交换机安全配置: Difference between revisions
Created page with "=== 端口安全 === <syntaxhighlight> Switch>enable Switch#configure terminal Switch(config)#interface fastethernet 0/1 Switch(config-if)#switchport mode access Switch(co..." |
No edit summary |
||
| Line 1: | Line 1: | ||
=== 端口安全 === | <br /> | ||
===端口安全=== | |||
<syntaxhighlight> | <syntaxhighlight> | ||
Switch>enable | Switch>enable | ||
| Line 20: | Line 21: | ||
#errdisable recovery interval 30 #(30s) | #errdisable recovery interval 30 #(30s) | ||
</syntaxhighlight>也可手动 shutdown / no shutdown 开启端口 | </syntaxhighlight>也可手动 shutdown / no shutdown 开启端口 | ||
| Line 31: | Line 33: | ||
</syntaxhighlight><br /> | </syntaxhighlight><br /> | ||
=== DHCP安全 === | ===DHCP安全=== | ||
开启dhcp snooping 只在接入层交换机开启<syntaxhighlight> | 开启dhcp snooping 只在接入层交换机开启<syntaxhighlight> | ||
ip dhcp snooping | ip dhcp snooping | ||
| Line 47: | Line 49: | ||
When option 82 is enabled on the switch, then this sequence of events occurs when a DHCP client sends a DHCP request: | When option 82 is enabled on the switch, then this sequence of events occurs when a DHCP client sends a DHCP request: | ||
# The switch receives the request and inserts the option 82 information in the packet header. | #The switch receives the request and inserts the option 82 information in the packet header. | ||
# The switch forwards or relays the request to the DHCP server. | #The switch forwards or relays the request to the DHCP server. | ||
# The server uses the DHCP option 82 information to formulate its reply and sends a response back to the switch. It does not alter the option 82 information. | #The server uses the DHCP option 82 information to formulate its reply and sends a response back to the switch. It does not alter the option 82 information. | ||
# The switch strips the option 82 information from the response packet. | #The switch strips the option 82 information from the response packet. | ||
# The switch forwards the response packet to the client. | #The switch forwards the response packet to the client. | ||
Suboption Components of Option 82 | Suboption Components of Option 82 | ||
| Line 74: | Line 76: | ||
<br /> | <br /> | ||
=== mac-based vlan === | ===mac-based vlan=== | ||
全局下<syntaxhighlight> | 全局下<syntaxhighlight> | ||
vlan 2 | vlan 2 | ||
| Line 81: | Line 83: | ||
show vlan association mac | show vlan association mac | ||
</syntaxhighlight> | </syntaxhighlight> | ||
[[Category:Networking]] | |||
Revision as of 05:15, 2 April 2020
端口安全
Switch>enable
Switch#configure terminal
Switch(config)#interface fastethernet 0/1
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#switchport port-security
Switch(config-if)#switchport port-security maximum 1
#Set limit for hosts that can be associated with interface. Default value is 1. Skip this command to use default value.
Switch(config-if)#switchport port-security violation shutdown
#Set security violation mode. Default mode is shutdown. Skip this command to use default mode.
Switch(config-if)#switchport port-security mac-address sticky
#Enable sticky feature.violation shutdown触发之后端口进入err-disable状态 可在全局设置err-disable自动恢复
#errdisable recovery cause psecure-violation
#errdisable recovery cause mac-locking
#errdisable recovery interval 30 #(30s)也可手动 shutdown / no shutdown 开启端口
全局配置port-security
switchport port-security端口配置port-security
switchport port-security
switchport port-securtiy maximum 3
switchport port-security mac-address sticky
switchport port-security violation shutdown
DHCP安全
开启dhcp snooping 只在接入层交换机开启
ip dhcp snooping
ip dhcp snooping vlan 10
ip dhcp snooping verify mac-address#untrusted port (end suer port)
int fastethernet 1/0/1
ip dhcp snooping limit rate 20
#trusted port (trunk interface)
int fastethernet 1/0/10
ip dhcp snooping trust原理：
When option 82 is enabled on the switch, then this sequence of events occurs when a DHCP client sends a DHCP request:
- The switch receives the request and inserts the option 82 information in the packet header.
- The switch forwards or relays the request to the DHCP server.
- The server uses the DHCP option 82 information to formulate its reply and sends a response back to the switch. It does not alter the option 82 information.
- The switch strips the option 82 information from the response packet.
- The switch forwards the response packet to the client.
Suboption Components of Option 82
Option 82 as implemented on a switching device comprises the suboptions circuit ID, remote ID, and vendor ID. These suboptions are fields in the packet header:
circuit ID—Identifies the circuit (interface or VLAN) on the switching device on which the request was received. The circuit ID contains the interface name and VLAN name, with the two elements separated by a colon—for example, ge-0/0/10:vlan1, where ge-0/0/10 is the interface name and vlan1 is the VLAN name. If the request packet is received on a Layer 3 interface, the circuit ID is just the interface name—for example, ge-0/0/10.
Use the prefix option to add an optional prefix to the circuit ID. If you enable the prefix option, the hostname for the switching device is used as the prefix; for example, device1:ge-0/0/10:vlan1, where device1 is the hostname.
You can also specify that the interface description be used rather than the interface name or that the VLAN ID be used rather than the VLAN name.
remote ID—Identifies the remote host. See remote-id for details.
vendor ID—Identifies the vendor of the host. If you specify the vendor-id option but do not enter a value, the default value Juniper is used. To specify a value, you type a character string.
STP 生成树协议 防止二层交换机出现环路
在接入端口设置
mac-based vlan
全局下
vlan 2
vlan association mac xxxx.xxxx.xxxx查看
show vlan association mac