04 二层交换机端口安全配置.docx

实验五二层交换机端口安全配置实验目的：Port-security配置及测试背景知识和实验内容：Port-security可以限制每个端口学习MAC地址的数量以此来防止MAC攻击1. 在ED-SW上，启用F0/1端口port-security功能，限制此端口只能学习一个mac地址2. 通过show port-security interface f0/1验证3. 测试，f0/1端口连接一台switch,switch再连接多台PC，分别配置IP地址并ping Core1 IP地址，show interface f0/1，观察端口状态4. 把端口可以学习的mac地址数量改成多个，并重启此端口5. ED-SW启用port-security sticky功能6. 验证，并接入第三台pc测试是否可以通过此端口正常通信实验拓扑：Core1 intvlan 88: 192.168.88.240/24 loopback0: 192.168.100.253/32ED-SW intvlan 88: 192.168.88.243/24PC: 192.168.88.88/24实验步骤：基本配置：所有交换机端口设置成access模式，并划分到vlan88，启用portfastCore1 vlan88 IP：192.168.88.240/24Core1 loopback0 IP: 192.168.100.253/32ED-SW vlan 88 IP: 192.168.88.243/24PC1 IP: 192.168.88.88/24Core1:vlan 88interface range f0/1 - 22switchport access vlan 88switchport mode accessspanning-tree portfastinterface range Fa0/23 - 24 shutdownintvlan 88ip address 192.168.88.240 255.255.255.0no shutdownint loopback 0ip address 192.168.100.253 255.255.255.255ED-SW:vlan 88interface range f0/1 - 24switchport access vlan 88switchport mode accessspanning-tree portfastintvlan 88ip address 192.168.88.243 255.255.255.0no shutdownPC: (如果PC是用Router模拟的，那么可以使用以下命令)no ip routingint fa0/0 no shutdownip address 192.168.88.88 255.255.255.0ip default-gateway 192.168.88.2401. 在ED-SW上，启用F0/1端口port-security功能，限制此端口只能学习一个mac地址ED-SW(config)#int fa0/1ED-SW(config-if)#switchport port-security2. 验证ED-SW#sh port-security interface f0/1Port Security : EnabledPort Status : Secure-shutdownViolation Mode : ShutdownAging Time : 0 minsAging Type : AbsoluteSecureStatic Address Aging : DisabledMaximum MAC Addresses : 1Total MAC Addresses : 0Configured MAC Addresses : 0Sticky MAC Addresses : 0Last Source Address : 0019.d2ca.5576Security Violation Count : 13. 测试，f0/1端口连接一台switch,switch再连接多台PC，分别配置IP地址并ping Core1 IP地址。F0/1学习到多个mac地址会进入err-disabled状态ED-SW#shint f0/1FastEthernet0/1 is down, line protocol is down (err-disabled)4. 要解决此问题，先把端口可以学习的mac地址数量改