第7个模块：最小化园区网的服务丢失数据窃听1理解交换机的安全问题 ccnp交换部分中文版 教学课件.pptVIP

* Lesson Aim Enter lesson aim here. * Lesson Aim Enter lesson aim here. * Lesson Aim Enter lesson aim here. ITAA学习情报组 汤姆一通互联网技术训练中心 /bbs 最小化园区网的服务丢失和数据窃听 理解交换机的安全问题 交换机安全概览 Rogue Access Points 流氓化网络可能是: 无线接入点 无线网路由器 访问层交换机 Hubs 这些是接入到访问层交换机的典型设备 交换机攻击种类 MAC层攻击 VLAN 攻击 欺骗攻击 攻击交换机设备 MAC 泛洪攻击 端口安全 Port security restricts port access by MAC address. 在交换机上配置 Port Security 启用端口安全 设置MAC地址限制 定义允许的 MAC 地址 定义违反以上MAC地址的动作 Switch(config-if)#switchport port-security [maximum value] violation {protect | restrict | shutdown} Enables port security and specifies the maximum number of MAC addresses that can be supported by this port. 验证 Port Security Switch#show port-security Displays security information for all interfaces Switch#show port-securitySecure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action (Count) (Count) (Count)--------------------------------------------------------------------------- Fa5/1 11 11 0 ShutdownFa5/5 15 5 0 RestrictFa5/11 5 4 0 Protect---------------------------------------------------------------------------Total Addresses in System: 21Max Addresses limit in System: 128 验证 Port Security (Cont.) Switch#show port-security interface type mod/port Displays security information for a specific interface Switch#show port-security interface fastethernet 5/1Port Security: EnabledPort status: SecureUpViolation mode: ShutdownMaximum MAC Addresses: 11Total MAC Addresses: 11Configured MAC Addresses: 3Aging time: 20 minsAging type: InactivitySecureStatic address aging: EnabledSecurity Violation count: 0 验证 Port Security (Cont.) Switch#show port-security address Displays MAC address table security information Switch#show port-security address Secure Mac Address Table----------------------------------------------------------------