第7个模块：最小化园区网的服务丢失数据窃听-3-防御欺骗攻击 CCNP交换部分中文版 教学课件.ppt

ITAA学习情报组 汤姆一通互联网技术训练中心 /bbs 最小化园区网的服务丢失和数据窃听 防御欺骗攻击 DHCP欺骗攻击 攻击者启用DHCP服务器 攻击者应答DHCP请求 攻击者将自己作为客户的默认网关 攻击者发起“中间人”攻击 DHCP 侦听 DHCP侦听将端口置于信任或者非信任状态 非信任端口不能处理DHCP应答 在往DHCP服务器方向的上行链路配置DHCP侦听 在客户端端口不配置DHCP侦听 防御DHCP欺骗攻击 Switch(config)#?ip?dhcp?snooping limit rate?[rate] Enables DHCP Option 82 data insertionDHCP relay agent information option Switch(config)#?ip?dhcp?snooping information?option Number of packets per second accepted on a port Enables DHCP snooping globally Switch(config)#?ip?dhcp?snooping Switch(config-if)# ip dhcp snooping?trust Configures a trusted interface Switch(config)#?ip?dhcp?snooping vlan?number?[number] Enables DHCP snooping on your VLANs 验证 DHCP侦听 Verifies the DHCP snooping configuration Switch#?show?ip?dhcp?snooping Switch#?show?ip?dhcp?snooping Switch DHCP snooping is enabled DHCP?Snooping?is?configured?on?the?following?VLANs: ????10?30-40?100?200-220 Insertion?of?option?82?information?is?enabled. Interface???????????Trusted????????Rate?limit?(pps) ---------???????????-------????????---------------- FastEthernet2/1?????yes????????????none FastEthernet2/2?????yes????????????none FastEthernet3/1?????no?????????????20 Switch#? IP source guard is configured on untrusted L2 interfaces IP 源保护 在交换机上配置IP源保护 Enables DHCP snooping on a specific VLAN Switch(config)#?ip?dhcp snooping vlan number [number] Enables DHCP snooping globally Switch(config)#?ip?dhcp?snooping Switch(config-if)# ip verify source vlandhcp-snooping port-security Enables IP Source Guard, source IP, and source MAC address filter on a port ARP 欺骗 DAI 和每个接口捆绑使用，分信任状态和非信任状态 信任接口绕过任何 DAI. 非信任接口经过DAI确认 动态 ARP检测 Switch(config)#ip arp inspection vlan vlan_id[,vlan_id] Enables DAI on a VLAN or range of VLANs Switch(config-if)#ip arp inspection trust Enables DAI on an interface and sets the interface as a trusted interface Switch(config-if)#ip arp inspection validate {[src-mac] [dst-mac] [ip]} Configures DAI to drop ARP packets when the IP addresses are invalid 配置 DAI 防护ARP欺骗 配置防止DHCP攻击者