交换机的端口安全

交换机的端口安全一实验题目交换机的端口安全二实验目的掌握交换机的端口安全功能，控制用户的安全接入三实验拓扑PCPC四实验设备1交换机一台2PC机一台五实验原理交换机端口安全功能是指对交换机的端口进行安全属性的配置，从而控制用户的安全接入。交换机端口安全主要有两种类型：一是限制交换机端口的最大连接数；二是针对交换机端口进行MAC地址，IP地址的绑定。限制交换机端口的最大连接数可以控制交换机端口下连的主机数，并防止用户进行恶意的ARP欺骗。交换机端口的地址绑定，可以针对IP地址，MAC地址，IP+MAC进行灵活的绑定。。可以实现对用户进行严格的控制。保证用户的安全接入和防止常见的内网的网络攻击。如ARP欺骗，IP，MAC地址欺骗，IP地址攻击等。配置交换机的安全功能后，当实际应用超出配置要求时，将产生一个安全违例，产生安全违例的方式有以下三种：Protect当安全地址个数满后，安全端口将丢弃未知名地址的包Restrict当违例产生时，将发送一个Trap通知。Shutdown当违例产生时，将关闭端口并发送一个Trap通知。当端口因为违例而被关闭后，在全局配置模式下使用命令errdisablerecovery来将接口从错误状态中恢复出来六实验步骤1配置交换机端口的最大连接数限制，步骤如下:将交换机名称改为：L2-SWSW-l>enBblePasstJQrdiSW-INccnftErit&rconfiquratioi'tccnMards.on&oerliive.EndwithCMTL/Z.SM-1(corifiQjnli^tnaNiAI.2-SW进行一组端口的配置模式开启交换机的端口安全功能配置端口的最大连接数为1以上三个步骤如下：L2-SW(config)flinterfacerangef00/1-23_2-SU(confl(j-if-range)t4switchportport-security_2-SU(config-if-rangejttswitchportport-securitymaximum1n ■ami•配置安全违例的处理方式为shutdown：L2-SW(Config-if-range)Hswiichportport=^ecurityviolationshutdownI。 £2m1£——.i 2X2验证查看交换机的端口安全配置;

L2-$HNEbwportsecuritySecureI'ortyfk：1innMaHSccurdldclr(Couini]CurrentAddr(CountJMsKlPSecureFHdr(Connt}CurrentlPllddr(Conn1]Securitrae/i1e1260ShutdmflaC/2IQ126QShutdow「日0/311128CSlwtdowIMVA10I2BeShufdowF成花11128cShiddowIM/6[0128aShutdonFri0/71G128(3ShuldowFaQ/S101289ShutdowFafi/9101280ShuIdou肯0/10101230ShuidowFaB/H101280ShuId。妙FaS/1210128可ShutdowFaG/1910128DShutdowra0/14101230ShutdowFaG/15101280ShutdoHrfle/i6101260Shutduwl-afi/l?1n123Shuidovjrfl071310123gShutdowFa0/19101280ShutdowFae/201Q1?8qShutdowFae/21101280ShuIdovjla0/22101280ShuidowFde/23101280ShutdownTotalSecurerddressasinMaxSecureAddressesliniSystem:2IinSystem:3928L.2-SWttshowport-securityinterfacefa0/linterface:Fa^tE+h^rnet"1PortS&curiiy:Endbl^dPortE-tatus:doiAinUiolatiorimode:ShuIdounNaxiMunMACAddresses:1TotalMACAddresses:0ConfiguredBindingHddresses:ftConfiguredMACRddressesz(JAgingtime:0rainsSecure-Staticaddressaging:Disabled

3配置交换机端口的MAC与IP地址绑定:在主机上打开cmd命令提示符并执行ipconfig/all命令，目的是查看物理地址和IP地址。thfirnetadAptnr本tfe连:接CoinnectianifthfirnetadAptnr本tfe连:接CoinnectianificDNSSuffixDescriptlorHHPhywical.rtddi-cssDhcpEnabled..IPAddx^ss...SmbnetHMN..DefaulttiatewauHostMainePrinarirDnsSufFisNedeT^rpe»B..IPRoutin^EnabledWINSFr^xyEnabledUnlcnovn192.168.10,1配置IP地址和MAC地址的绑定:L2-SWHconfIEnterconfiyurdlioncanndnds,oneperline.EndwiillCNTL/Z.L2-SW[config)Hinterfacefafl/3L2-SH(config-if-FastEthernet0/3)lsuitchportport-securityL2；SW(config-if-FasiEthernet0/9)l*R9-12-flA-87ip-address192.16810.1iwiluhpurIpur{aecur-ityncmciddres3464H912RH8iip 192.16B.10.1 "ViInvalidinputdetectedatmarker.L2-SW(config-ifFasiEthernei0/3)Hess3464.H912.HRS7ipaddress192.168.10,1L2-SWtconfwif-Tas+Etherne^R/3)#e>iitL2-SW(config)Hexit，K~4查看查看地址安全绑定配置L2-SWBshownort-sfecurItyaddressal]UlanFortArp-ChockHacftdclrossIPOddrossTypeRetidiningOye1FdO/3Contiaiirndi rO1FdO/3Contiaiirndi rO0/3Hynairic1 Fa0/5DyndiiicDisdLledDisablsdDisabled0t64.d912.dd8?192.158.10.19464.o912.ae875配置交换机端口的IP地址绑定L2-SWHconftEn+erconfifljraiionconmeinds,oneporline.FndwithCNTII/7L2-SW(config)lti.nterfacefafl/5L2-SW[config-ir-FasiElhernei0/5securityip-address192.166.20.1查看:L2-SWttshowport-securityaddressallUlanPortTypeFlrp-ChcckRemainilngAje(nins)MacHddressIPAddress1 「03Disabled3A64.a912aa»7192.168.10.1Configured1 Fa0/3DvrianicFa0/5Configured1「M/SDs/ndnicDisabledDisabledDi$土led3464.a912.aa873464.fl912aa95192168.201Ruiiie>RtJlRmjiesenhleIrjrslaling"enble~__.SUrrecogniEedhrraloraddress.□「prolpcclrw