When enabled, additional checks are performed during evaluation of MAC address-based policies to ensure that they are only applied to ports on which only a single MAC address has been learned or where the MAC that is matched by the policy represents the directly connected device. When disabled, MAC address-based policies are more freely applied to any port on which there exists MAC address data matching policy criteria.