Cisco以太网LAN-了解交换机安全.ppt

以太网LAN,了解交换机安全,物理安装的常见危胁,硬件威胁环境危胁电气威胁维护威胁,设置交换机口令,配置登录标语,在用户名和口令登录提示符之前，定义和显示自定义标语。,SwitchX#bannerloginAccessforauthorizedusersonly.Pleaseenteryourusernameandpassword.,Telnet访问与SSH访问,Telnet最常见的访问方法不安全SSH加密,!TheusernamecommandcreatetheusernameandpasswordfortheSSHsessionUsernameciscopasswordciscoipdomain-cryptokeygeneratersaipsshversion2linevty04loginlocaltransportinputssh,CiscoCatalyst2960系列,SwitchX(config-if)#switchportport-securitymac-addressmac-address|mac-addressstickymac-address|maximumvalue|violationrestrict|shutdown,SwitchX(config)#interfacefa0/5SwitchX(config-if)#switchportmodeaccessSwitchX(config-if)#switchportport-securitySwitchX(config-if)#switchportport-securitymaximum1SwitchX(config-if)#switchportport-securitymac-addressstickySwitchX(config-if)#switchportport-securityviolationshutdown,配置端口安全,SwitchX#showport-securityinterfaceinterface-idaddress|begin|exclude|includeexpression,SwitchX#showport-securityinterfacefastethernet0/5PortSecurity:EnabledPortStatus:Secure-upViolationMode:ShutdownAgingTime:20minsAgingType:AbsoluteSecureStaticAddressAging:DisabledMaximumMACAddresses:1TotalMACAddresses:1ConfiguredMACAddresses:0StickyMACAddresses:0LastSourceAddress:0000.0000.0000SecurityViolationCount:0,检验Catalyst2960系列交换机的端口安全,SwitchX#shport-securitySecurePortMaxSecureAddrCurrentAddrSecurityViolationSecurityAction(Count)(Count)(Count)-Fa0/5110Shutdown-TotalAddressesinSystem(excludingonemacperport):0MaxAddresseslimitinSystem(excludingonemacperport):1024,SwitchX#shport-securityaddressSecureMacAddressTable-VlanMacAddressTypePortsRemainingAge(mins)-10008.dddd.eeeeSecureConfiguredFa0/5-TotalAddressesinSystem(excludingonemacperport):0MaxAddresseslimitinSystem(excludingonemacperport):1024,检验Catalyst2960系列交换机的端口安全（续）,保护未使用的端口,未受保护的端口存在安全漏洞。插入未使用端口的交换机将加入网络。通过禁用接口（端口）来保护未使用的端口。,禁用接口（端口）,shutdown,SwitchX(config-int)#,禁用某个接口，请在接口配置模式下使用shutdown命令。重新启用已禁用的接口，请使用该命令的no形式。,总结,第一层安全是物理安全。口令的使用将限制