How it Works

MAC Notification traps trigger under the following conditions:

Add - Device generates traffic for the first time

Remove - MAC is removed from the address table. The time it takes for this to occur depends upon how the device is connected.

• Directly connected devices: MAC entry is removed immediately

• Devices behind an IP Phone, non-managed switch or hub: MAC entry must age out of the switch's MAC address table. This is based on the age time configured within the switch (typically minutes).

Change - device whose MAC is already learned on a port moves and connects to another port and generates traffic

Events logged in FortiNAC can be used to verify whether or not MAC Notification traps are being processed.

Each connection point must be configured to generate MAC Notification traps when a MAC address is added or removed from the network. This is done through the switch CLI interface. The coldStart and warmStart traps are not affected by this configuration change.