《计算机网络》实验指导书：交换机端口与MAC地址绑定.doc

海量资料 超值下载交换机端口与MAC地址绑定一、实验目的1. 了解什么是交换机的MAC绑定功能；2. 熟练掌握MAC与端口绑定的静态方式。二、实验描述主要实验内容如下：1交换机IP地址为192.168.1.10/24，PC1的地址为192.168.1.101/24；PC2的地址为192.168.1.102/242. 在交换机上作MAC与端口绑定三、实验拓扑四、实验设备1.S2960 1台2PC 2台3.双绞线 2根五、实验步骤第1步： 配置PC1的地址为192.168.1.101/24，配置PC2的地址为192.168.1.102/24.然后得到PC1的主机的MAC地址PCipconfig /allPhysical Address.: 000A.418B.D76CIP Address.: 192.168.1.101Subnet Mask.: 255.255.255.0Default Gateway.: 0.0.0.0DNS Servers.: 0.0.0.0我们得到了PC1的MAC地址：000A.418B.D76C第2步：配置交换机的IP地址Switch(config)#int vlan 1Switch(config-if)#ip add 192.168.1.10 255.255.255.0Switch(config-if)#no shSwitch(config-if)#exit第3步：使用端口的MAC地址绑定功能Switch(config)#int f0/1Switch(config-if)#switchport mode accessSwitch(config-if)#switchport port-security第4步：添加端口静态安全MAC地址，缺省端口最大安全地址数为1Switch(config-if)#switchport port-security mac-address 000A.418B.D76C验证配置：Switch#sh port-security address Secure Mac Address Table-VlanMac AddressTypePortsRemaining Age(mins)-1000A.418B.D76CSecureConfiguredFastEthernet0/1-Total Addresses in System (excluding one mac per port) : 0Max Addresses limit in System (excluding one mac per port) : 1024第5步：使用PING命令验证在PC1上ping 192.168.1.10能通PCping 192.168.1.10Pinging 192.168.1.10 with 32 bytes of data:Reply from 192.168.1.10: bytes=32 time=32ms TTL=255Reply from 192.168.1.10: bytes=32 time=31ms TTL=255Reply from 192.168.1.10: bytes=32 time=32ms TTL=255Reply from 192.168.1.10: bytes=32 time=32ms TTL=255Ping statistics for 192.168.1.10: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds: Minimum = 31ms, Maximum = 32ms, Average = 31ms先拔掉PC1到f0/1的连线，再把PC2接到F0/1验证配置，ping交换机的IP地址（不通因为设置了PC1到F0/1的绑定）PCping 192.168.1.10Pinging 192.168.1.10 with 32 bytes of data:Request timed out.Request timed out.Request timed out.Request timed out.Ping statistics for 192.168.1.10: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),第6步：在一个口上绑定多个MACSwitch(config)#int f0/1Switch(config-if)#switchport port-security maximum 2Switch(config-if)#switchport port-security mac-address 00D0.58BC.29D2验证配置：Switch#sh port-security address Secure Mac Address Table-VlanMac AddressTypePortsRemaining Age(mins)-1000A.418B.D76CSecureConfiguredFastEthernet0/1-100D0.58BC.29D2SecureConfiguredFastEthernet0/1-Total Addresses in System (excluding one mac per port) : 1Max Addresses limit in System (excluding one mac per port) : 1024第7步：使用PING命令验证先拔掉PC1到f0/1的连线，再把PC2接到F0/1验证配置：此进PC2也能PING通交换机（因为F0/1接口上也同时绑定了PC2的MAC地址）PCping 192.168.1.10Pinging 192.168.1.10 with 32 bytes of data:Reply from 192.168.1.10: bytes=32 time=46ms TTL=255Reply from 192.168.1.10: bytes=32 time=31ms TTL=255Reply from 192.168.1.10: bytes=32 time=31ms TTL=255Reply from 192.168.1.10: bytes=32 time=31ms TTL=255Ping statistics for 192.168.1.10: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds:Minimum = 31ms, Maximum = 46ms, Average = 34ms六、注意事项如果出现端口无法配置MAC地址绑定功能的情况，请检查交换机的端口是否运行了生成树协议、802.1X、端口汇聚或端口已经配置为TRUNK端口，MAC绑定与这些配置是互斥的，所以在执行端口绑定前一定要先关闭端口下的上述功能。七、参考配置Switch#sh runBuilding configuration.Current configuration : 1131 bytes!version 12.2no service password-encryption!hostname Switch!interface FastEthernet0/1 switchport mode access switchport port-security switchport port-security maximum 2 switchport port-security mac-address 000A.418B.D76C switchport port-security mac-address 00D0.58BC.29D2!interface FastEthernet0/2!interface FastEthernet0/3!interface FastEthernet0/4!interface FastEthernet0/5!interface FastEthernet0/6!interface FastEthernet0/7!interface FastEthernet0/8!interface FastEthernet0/9!interface FastEthernet0/10!interface FastEthernet0/11!interface FastEthernet0/12!interface FastEthernet0/13!interface FastEthernet0/14!interface FastEthernet0/15!interface FastEthernet0/16!interface FastEthernet0/17!interface FastEthernet0/18!interface FastEthernet0/19!interface FastEthernet0/20!interface FastEthernet0/21!interface FastEthernet0/22!interface Fas