This object enables or disables user-side MAC address movement, only activated when both zxAnMasEnable and zxAnMasUplinkProtectEnable are enabled; when enabled, a MAC can move between user ports but not from an uplink port to a user port, and this is noted as C3XX-only, defaulting to disabled. Admins enable this in deployments where legitimate MAC addresses (such as a device changing ports) need to move freely among user-facing ports while still being blocked from an uplink-to-user-port move that could indicate spoofing. For example, an admin whose users occasionally move devices between access ports would enable this so those legitimate moves aren't blocked as spoofing.