2實(shí)施vlan安全實(shí)驗(yàn)

IPVLANVLAN第2部分：在交換機(jī)上實(shí)施VLAN安全施。您還將使用各種show命令檢查思科交換機(jī)的行為。然后您將應(yīng)用安全措施。注意：CiscoIOSRelease15.0(2)（lanbasek9映像）CiscoCatalyst2960系列。也可使用其他交換機(jī)以及CiscoIOS版本。根據(jù)型號(hào)以及CiscoIOS版本不同，可用命令和產(chǎn)生的輸出可能與1部分:1步:建立如拓?fù)鋱D所示的網(wǎng)絡(luò)。2步:3步:PC-A、PC-BPC-CIP4步:5步:VLAN6步:S1(config)#noiphttpS2(config)#noiphttp:2部分:VLAN1步:S1S2TRUNKS1(config)#interfaceS1(config-if)#switchportmodeS2(config)#interfaceS2(config-if)#switchportmodeS1#showinterface

allowedon Vlansallowedandactiveinmanagementdomain Vlansinspanningtreeforwardingstateandnotpruned 2步:S1S2TRUNKVLANS1#configS1(config)#interfaceS1(config-if)#switchporttrunknativevlanNATIVE_VLAN_MISMATCH:S2(config)#interfaceS2(config-if)#switchporttrunknativevlanS1#showinterface EncapsulationStatus on

allowedon Vlansallowedandactiveinmanagementdomain Vlansinspanningtreeforwardingstateandnot 3步:TRUNK4步:S1S2DTPS1#showinterfacef0/1Name:Fa0/1AdministrativeMode:trunkOperationalMode:trunkAdministrativeTrunkingEncapsulation:dot1qOperationalTrunkingEncapsulation:dot1qNegotiationofTrunking:OnS1(config)#interfaceS1(config-if)#switchportS2(config)#interfaceS2(config-if)#switchportS1#showinterfacef0/1Name:Fa0/1AdministrativeMode:trunkOperationalMode:trunkAdministrativeTrunkingEncapsulation:dot1qOperationalTrunkingEncapsulation:dot1qNegotiationofTrunking:Off5步:S1S2VLAN1中。比較好的做法是將所有未使用的端口放入“黑洞”VLAN。只在兩臺(tái)交換機(jī)上配置端口2至端口5。S1#showinterfacef0/2Name:Fa0/2AdministrativeMode:dynamicautoOperationalMode:downAdministrativeTrunkingEncapsulation:dot1qNegotiationofTrunking:OnS1(config)#interfacerangef0/2–S1(config-if-range)#switchportmodeS1(config-if-range)#switchportaccessvlanS1showinterfacef0/2switchportName:Fa0/2Switchport:EnabledAdministrativeMode:staticaccessOperationalMode:downAdministrativeTrunkingEncapsulation:dot1qNegotiationofTrunking:OffAccessModeVLAN:999(BlackHole)TrunkingNativeModeVLAN:1(default)AdministrativeNativeVLANtagging:enabledVoiceVLAN:noneS1#showvlan1Fa0/7,Fa0/8,Fa0/9,Fa0/11,Fa0/12,Fa0/13,Fa0/15,Fa0/16,Fa0/17,Fa0/19,Fa0/20,Fa0/21,Fa0/23,Fa0/24,Gi0/1,999999 Fa0/2,Fa0/3,Fa0/4,1002fddi- 1004fddinet- 1005trnet-default RestrictVLANsallowedontrunkports.S1(config)#interfaceS1(config-if)#switchporttrunkallowedvlanS1#s