1、【實訓名稱】交換機的端口安全配置【實訓目的】掌握交換機的端口安全功能，控制用戶的安全接入【背景描述】你是一個公司的網(wǎng)絡管理員，公司要求對網(wǎng)絡進行嚴格控制。為了防止公司內(nèi)部用戶的IP地址沖突，防止公司內(nèi)部的網(wǎng)絡攻擊和破壞行為。為每一位員工分配了固定的IP地址，并且限制只允許公司員工主機可以使用網(wǎng)絡，不得隨意連接其他主機。例如：某員工分配的IP地址是172.16.1.55/24，主機MAC地址是00-06-1B-DE-13-B4，該主機連接在1臺2126G上邊?！拘枨蠓治觥酷槍粨Q機的所有端口，配置最大連接數(shù)為1,針對PC1主機的接口進行IP+MAC地址綁定?！緦嵱柾負洹繄D10-實1訓拓撲圖【預備

2、知識】路由器基本配置知識、端口安全知識【實訓設備】交換機1臺PC1臺直連網(wǎng)線1條【實訓原理】交換機端口安全功能，是指針對交換機的端口進行安全屬性的配置，從而控制用戶的安全接入。交換機端口安全主要有兩種類項：一是限制交換機端口的最大連接數(shù)，二是針對交換機端口進行MAC地址、IP地址的綁定。限制交換機端口的最大連接數(shù)可以控制交換機端口下連的主機數(shù)，并防止用戶進行惡意的ARP欺騙。交換機端口的地址綁定，可以針對IP地址、MAC地址、IP+MAC進行靈活的綁定?？梢詫崿F(xiàn)對用戶進行嚴格的控制。保證用戶的安全接入和防止常見的內(nèi)網(wǎng)的網(wǎng)絡攻擊。如ARP欺騙、IP、MAC地址欺騙，IP地址攻擊等。配置了交換機的

3、端口安全功能后，當實際應用超出配置的要求，將產(chǎn)生一個安全違例，產(chǎn)生安全違例的處理方式有3種：protect當安全地址個數(shù)滿后，安全端口將丟棄未知名地址(不是該端口的安全地址中的任何一個)的包。restrict當違例產(chǎn)生時，將發(fā)送一個Trap通知。shutdown當違例產(chǎn)生時，將關閉端口并發(fā)送一個Trap通知。電當端口因為違例而被關閉后，在全局配置模式下使用命令errdisablerecovery來將接口從錯誤狀態(tài)中恢復過來?！緦嵱柌襟E】第一步：配置交換機端口的最大連接數(shù)限制S3750#configureterminalS3750(config)#interfacerangefastethern

4、et0/1-23S3750(config-if-range)#switchportport-securityS3750(config-if-range)#switchportport-secruitymaximum1S3750(config-if-range)#switchportport-secruityviolationshutdown第二步：驗證交換機端口的最大連接數(shù)限制S3750#shport-securitySecurePortMaxSecureAddr(count)CurrentAddr(count)SecurityActionFastEthernet0/110ShutdownFa

5、stEthernet0/210ShutdownFastEthernet0/310ShutdownFastEthernet0/410ShutdownFastEthernet0/510ShutdownFastEthernet0/610ShutdownFastEthernet0/710ShutdownFastEthernet0/810ShutdownFastEthernet0/910ShutdownFastEthernet0/1010ShutdownFastEthernet0/1110ShutdownFastEthernet0/1210ShutdownFastEthernet0/1310Shutdo

6、wnFastEthernet0/1410ShutdownFastEthernet0/1510ShutdownFastEthernet0/1610ShutdownFastEthernet0/1710ShutdownFastEthernet0/1810ShutdownFastEthernet0/1910ShutdownFastEthernet0/2010ShutdownFastEthernet0/2110ShutdownFastEthernet0/2210ShutdownFastEthernet0/2310ShutdownS3750#showport-securityinterfacefastEt

7、hernet0/1Interface:FastEthernet0/1PortSecurity:EnabledPortstatus:upViolationmode:ShutdownMaximumMACAddresses:1TotalMACAddresses:0ConfiguredMACAddresses:0Agingtime:0minsSecureStaticaddressaging:Disabled第三步：配置交換機端口的MAC與IP地址綁定查看主機的IP和MAC地址信息在主機上打開CMD命令提示符窗口，執(zhí)行ipconfig/all命令配置交換機端口的地址綁定S3750#configurete

8、rminalS3750(config)#interfacefastethernet0/3S3750(config-if)#switchportport-securityS3750(config-if)#switchportport-securitymac-address0006.1bde.13b4ip-address172.16.1.55第四步：查看地址安全綁定配置S3750#shport-securityaddressallVlanPortArp-CheckMacAddressIPAddressTypeRemainingAge(mins)1FastEthernet0/3Disabled000

9、6.1bde.13b4172.16.1.55Configured-S3750#shport-securityaddressinterfacefa0/3VlanMacAddressIPAddressTypePortRemainingAge(mins)10006.1bde.13b4172.16.1.55ConfiguredFastEthernet0/3-第五步：配置交換機端口的IP地址綁定S3750(config)#intfastEthernet0/2S3750(config-if)#switchportport-securityip-address10.1.1.1S3750#showport-s

10、ecurityaddressallVlanPortArp-CheckMacAddressIPAddressTypeRemainingAge(mins)1FastEthernet0/2Disabled10.1.1.1Configured-1FastEthernet0/3Disabled0006.1bde.13b4172.16.1.55Configured-【注意事項】1、交換機端口安全功能只能在ACCESS接口進行配置。2、交換機最大連接數(shù)限制取值范圍是1128，默認是128。3、交換機最大連接數(shù)限制默認的處理方式是protect?！緟⒖寂渲谩縎3750#shrunning-configBuil

11、dingconfiguration.Currentconfiguration:3759bytes!versionRGNOS10.1.00(4),Release(18443)(TueJul1719:51:54CST2007-ubu6server)!vlan1!interfaceFastEthernet0/1switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceFastEthernet0/2switchportport-securityip-ad

12、dress10.1.1.1switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-securityinterfaceFastEthernet0/3switchportport-securitymac-address0006.1bde.13b4ip-address172.16.1.55switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!inter

13、faceFastEthernet0/4switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceFastEthernet0/5switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceFastEthernet0/6switchportport-securitymaximum1switchportpo

14、rt-securityviolationshutdownswitchportport-security!interfaceFastEthernet0/7switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceFastEthernet0/8switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceF

15、astEthernet0/9switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceFastEthernet0/10switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceFastEthernet0/11switchportport-securitymaximum1switchportport-

16、securityviolationshutdownswitchportport-security!interfaceFastEthernet0/12switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-securityinterfaceFastEthernet0/13switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceFas

17、tEthernet0/14switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceFastEthernet0/15switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceFastEthernet0/16switchportport-securitymaximum1switchportport-s

18、ecurityviolationshutdownswitchportport-security!interfaceFastEthernet0/17switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceFastEthernet0/18switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceFastEthernet0/19switchportport-securitymaximum1switchportport-securityviolationshutdownswitchportport-security!interfaceFastEthernet0/20switchpo