第7个模块：最小化园区网的服务丢失数据窃听-2-对抗VLAN攻击 CCNP交换部分中文版 教学课件.ppt

ITAA学习情报组 汤姆一通互联网技术训练中心 /bbs 最小化园区网的服务丢失和数据窃听 对抗VLAN攻击 解释 VLAN Hopping 攻击系统伪装自己的网卡为1个合法的Trunk协商端口（DTP） Trunk链路动态协商 形成Trunk后，攻击设备获得访问所有VLAN的渠道 双层标记VLAN Hopping 双层标记允许一个数据帧转发到另外一个VLAN 减轻 VLAN 跳跃 Switch(config-if)#switchport access vlan vlan-id Statically assigns the ports to specific unused VLAN Switch(config-if)#switchport mode access Configures the ports as access ports and turns off DTP Selects a range of interfaces to configure Switch(config)# interface-range type mod/port-port ACLs类型 配置 VACLs Switch(config)#vlan access-map map_name [seq#] 定义 VLAN access map Switch(config-access-map)# match {ip address {1-199 | 1300-2699 | acl_name} | ipx address {800-999 | acl_name}| mac address acl_name} Configures the match clause in a VLAN access map sequence Switch(config-access-map)#action {drop [log]} | {forward [capture]} | {redirect {type slot/port} | {port-channel channel_id}} Configures the action clause in a VLAN access map sequence Switch(config)#vlan filter map_name vlan_list list Applies the VLAN access map to the specified VLANs 私有 VLANS PVLAN 端口类型 Isolated: Communicate with only promiscuous ports Promiscuous: Communicate with all other ports Community: Communicate with other members of community and all promiscuous ports 配置 PVLANs Switch(config-vlan)#private-vlan [primary | isolated | community] 配置 一个VLAN 为 PVLAN Switch(config-vlan)#private-vlan association {secondary_vlan_list | add svl | remove svl} Associates secondary VLANs with the primary VLAN Switch#show vlan private-vlan type Verifies PVLAN configuration 配置 PVLAN 端口 Switch(config-if)#switchport mode private-vlan {host | promiscuous} Configures an interface as a PVLAN port Switch(config-if)#switchport private-vlan host-association {primary_vlan_ID secondary_vlan_ID Associates an isolated or community port with a PVLAN Switch#show interfaces private-vlan mapping Verifies PVLAN port configuration Switch(config-if)#private-vlan mapping primary_vlan_ID {secondary_vlan_list | add svl | remove svl} Ma