端口安全 交換機 port-security sticky

1、 根據拓撲完成上圖 ，可以配置pc的地址為192.168.1.1-192.168.1.4
2、 配置安全端口
Switch>enable
switch#conf t
Switch(config)#interface f0/1
Switch(config-if)#switchport mode access 配置access模式
Switch(config-if)#switchport port-security 開啟安全端口
Switch(config-if)# do show port inter f0/1 查看安全端口信息
Port Security : Enabled 已經開啟
Port Status : Secure-up
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 0
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0000.0000.0000:0
Security Violation Count : 0

Switch(config-if)#switchport port-security maximum 2

設置最大接入MAC地址數為2
Switch(config-if)#switchport port-security mac-address sticky
自動獲得接入設備的MAC
Switch(config-if)#switchport port-security violation ?
違規處理方式
protect Security violation protect mode

保護- 丟棄數據，不告警
restrict Security violation restrict mode
抵制 –丟棄數據，發告警
shutdown Security violation shutdown mode
關閉- 丟棄數據，發告警並關閉鏈路
Switch(config-if)#switchport port-security violation protect
選擇違規處理方式為保護
Switch(config-if)#end
Switch#
Switch#show port-security address 查看地址表
Secure Mac Address Table

Vlan Mac Address Type Ports Remaining Age
(mins)

---

1 0002.4AA6.D46D SecureSticky FastEthernet0/1 -
1 0010.1108.D197 SecureSticky FastEthernet0/1 -

Total Addresses in System (excluding one mac per port) : 1
Max Addresses limit in System (excluding one mac per port) : 1024

驗證試驗，兩臺先接入的主機可以訪問PC3 ，第三臺不能訪問PC3 說明試驗成功 。

驗證安全端口的另外一種模式-靜態綁定

Switch#conf t
Switch(config)#
Switch(config)#interface f0/1
Switch(config-if)#no switchport port-security mac-address sticky 刪除動態綁定
Switch(config-if)#do show port add
Secure Mac Address Table

Vlan Mac Address Type Ports Remaining Age

---

1 0002.4AA6.D46D SecureSticky FastEthernet0/1 -
動態綁定的地址還在
1 0010.1108.D197 SecureSticky FastEthernet0/1 -

Total Addresses in System (excluding one mac per port) : 1
Max Addresses limit in System (excluding one mac per port) : 1024
Switch(config-if)#end
Switch#clear port-security sticky
清除動態綁定地址
Switch#show port-security address
Secure Mac Address Table

Vlan Mac Address Type Ports Remaining Age
(mins)

---

---

Total Addresses in System (excluding one mac per port) : 0
Max Addresses limit in System (excluding one mac per port) : 1024

Switch#conf t
Switch(config)#interface f0/1
Switch(config-if)#switchport port-security mac-address 00D0.FF76.14ED 手動綁定PC的MAC
Switch(config-if)#switchport port-security mac-address 0010.1108.D197

PC的MAC地址需要你自己在pC 的命令提示符下獲取，獲取方法：ipconfig /all

驗證試驗，靜態綁定的PC可以訪問PC3 ，其他不可以訪問PC3 ，證明試驗成功 。

交換機端口安全配置實驗(MAC動態綁定和靜態綁定)