交换机配置端口安全

---交换机双工速率端口安全Catalyst交换机默认配置IP地址：0.0.0.0CDP:启动10/100端口：自动协商生成树协议：启用控制台密码：没有端口状态：开启以太网通道：配置配置查看命令端口命名规则Show

running-configShow

spanning-treeShow

vlanShow

ip

interface

brief交换机配置IP地址、子网掩码和默认网关Switch(config)#interface

vlan

1Switch(config-if)#ip

address

ip地址子网掩码Switch(config-if)#no

shutdownSwitch(config)#ip

default-gateway

192.168.1.1Vlan

1

和interface

vlan

1的区别双工模式和速率半双工(CSMA/CD)单向数据流产生冲突率高Hub连接全双工点到点的连接要求两端设备同时配置为全双工避免冲突设置双工模式Catalyst

2950wg_sw_2950(config)#interface

fe0/1wg_sw_2950(config-if)#duplex

{auto

|

full

|

half}Showing

Duplex

OptionsSwitch#show

interfaces

fastethernet0/3FastEthernet0/3

is

up,

line

protocol

is

downHardware

is

Fast

Ethernet,

address

is

0000.0000.0003

(bia

0000.0000.0003)MTU

1500

bytes,

BW

100000

Kbit,

DLY

100

usec,reliability

255/255,

txload

1/255,

rxload

1/255Encapsulation

ARPA,loopback

not

setKeepalive

set

(10

sec)Half-duplex,

10Mb/sinput

flow-control

is

off,

output

flow-control

is

offARP

type:

ARPA,

ARP

Timeout

04:00:00Last

input

never,

output

never,

output

hang

neverLast

clearing

of

"show

interface"

counters

neverQueueing

strategy:

fifoOutput

queue

0/40,

0

drops;

input

queue

0/75,

0

drops5

minute

input

rate

0

bits/sec,

0

packets/sec5

minute

output

rate

0

bits/sec,

0

packets/sec0

packets

input,

0

bytes,

0

no

bufferReceived

0

broadcasts,

0

runts,

0

giants,

0

throttles0

input

errors,

0

CRC,

0

frame,

0

overrun,

0

ignored0

input

packets

with

dribble

condition

detected0

packets

output,

0

bytes,

0

underruns0

output

errors,

0

collisions,

2

interface

resets0

babbles,

0

late

collision,

0

deferred0

lost

carrier,

0

no

carrier0

output

buffer

failures,

0

output

buffers

swapped

out配置PortfastPortfast命令能使端口直接进入转发状态Switch(config-if)spanning-tree

portfast管理MAC地址表Catalyst

2950wg_sw_2950#show

mac-address-tableDynamic

Address

Count:1Secure

Address

Count:0Static

Address

(User-defined)

Count:0System

Self

Address

Count:25Total

MAC

addresses:26Maximum

MAC

addresses:8192Non-static

Address

Table:Destination

AddressAddressTypeVLANDestination

Port0050.0f02.3372Dynamic1FastEthernet0/2设置静态MAC

地址wg_sw_2950(config)#mac-address-table

staticmac_addr

{vlan

vlan_id}

[interface

int1

[int2

...

int15]]Catalyst

2950

only限制静态MAC地址wg_sw_2950#mac-address-table

secure

0003.3333.3333

fa

0/1

vlan

1wg_sw_2950#show

mac-address-tableDynamic

Address

Count:

1Secure

Address

Count:

1Static

Address

(User-defined)

Count:

1System

Self

Address

Count:

25Total

MAC

addresses:

28Maximum

MAC

addresses:

8192Non-static

Address

Table:Destination

Address Address

Type

VLAN Destination

Port0050.0f02.33720003.3333.3333DynamicSecure1

FastEthernet0/21

FastEthernet0/1Static

Address

Table:Destination

Address

VLAN Input

Port Output

Ports2222.2222.2222

1

ALL

Fa0/1wg_sw_2950(config)#mac-address-table

securehw-addr

interface

[vlan

vlan-id]配置Port

SecurityCatalyst

2950wg_sw_2950(config-if)#port

security

max-mac-count

countwg_sw_2950(config)#interface

fa0/1wg_sw_2950(config-if)#port

securitywg_sw_2950(config-if)#port

security

max-mac-count

10在交换机上验证Port

Securitywg_sw_2950#show

mac-address-table

securewg_sw_2950#show

port-securitywg_sw_2950#show

mac-address-table

secureNon-static

Address

Table:Destination

Address Address

Type

VLAN Destination

Port0003.3333.3333

Secure

1

FastEthernet