CCNA認(rèn)證：交換機(jī)配置和端口安全
作者：曉兵
從基本原理上講，Port Security特性記住的是連接到交換機(jī)端口的以太網(wǎng)MAC地址即網(wǎng)卡號(hào)，并只答應(yīng)某個(gè)MAC地址通過(guò)本端口通信。假如任何其它MAC地址試圖通過(guò)此端口通信，端口安全特性會(huì)阻止它。使用端口安全特性可以防止某些設(shè)備訪問(wèn)網(wǎng)絡(luò)，并增強(qiáng)安全性。
交換機(jī)配置實(shí)例拓?fù)鋱D如下：
交換機(jī)基本配置
- Switch> enable Switch# config ter
- Switch(config)# hostname Switch Switch(config)# interface vlan 1
- Switch(config-if)# ip address 192.168.1.10 255.255.255.0 Switch(config-if)# no shutdown
- Switch(config-if)# exit Switch(config)# ip default-gateway 192.168.1.1
- Switch(config)# end Switch#show int vlan 1
- Vlan1 is administratively down, line protocol is down Hardware is CPU Interface, address is 0001.9719.ab57 (bia 0001.9719.ab57)
- Internet address is 192.168.1.10/24 MTU 1500 bytes, BW 100000 Kbit, DLY 1000000 usec,
- reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set
- ARP type: ARPA, ARP Timeout 04:00:00 Last input 21:40:21, output never, output hang never
- Last clearing of “show interface” counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
- Queueing strategy: fifo Output queue: 0/40 (size/max)
- 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec
- 1682 packets input, 530955 bytes, 0 no buffer Received 0 broadcasts (0 IP multicast)
- 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
- 563859 packets output, 0 bytes, 0 underruns 0 output errors, 23 interface resets
- 0 output buffer failures, 0 output buffers swapped out Switch#
配置各臺(tái)PC 的設(shè)置
- a) PC1 IP ADDRESS：192.168.1.100
- SUBMASK: 255.255.255.0 DEFAULT-GATEWAY: 192.168.1.1
- b) PC2 IP ADDRESS：192.168.1.101
- SUBMASK: 255.255.255.0 DEFAULT-GATEWAY: 192.168.1.1
- c) PC3 IP ADDRESS：192.168.1.102
- SUBMASK: 255.255.255.0 DEFAULT-GATEWAY: 192.168.1.1
驗(yàn)證
- d) PC1
- ping 192.168.1.101
- ping 192.168.1.102
能通
- e) PC2
- ping 192.168.1.100
- ping 192.168.1.102
能通
查看交換機(jī)動(dòng)態(tài)學(xué)習(xí)到的MAC 表
因?yàn)槲覀兺ㄟ^(guò)ping 命令互相訪問(wèn)，交換機(jī)會(huì)動(dòng)態(tài)學(xué)習(xí)到各個(gè)PC 的MAC 地址!
- Switch#show mac-address-table Mac Address Table
- ——————————————-
- Vlan Mac Address Type Ports —- ———– ——– —–
- 1 0001.4246.a36c DYNAMIC Fa0/3
- 1 0009.7c35.7001 DYNAMIC Fa0/24 1 00d0.58b6.24da DYNAMIC Fa0/2
- 1 00d0.bc37.3d6b DYNAMIC Fa0/1
現(xiàn)在配置交換機(jī)的F0/1 接口只允許PC0 的接入，其它PC 非法接入該接口會(huì)關(guān)閉無(wú)法使。
- Switch# config term Switch(config)# interface f0/1
- Switch(config-if)# switchport mode access //將接口設(shè)置為訪問(wèn)接口 Switch(config-if)# switchport port-security //在該接口上啟動(dòng)端口安全
- Switch(config-if)# switchport port-security mac 00d0.58b6.24da //將PC0 的MAC 地址和該接口綁定，該MAC 地址可以通過(guò)第三步查看到
- Switch(config-if)# switchport port-security maximum 1 //因?yàn)槲覀冎辉试SPC0 訪問(wèn)，這里將訪問(wèn)量設(shè)置為1
- Switch(config-if)# switchport port-security violation shutdown //將非法用戶接入后的動(dòng)作為關(guān)閉接口
驗(yàn)證：
- Switch# show port-security interface f0/1 Port Security : Enabled
- Port Status : Secure-up Violation Mode : Shutdown
- Aging Time : 0 mins Aging Type : Absolute
- SecureStatic Address Aging : Disabled Maximum MAC Addresses : 1
- Total MAC Addresses : 1 Configured MAC Addresses : 1
- Sticky MAC Addresses : 0 Last Source Address:Vlan : 00D0.58B6.24DA:1
- Security Violation Count : 0
#p#
測(cè)試端口安全
a) PC1
ping 192.168.1.101
能PING 通
b) 重新配置新的PC，IP 地址配置為192.168.1.103，子網(wǎng)掩碼為255.255.255.0，將原PC0 從交換機(jī)的f0/1 口移出，將新的PC 接入到交換機(jī)的F0/1 口（如下）
c) PC4 中
Ping 192.168.1.101
d) 結(jié)果發(fā)現(xiàn)交換機(jī)出現(xiàn)如下提示：
- %LINK-5-CHANGED: Interface FastEthernet0/1, changed state to administratively down %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state todown
因?yàn)榻粨Q機(jī)的F0/1 口配置了端口安全，只允許MAC 為00d0.58b6.24da 訪問(wèn)該接口，新的PC 機(jī)的MAC 地址不符合條件，交換機(jī)就會(huì)按照配置將該接口shutdown。
e) PC4 中再次訪問(wèn)PC1 和PC2 都無(wú)法正常訪問(wèn)
- Switch#Ping 192.168.1.101 Pinging 192.168.1.101 with 32 bytes of data:
- Request timed out. Request timed out.
- Request timed out. Request timed out.
- Ping statistics for 192.168.1.101: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)
f) 交換機(jī)中驗(yàn)證：
- Switch# show port-security interface F0/1 Port Security : Enabled
- Port Status : Secure-shutdown Violation Mode : Shutdown
- Aging Time : 0 mins Aging Type : Absolute
- SecureStatic Address Aging : Disabled Maximum MAC Addresses : 1
- Total MAC Addresses : 1 Configured MAC Addresses : 1
- Sticky MAC Addresses : 0 Last Source Address:Vlan : 00E0.F961.D8C7:1
- Security Violation Count : 1 //安全動(dòng)作統(tǒng)計(jì)為1
配置交換機(jī)的靜態(tài)MAC
a) 配置靜態(tài)綁定
- Switch# config termi Switch(config)# mac-address-table static 0001.4246.a36c vlan 1 interface f0/2 //將MAC 地址為0001.4246.a36c 靜態(tài)綁定到vlan1 中的接口F0/2
- SW1# show mac Mac Address Table
- ——————————————- Vlan Mac Address Type Ports
- —- ———– ——– —– 1 0001.4246.a36c STATIC Fa0/2
b) 靜態(tài)指定的MAC 地址，交換機(jī)重新啟動(dòng)后不會(huì)從MAC 表中丟失，動(dòng)態(tài)學(xué)習(xí)到MAC地址交換機(jī)重新啟動(dòng)后會(huì)丟失將交換機(jī)重新啟動(dòng)驗(yàn)證靜態(tài)綁定MAC
- SW1# write Destination filename [startup-config]?
- Building configuration… [OK]
- SW1# reload
c) 啟動(dòng)后，查看交換機(jī)的MAC 地址表
- SW1# show mac Mac Address Table
- ——————————————- Vlan Mac Address Type Ports
- —- ———– ——– —– 1 0001.4246.a36c STATIC Fa0/2
- 1 00d0.58b6.24da STATIC Fa0/1
交換機(jī)是組網(wǎng)設(shè)備中關(guān)鍵角色之一，所以它的配置是非常關(guān)鍵的，本文意在讓初學(xué)者能夠掌握基本的交換機(jī)配置方法，在CCNA認(rèn)證時(shí)也是至關(guān)重要的。
責(zé)任編輯：佚名
來(lái)源：
咦哇噢博客
