwarding table updates. The CAM table remains anchored to the configured interface, keeping return traffic steered away from the attacker.

Configuring Static MAC Addresses in Cisco IOS and IOS-XE

Configuring a static MAC address on modern Cisco Catalyst switches running Cisco IOS or Cisco IOS-XE requires global configuration mode access.

Step 1: Collect Required Interface and Host Parameters

Before modifying the forwarding table, ensure you have gathered the following exact parameters:
– MAC Address: Must be formatted in Cisco 4-digit dotted hexadecimal notation: aaaa.bbbb.cccc (e.g., 0050.56a1.2b3c).
– VLAN ID: The exact Layer 2 broadcast domain (1 to 4094) through which the endpoint communicates.
– Target Interface: The physical port (e.g., GigabitEthernet1/0/12) or logical EtherChannel (e.g., Port-channel 1) directly attached to the host.

Step 2: Enter Global Configuration Mode

Log in to the switch CLI, elevate privileges, and enter configuration mode:

Switch> enable
Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#

Step 3: Execute the Static MAC Address Command

Apply the static entry by linking the MAC address, the target VLAN, and the outbound interface:

Switch(config)# mac address-table static 0050.56a1.2b3c vlan 10 interface GigabitEthernet 1/0/12

(Note: Older legacy Cisco Catalyst switches running early IOS releases may use the hyphenated variant mac-address-table static 0050.56a1.2b3c vlan 10 interface GigabitEthernet 1/0/12.)

If the target endpoint connects via an aggregated link, specify the Port-Channel interface instead:

Switch(config)# mac address-table static 0050.56a1.2b3c vlan 10 interface Port-channel 5

Step 4: Configure MAC Address Filtering (Drop Action)

Cisco IOS and IOS-XE also support using static MAC entries to discard traffic from blacklisted hardware addresses rather than forward them. To drop all frames matching a specific unicast MAC within a VLAN:

Switch(config)# mac address-table static dead.beef.0001 vlan 10 drop

Frames containing this MAC address as either source or destination will be dropped at ingress by switch hardware.

Step 5: Save the Running Configuration

Ensure the static mapping is committed to NVRAM so it survives reboots:

Switch(config)# exit
Switch# copy running-config startup-config
Destination filename [startup-config]? 
Building configuration...
[OK]

Verifying and Removing Static MAC Table Entries

Once configured, verify that the entry is active in the hardware forwarding table and learn how to remove it when hardware is replaced or re-cabled.

Step 1: Inspect the Static CAM Table Entries

To view all statically configured entries in the switch CAM table, issue:

Switch# show mac address-table static
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    0050.56a1.2b3c    STATIC      Gi1/0/12
  10    dead.beef.0001    STATIC      Drop
Total Mac Addresses for this criterion: 2

To limit the query to a specific VLAN:

Switch# show mac address-table static vlan 10

Step 2: Query a Specific MAC Address

To confirm the operational binding of an individual host:

Switch# show mac address-table address 0050.56a1.2b3c
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    0050.56a1.2b3c    STATIC      Gi1/0/12
Total Mac Addresses for this criterion: 1

Step 3: Validate Interface Operational and VLAN State

A static CAM entry requires an active, matching Layer 2 path to forward frames. Confirm that the port is physically up and that its VLAN assignment matches the static definition:

Switch# show interfaces GigabitEthernet 1/0/12 status

Port      Name               Status       Vlan       Duplex  Speed Type
Gi1/0/12  Server_Primary     connected    10         a-full  a-1000 10/100/1000BaseTX

If the port is configured as a trunk, ensure that the target VLAN is active and allowed across the link:

Switch# show interfaces GigabitEthernet 1/0/12 switchport

Step 4: Deleting a Static MAC Entry

Unlike dynamic MAC addresses—which can be flushed instantly using EXEC commands like clear mac address-table dynamic—static entries can only be deleted through configuration mode:

Switch# configure terminal
Switch(config)# no mac address-table static 0050.56a1.2b3c vlan 10 interface GigabitEthernet 1/0/12
Switch(config)# exit

If you configured a static drop entry, remove it with the corresponding drop syntax:

Switch(config)# no mac address-table static dead.beef.0001 vlan 10 drop

Confirm removal by re-running the verification command, and save the updated configuration:

Switch# show mac address-table address 0050.56a1.2b3c
Switch# copy running-config startup-config

Static MAC Entries vs. Port Security Sticky MAC: Operational Comparison

Administrators frequently debate whether to implement manual static MAC bindings or deploy switchport port security with sticky MAC learning. While both bind MAC addresses to switch ports, their architectural objectives, enforcement points, and administrative workflows differ fundamentally.

When to Choose Static MAC Entries

Choose static MAC entries when your primary objective is forwarding reliability rather than edge security. For example, when connecting network appliances that rarely send traffic upstream (which risks CAM aging), a static MAC entry prevents the switch from flooding packets across every port in the broadcast domain.

When to Choose Port Security Sticky

Choose port security sticky when securing edge switchports against physical tampering. Port security prevents an employee or intruder from disconnecting an authorized workstation and plugging in an unauthorized laptop or rogue wireless access point.

Configuring Static MAC Addresses in Cisco Nexus NX-OS

In enterprise data centers running Cisco Nexus switches (Nexus 3000, 7000, 9000 Series), the underlying operating system is Cisco NX-OS. While the conceptual forwarding behavior matches IOS-XE, NX-OS provides modular syntax, slot/port hardware naming conventions, and specialized flags such as auto-learn.

                     +---------------------------------------+
                     |    Nexus NX-OS Static MAC Options     |
                     +---------------------------------------+
                                         |
                    /--------------------+--------------------\
                   /                                           \
                  v                                             v
     +--------------------------+                 +--------------------------+
     | Standard Static Binding  |                 | Static with [auto-learn] |
     +--------------------------+                 +--------------------------+
     | • Strictly pinned to port|                 | • Pinned by default      |
     | • Moves cause drops      |                 | • Auto-updates if MAC is |
     | • Ideal for bare metal   |                 |   detected on a new port |
     |   and fixed gateways     |                 | • Ideal for VM migration |
     +--------------------------+                 +--------------------------+

1. Architectural Nuances in NX-OS

In Cisco NX-OS:
– Interface names follow modular slot/port designations (e.g., Ethernet 1/10 or breakout notations like Ethernet 1/1/1).
– Static MAC entries can be assigned directly to physical ports, port-channels, or set to drop.
– NX-OS supports the optional auto-learn parameter. When configured, if the host moves to a different port (such as during a virtual machine vMotion event or physical NIC team failover), NX-OS automatically updates the entry to the new interface rather than blackholing frames.

2. Step-by-Step Configuration in NX-OS

Enter configuration mode on the Nexus switch:

nexus-switch# configure terminal
nexus-switch(config)#

Bind a static unicast address to an access or trunk interface:

nexus-switch(config)# mac address-table static 0050.56bb.01a2 vlan 100 interface Ethernet 1/10

To configure a static MAC entry over an EtherChannel / vPC:

nexus-switch(config)# mac address-table static 0050.56bb.01a2 vlan 100 port-channel 10

To enable dynamic migration tracking using the NX-OS auto-learn keyword:

nexus-switch(config)# mac address-table static 0050.56bb.01a2 vlan 100 interface Ethernet 1/10 auto-learn

To configure hardware-level frame dropping for an unauthorized address:

nexus-switch(config)# mac address-table static 0000.dead.beef vlan 100 drop

3. Verification and Deletion on NX-OS

To verify active entries on a Nexus switch:

nexus-switch# show mac address-table static
Legend: 
        * - primary entry, G - Gateway MAC, (R) - Routed MAC, O - Overlay MAC
        age - seconds since last seen,+ - primary entry using vPC Peer-Link
VLAN     MAC Address      Type      age     Secure NTFY Ports
---------+-----------------+--------+---------+------+----+------------------
* 100     0050.56bb.01a2   static   -         F      F    Eth1/10

To delete the static MAC binding:

nexus-switch(config)# no mac address-table static 0050.56bb.01a2 vlan 100 interface Ethernet 1/10

Save the active Nexus configuration to NVRAM:

nexus-switch# copy running-config startup-config

Troubleshooting Static MAC Forwarding Failures

When packets destined for a statically mapped device fail to arrive, use this troubleshooting sequence to identify and correct the underlying fault.

FAQ: Common Static MAC Issues and Solutions

Q: The static entry appears in the CAM table, but the destination device cannot receive frames. What is causing this?

A: This is almost always caused by an operational VLAN mismatch or interface link failure.
1. Check the physical and operational link state with show interfaces <id> status. If the interface is notconnect, down/down, or in an err-disabled state, the switch will discard egress frames despite the static CAM table configuration.
2. Verify VLAN membership using show interfaces <id> switchport. If the static MAC command specifies vlan 20, but the access port is configured for switchport access vlan 10, the switch cannot deliver frames across different broadcast domains.
3. On 802.1Q trunk links, confirm that the static entry’s VLAN is included in the switchport trunk allowed vlan list and is not blocked by Spanning Tree Protocol (STP).

Q: What happens if a server with a static MAC entry is physically relocated to a different switchport?

A: Traffic directed to that server will be blackholed. Because static CAM entries override dynamic address learning, the switch will ignore inbound frames from the server on its new port and will continue sending all outbound frames to the old port. You must explicitly remove the old static command and create a new static binding referencing the updated interface. On Cisco Nexus switches, this issue can be mitigated in advance using the auto-learn flag.

Q: Why is the switch dropping frames immediately after configuring a static MAC command?

A: Check if the command was entered with the drop keyword instead of an interface target. The command mac address-table static <mac> vlan <vlan> drop instructs hardware ASICs to discard all ingress and egress unicast traffic matching that address within the specified VLAN. Review running configuration lines with:

Switch# show running-config | include mac address-table static

Q: Why does static MAC configuration conflict with 802.1X or Port Security?

A: Hardware port security and dynamic network access control (802.1X / MAB) enforce strict MAC-to-port authentication tables. If an interface has switchport port-security active and a static CAM entry points to that same port with an unlisted MAC, the port security ASIC logic will trigger a security violation, incrementing error counters or shutting down the interface (err-disable). Do not combine manual global static MAC forwarding entries on switchports configured for dynamic port security or 802.1X access sessions without matching host authorization policies.

Q: How can I verify if Spanning Tree is blocking traffic to my static MAC address?

A: Run show spanning-tree interface <interface-id> to inspect the port state. If Spanning Tree has placed the port in BLK (blocking) or DIS (discarding) to prevent a network loop, all data frames to and from the static MAC address are dropped at Layer 2.

Cisco Official Command Reference and Documentation Specifications

For formal engineering implementations, auditing, and configuration templates, use the command reference specifications below.

Command Syntax Specification

mac address-table static <mac-address> vlan <vlan-id> {interface <interface-id> | drop}
no mac address-table static <mac-address> vlan <vlan-id> [{interface <interface-id> | drop}]

(NX-OS Additional Syntax):

mac address-table static <mac-address> vlan <vlan-id> {interface <interface-id> | port-channel <number> | drop} [auto-learn]
no mac address-table static <mac-address> vlan <vlan-id>

Parameter Reference

• <mac-address>: The 48-bit Ethernet MAC address. Formatted as three groups of four hexadecimal digits separated by dots (hhhh.hhhh.hhhh). Multicast MAC addresses are permitted only when binding to multiple outbound interfaces; they cannot be used with the drop parameter.
• vlan <vlan-id>: Specifies the VLAN identifier associated with the frame. Range is 1 to 4094.
• interface <interface-id>: Defines the target physical Ethernet interface (e.g., GigabitEthernet1/0/1, TenGigabitEthernet1/0/2, Ethernet1/1) or logical bundle (Port-channel 1).
• drop: Optional filter keyword supported on modern Catalyst and Nexus switches. Discards frames where the source or destination address matches the configured MAC in the designated VLAN.
• auto-learn: (Cisco NX-OS only) Permits the switch to dynamically update its static CAM table if the address is observed ingressing on an alternate port.

Platform Compatibility Matrix

• Cisco Catalyst 9000 Family (9200, 9300, 9400, 9500, 9600): Supported across all Cisco IOS-XE releases (e.g., Bengaluru 17.6, Cupertino 17.9, Dublin 17.12, and later).
• Cisco Catalyst Legacy Family (2960X, 3560X, 3750X, 3850): Supported on Cisco IOS 12.2, 15.0, 15.2, and IOS-XE 3.x/16.x.
• Cisco Nexus Family (3000, 5000, 7000, 9000): Supported on all major releases of Cisco NX-OS (7.x, 9.x, 10.x).
• Cisco Industrial Ethernet (IE 2000, IE 3400, IE 4000): Supported in all Cisco IOS and IOS-XE industrial routing/switching software images.

Official Cisco Documentation Paths

For further details, consult the following official technical documentation:
– Cisco Catalyst 9300 Series Switches System Management Configuration Guide (Layer 2 MAC Address Table Management).
– Cisco IOS-XE Command Reference: Layer 2/3 and Security Commands (mac address-table static).
– Cisco Nexus 9000 Series NX-OS Layer 2 Switching Configuration Guide (“Configuring MAC Address Tables”).

Conclusion

Configuring static MAC addresses on Cisco Catalyst and Nexus switches gives administrators precise, deterministic control over Layer 2 forwarding paths. By permanently binding an address to an interface, you eliminate the delays and network overhead of unknown unicast flooding while ensuring that vital infrastructure components remain reachable without relying on dynamic CAM aging cycles.

However, because static entries override dynamic learning and lack the automated security enforcement of Port Security or 802.1X, they should be deployed deliberately. Maintain disciplined documentation of your static entries, verify interface operational states and VLAN tagging carefully, and remember to negate existing bindings whenever endpoint hardware or cabling changes occur.

Please follow and like us: