2层安全技术合集.pdfVIP

Layer 2 Security Features on Cisco Catalyst Layer 3 Fixed Configuration Switches Configuration Example Document ID: 72846 Contents Introduction Prerequisites Requirements Components Used Related Products Conventions Background Information Configure Network Diagram Port Security DHCP Snooping Dynamic ARP Inspection IP Source Guard Verify Troubleshoot Related Information Introduction This document provides a sample configuration for some of the Layer 2 security features, such as port security, DHCP snooping, dynamic Address Resolution Protocol (ARP) inspection and IP source guard, that can be implemented on Cisco Catalyst Layer 3 fixed configuration switches. Prerequisites Requirements There are no specific requirements for this document. Components Used The information in this document is based on the Cisco Catalyst 3750 Series Switch with version 12.2(25)SEC2. The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command. Related Products This configuration can also be used with these hardwares: • Cisco Catalyst 3550 Series Switches • Cisco Catalyst 3560 Series Switches • Cisco Catalyst 3560−E Series Switches • Cisco Catalyst 3750−E Series Switches Conventions Refer to Cisco Technical Tips Conventions for more information on document conventions. Background Information Similar to routers, both Layer 2 and Layer 3 switches have their own sets of network security requirements. Switches are susceptible to many of the same Layer 3 attacks as routers. However, switches and Layer 2 of the OSI reference model in general, are subject to network attacks in different ways. These include: • Content Addressable Memory (CAM) Table Overflow Conten