交换机的流量控制和端口安全.docVIP

交换机的流量控制和端口安全 (2009-10-16 ) 四大traffic control: ??? storm-control——用于限制广播/组播/单播流量不超过门限 ?????????????????????????????? 只有storm-control不是switchport语句 ??? switch protect,—— 用于接口隔离，配protect的接口互相隔离 ? ? switch block——用于block unknown unicast/multicast包 ??? switch port-security—— 只允许某个MAC地址的包 ??? storm-control——其实就是流量控制 storm-control {broadcast | multicast | unicast} level {level [level-low] | pps? pps [pps-low]} interface fastethernet0/1?storm-control broadcast level 87 65广播流量大于87%，就关闭接口，低于65%，再开启接口 如果百分比设为0?? ?就是完全禁止广播/组播/单播流量如果百分比设为100?? ?流量无限制 ??? Protected Ports interface fastethernet0/1? switchport protected protected port 和另一个protected port 肯定隔离 常用于接入服务：要求流量只被uplink转出，不转发到SW其他端口，即端口间互相隔离,只和上层连接 ??? switchport block是针对unknown包 interface gigabitethernet0/1?? switchport block multicast?? switchport block unicast unknown? multicastunknownd unicast Switch# show interfaces fastethernet 0/1 switchportProtected: falseUnknown unicast blocked: disabledUnknown multicast blocked: disabled ??? swichport security配置 3550-B(config-if)#switchport mode access enable起用3550-B(config-if)#switchport port-security 最大允许数目The default is 1如果不设VLAN，最大数目就涵盖所有VLAN3550-B(config-if)#switchport port-security maximum value ?静态绑定MAC地址?可以配置多条?如果接口配置的secure MAC address的条数 低于maximum number of secure MAC addresses，剩下的会动态学习3550-B(config-if)#switchport port-security mac-address mac-address 定义MAC地址冲突时的ACTION ? ?? protect—dropped ?? restrict—dropped ??? an SNMP trap is sent,??? a syslog message is logged, ?? shutdown—The interface is error-disabled ??? an SNMP trap is sent,??? a syslog message is logged3550-B(config-if)#switchport port-security violation [protect | restrict | shutdown] 配置aging timer3550-B(config-if)#switchport port-security aging [static] time time type [absolute |? inactivity] ??? Port Security Aging switchport port-security aging {static |? time ... | type {absolute | inactivity}} static static参数使swtchport secure mac-address语句配置的静态条目也