How to Reduce the Number of MAC Entries on the Firewall
457
Created On 07/29/25 20:38 PM - Last Modified 08/04/25 19:03 PM
Objective
- Check the maximum number of MAC Entries supported by the Firewall.
- Reduce the MAC Entries of the Firewall.
Environment
- NGFW
- MAC entries
Procedure
- Check the maximum capacity of MAC entries for your Firewall.
- Go to the Product Selection web page. Click Show More under your firewall platform name. Find the MAC table size per device.
- For VM-Flex Firewall running a version lower than 10.2.x, refer to Maximum Limits Based on Memory. For versions 10.2.x and higher, refer to Maximum Limits Based on Tier and Memory. Note that the memory size (memory profile) determines the capacity of the firewall. Check the memory profile "vm-cap-tier:" in the output of the FW CLI command:
> show system info - Alternatively, use one of the following CLI commands and read the numerical value in the line "maximum of entries supported":
> show mac all | match max
- Analyze network traffic to determine why the MAC address table is filling up. Check if this is due to a large number of unique devices or a potential MAC flooding attack.
- If caused by many unique devices, optimize the network topology by reducing unnecessary Layer 2 segments or aggregating devices behind switches or routers.
- If caused by an attack, implement mitigation measures on the upstream device (eg, switch), such as port security and VLAN segmentation. Consult with the upstream device vendor to learn more details on how to mitigate the MAC flood attack.
- To temporarily free up space for new entries, you can clear specific VLAN MAC information using the following CLI command:
Note: Clearing the entire MAC table (clear mac all) may temporarily disrupt all existing connections as MAC addresses are re-learned.> clear mac <dot1q-vlan> - If even after following the recommendation listed above, you are unable to reduce the number of MAC entries below the capacity limit of the FW, then:
- For a hardware firewall, consider upgrading your firewall to a higher-capacity platform.
- For a VM-Flex FW if it's running a version lower than 10.2.0, consider upgrading to a version greater than 10.2.0 to take advantage of the increased configuration capacity offered by the Memory Scaling of the VM-Series Firewall Feature. Also, consider increasing the FW memory/RAM to increase the capacity of your VM-Flex FW.