BCMSN09交换网络性能优化与安全.ppt

OptimizingandSecuringMultilayerSwitchedNetworks,Module9,OptimizingMultilayerSwitchedNetworks,2003,CiscoSystems,Inc.Allrightsreserved.,BCMSNv2.09-2,Objectives,Uponcompletingthislesson,youwillbeableto:DescribetechniquestoenhancetheperformanceofamultilayerswitchednetworkMonitorswitchportsusingSPANandVSPANMonitorswitchportsusingRSPANDescribethefeaturesandoperationofnetworkanalysismodulesonCatalystswitchestoimprovenetworktrafficmanagementVerifyandtroubleshoottheoperationofnetworkanalysismodules,EnhancingNetworkPerformance,Gatherabaseline.Performawhat-ifanalysis.Performexceptionreportingforcapacityissues.Determinethenetworkmanagementoverhead.Analyzethecapacityinformation.Periodicallyreviewcapacityinformation.Haveupgradeortuningproceduressetup.,SwitchedPortAnalyzer,ConfiguringSPAN,Switch(config)#monitorsessionsession_numsourceinterfacetype/num|vlannum,|-|rx|tx|both,ConfiguresaSPANsessiontomonitortraffic,Switch(config)#monitorsessionsession_numberdestinationinterfacetype/num,|-|vlannum,ConfiguresthedestinationforaSPANsession,RemoteSPAN,ConfiguringRSPAN,EntersconfigurationmodeforaspecificVLAN,Switch(config)#vlanvlan-number,EnablesRSPANfortheVLAN,Switch(config-vlan)#remote-span,VerifyingSPANandRSPAN,Switch#showmonitorsessionsession_numberdetail,DisplaysSPANsessioninformation,Switch#showmonitorsession2Session2-Type:RemoteSourceSessionSourcePorts:RXOnly:Fa3/1DestRSPANVLAN:901,Switch#showmonitorsession2detailSession2-Type:RemoteSourceSessionSourcePorts:RXOnly:Fa1/1-3TXOnly:NoneBoth:NoneSourceVLANs:RXOnly:NoneTXOnly:NoneBoth:NoneSourceRSPANVLAN:NoneDestinationPorts:NoneFilterVLANs:NoneDestRSPANVLAN:901,NetworkAnalysisModule,NAMInitialConfiguration,AssignparametersIPaddressSubnetmaskIPbroadcastaddressIPhostnameDefaultgatewayDomainnameDNSnameserverSNMP(MIBvariables,accesscontrol,systemgroupsettings)Startthewebserver,ConfiguringNAM,Switch(config)#interfacegi8/0Switch(config-if)#switchportaccessvlan93Switch(config-if)#endSwitch(config)#monitorsession1destinationinterfacegi8/1rootlocalhost#autostartaddressmapenable,Enablesacollectiontype,Rootlocalhost#autostartcollectionenable,VerifyingNAM,Switch#showmodule,Displaysinformationaboutinstalledmodules,Switch#showmoduleModPortsCardTypeModelSerialNo.-22Catalyst6000supervisor2(Active)WS-X6K-SUP2-2GESAD0410050B34848port10/100mbRJ-45ethernetWS-X6248-RJ-45SAD0308048552NetworkAnalysisModuleWS-X6380-NAMSAD05130AXB72IntrusionDetectionSystemWS-X6381-IDSSAD05100HPT,Switch#showinterfaceGigabitEthernetslot/1|2,DisplaysNAMinterfaceinformation,Summary,Performancemanagementmaintainsinternetworkperformanceatacceptablelevelsbymeasuringandmanagingvariousnetworkperformancevariables.SPANselectsandcopiesnetworktraffictosendtoanetworkanalyzer.RemoteSPANisavariationofSPANthatsendsmonitoredtrafficthroughanintermediateswitchratherthandirectlytothetrafficanalyzer.ANAMusesSNMPRMONinformationtomonitorandanalyzenetworktraffic.UsetheshowcommandstoverifyNAMconfiguration.,SecuringMultilayerSwitchedNetworks,2003,CiscoSystems,Inc.Allrightsreserved.,BCMSNv2.09-15,Objectives,Uponcompletingthislesson,youwillbeableto:ExplainbasicsecurityconceptsforthemultilayerswitchednetworkConfigureauthentication,authorization,andaccountingonCatalystswitchesConfigureportsecurityandport-basedauthenticationwith802.1XVerifythenetworkaccesssecurityconfigurationConfigureVLANaccesslistsVerifytheVLANaccesslistsecurityconfiguration,RecommendedSwitchSecurity,SetsystempasswordsConfigurebasicACLsSecurephysicalaccesstotheconsoleSecureaccesstoVTYsConfiguresystemwarningbannersDisableunneededservicesSSH,TrimCDPDisabletheintegratedHTTPdaemonConfigurebasicloggingSecureSNMPLimittrunkingconnectionsSecurethespanning-treetopology,AAANetworkConfiguration,AuthenticationVerifiesausersidentifyAuthorizationSpecifiesthepermittedtasksfortheuserAccountingProvidesbilling,auditing,andmonitoring,ConfiguringAuthentication,Switch(config)#aaanew-model,EnablesAAAglobally,Switch(config)#aaaauthenticationlogindefault|list-namemethod1method2.,Createsalocalauthenticationlist,Switch(config)#lineaux|console|tty|vtyline-numberending-line-number,Enterslineconfigurationmode,Switch(config-line)#loginauthenticationdefault|list-name,Appliestheauthenticationlisttoaline,ConfiguringAuthorization,Switch(config)#aaaauthorizationauth-proxy|network|exec|commandslevel|reverse-access|configuration|ipmobiledefault|list-namemethod1method2.,Createsanauthorizationmethodlistandenablesauthorization,Switch(config)#interfaceinterface-typeinterface-number,Entersinterfaceconfigurationmode,Switch(config-if)#pppauthorizationdefault|list-name,Appliesthenamedauthorizationmethodlisttotheinterface,ConfiguringAccounting,Switch(config)#aaaaccountingsystem|network|exec|connection|commandsleveldefault|list-namestart-stop|stop-only|nonemethod1method2.,Createsanaccountingmethodlistandenablesaccounting,Switch(config)#interfaceinterface-typeinterface-number,Entersinterfaceconfigurationmode,Switch(config-if)#pppaccountingdefault|list-name,Appliesthenamedaccountingmethodlisttotheinterface,PortsecurityisaMACaddresslockdownthatdisablestheportiftheMACaddressisnotvalid.,NetworkAccessPortSecurity,EnablingPortSecurity,Switch(config-if)#switchportport-securitymaximumvalueviolationprotect|restrict|shutdown,EnablesportsecurityandspecifiesthemaximumnumberofMACaddressesthatcanbesupportedbythisport,802.1XPort-BasedAuthentication,RestrictsunauthorizedclientsfromconnectingtoaLANthroughpubliclyaccessibleports,Configuring802.1XPort-BasedAuthentication,Switch(config)#aaaauthenticationdot1xdefaultmethod1method2.,Createsan802.1Xport-basedauthenticationmethodlist,Switch(config)#dot1xsystem-auth-control,Globallyenables802.1Xport-basedauthentication,Switch(config)#interfacetypeslot/port,Entersinterfaceconfigurationmode,Switch(config-if)#dot1xport-controlauto,Enables802.1Xport-basedauthenticationontheinterface,VerifyingPortSecurity,Switch#showport-security,Displayssecurityinformationforallinterfaces,Switch#showport-securitySecurePortMaxSecureAddrCurrentAddrSecurityViolationSecurityAction(Count)(Count)(Count)-Fa5/111110ShutdownFa5/51550RestrictFa5/11540Protect-TotalAddressesinSystem:21MaxAddresseslimitinSystem:128,VerifyingPortSecurity(Cont.),Switch#showport-securityinterfaceinterfacex/y,Displayssecurityinformationforaspecificinterface,Switch#showport-securityinterfacefastethernet5/1PortSecurity:EnabledPortstatus:SecureUpViolationmode:ShutdownMaximumMACAddresses:11TotalMACAddresses:11ConfiguredMACAddresses:3Agingtime:20minsAgingtype:InactivitySecureStaticaddressaging:EnabledSecurityViolationcount:0,VerifyingPortSecurity(Cont.),Switch#showport-securityaddress,DisplaysMACaddresstablesecurityinformation,Switch#showport-securityaddressSecureMacAddressTable-VlanMacAddressTypePortsRemainingAge(mins)-10001.0001.0001SecureDynamicFa5/115(I)10001.0001.0002SecureDynamicFa5/115(I)10001.0001.1111SecureConfiguredFa5/116(I)10001.0001.1112SecureConfiguredFa5/1-10001.0001.1113SecureConfiguredFa5/1-10005.0005.0001SecureConfiguredFa5/52310005.0005.0002SecureConfiguredFa5/52310005.0005.0003SecureConfiguredFa5/52310011.0011.0001SecureConfiguredFa5/1125(I)10011.0011.0002SecureConfiguredFa5/1125(I)-TotalAddressesinSystem:10MaxAddresseslimitinSystem:128,TypesofACLs,ConfiguringVACLs,Switch(config)#vlanaccess-mapmap_nameseq#,DefinesaVLANaccessmap,Switch(config-access-map)#matchipaddress1-199|1300-2699|acl_name|ipxaddress800-999|acl_name|macaddressacl_name,ConfiguresthematchclauseinaVLANaccessmapsequence,Switch(config-access-map)#actiondroplog|forwardcapture|redirecttypeslot/port|port-channelchannel_id,ConfigurestheactionclauseinaVLANaccessmapsequence,Switch(config)#vlanfiltermap_namevlan_listlist,AppliestheVLANaccessmaptothespecifiedVLANs,CustomerVLANRequirements,ISPcustomersrequireInternetaccessformultipleserversIsolationfromothercustomersCommunicationbetweenserversTraditionalsolution:oneVLANandIPsubnetpercustomerHighresourcerequirementsLimitedscalabilityHighmanagementcomplexity,PrivateVLANs,PVLANPortsandTypes,PrivateVLANports:Promiscuous:CancommunicatewithallotherportsIsolated:CanonlycommunicatewithpromiscuousportsCommunity:CancommunicatewithothermembersofcommunityandallpromiscuousportsPrivateVLANtypes:Primary:UsedbypromiscuousportstocommunicatewithallotherportsintheprivateVLANIsolated:UsedbyisolatedportstocommunicatewithpromiscuousportsCommunity:Usedbycommunityportstocommunicatewitheachotherandpromiscuousports,ConfiguringPrivateVLANs,Switch(config-vlan)#private-vlanprimary|isolated|community,ConfiguresaVLANasaprivateVLAN,Switch(config-vlan)#private-vlanassociationsecondary_vlan_list|addsvl|removesvl,AssociatessecondaryVLANswiththeprimaryVLAN,Switch#showvlanprivate-vlantype,Ver