交換機(jī)配置端口安全

---交換機(jī)雙工速率端口安全Catalyst交換機(jī)默認(rèn)配置IP地址：0.0.0.0CDP:啟動10/100端口：自動協(xié)商生成樹協(xié)議：啟用控制臺密碼：沒有端口狀態(tài)：開啟以太網(wǎng)通道：配置配置查看命令端口命名規(guī)則Show

running-configShow

spanning-treeShow

vlanShow

ip

interface

brief交換機(jī)配置IP地址、子網(wǎng)掩碼和默認(rèn)網(wǎng)關(guān)Switch(config)#interface

vlan

1Switch(config-if)#ip

address

ip地址子網(wǎng)掩碼Switch(config-if)#no

shutdownSwitch(config)#ip

default-gateway

192.168.1.1Vlan

1

和interface

vlan

1的區(qū)別雙工模式和速率半雙工(CSMA/CD)單向數(shù)據(jù)流產(chǎn)生沖突率高Hub連接全雙工點到點的連接要求兩端設(shè)備同時配置為全雙工避免沖突設(shè)置雙工模式Catalyst

2950wg_sw_2950(config)#interface

fe0/1wg_sw_2950(config-if)#duplex

{auto

|

full

|

half}Showing

Duplex

OptionsSwitch#show

interfaces

fastethernet0/3FastEthernet0/3

is

up,

line

protocol

is

downHardware

is

Fast

Ethernet,

address

is

0000.0000.0003

(bia

0000.0000.0003)MTU

1500

bytes,

BW

100000

Kbit,

DLY

100

usec,reliability

255/255,

txload

1/255,

rxload

1/255Encapsulation

ARPA,loopback

not

setKeepalive

set

(10

sec)Half-duplex,

10Mb/sinput

flow-control

is

off,

output

flow-control

is

offARP

type:

ARPA,

ARP

Timeout

04:00:00Last

input

never,

output

never,

output

hang

neverLast

clearing

of

"show

interface"

counters

neverQueueing

strategy:

fifoOutput

queue

0/40,

0

drops;

input

queue

0/75,

0

drops5

minute

input

rate

0

bits/sec,

0

packets/sec5

minute

output

rate

0

bits/sec,

0

packets/sec0

packets

input,

0

bytes,

0

no

bufferReceived

0

broadcasts,

0

runts,

0

giants,

0

throttles0

input

errors,

0

CRC,

0

frame,

0

overrun,

0

ignored0

input

packets

with

dribble

condition

detected0

packets

output,

0

bytes,

0

underruns0

output

errors,

0

collisions,

2

interface

resets0

babbles,

0

late

collision,

0

deferred0

lost

carrier,

0

no

carrier0

output

buffer

failures,

0

output

buffers

swapped

out配置PortfastPortfast命令能使端口直接進(jìn)入轉(zhuǎn)發(fā)狀態(tài)Switch(config-if)spanning-tree

portfast管理MAC地址表Catalyst

2950wg_sw_2950#show

mac-address-tableDynamic

Address

Count:1Secure

Address

Count:0Static

Address

(User-defined)

Count:0System

Self

Address

Count:25Total

MAC

addresses:26Maximum

MAC

addresses:8192Non-static

Address

Table:Destination

AddressAddressTypeVLANDestination

Port0050.0f02.3372Dynamic1FastEthernet0/2設(shè)置靜態(tài)MAC

地址wg_sw_2950(config)#mac-address-table

staticmac_addr

{vlan

vlan_id}

[interface

int1

[int2

...

int15]]Catalyst

2950

only限制靜態(tài)MAC地址wg_sw_2950#mac-address-table

secure

0003.3333.3333

fa

0/1

vlan

1wg_sw_2950#show

mac-address-tableDynamic

Address

Count:

1Secure

Address

Count:

1Static

Address

(User-defined)

Count:

1System

Self

Address

Count:

25Total

MAC

addresses:

28Maximum

MAC

addresses:

8192Non-static

Address

Table:Destination

Address Address

Type

VLAN Destination

Port0050.0f02.33720003.3333.3333DynamicSecure1

FastEthernet0/21

FastEthernet0/1Static

Address

Table:Destination

Address

VLAN Input

Port Output

Ports2222.2222.2222

1

ALL

Fa0/1wg_sw_2950(config)#mac-address-table

securehw-addr

interface

[vlan

vlan-id]配置Port

SecurityCatalyst

2950wg_sw_2950(config-if)#port

security

max-mac-count

countwg_sw_2950(config)#interface

fa0/1wg_sw_2950(config-if)#port

securitywg_sw_2950(config-if)#port

security

max-mac-count

10在交換機(jī)上驗證Port

Securitywg_sw_2950#show

mac-address-table

securewg_sw_2950#show

port-securitywg_sw_2950#show

mac-address-table

secureNon-static

Address

Table:Destination

Address Address

Type

VLAN Destination

Port0003.3333.3333

Secure

1

FastEthernet