85, switch security MAC Layer attack configuration experiment port-security

1, Port security analysis

Conditions for triggering port security:

• An unauthorized MAC address

• The number of Port MAC addresses exceeds the limit

Action after port security is triggered:

• Protect Security violation Protect mode discards data, does not send SNMP trap messages

• Restrict Security violation restrict mode drops a data frame, sends an SNMP trap message

• Shutdown Security violation shutdown mode off interface, sending SNMP trap messages

2. Experimental topology

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M02/79/83/wKioL1aTYc3iWOmYAAAv6DsK1lE481.png "title=" m2.png "alt=" Wkiol1atyc3iwomyaaav6dsk1le481.png "/>

3. Experiment Configuration

Connectivity under normal conditions

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M00/79/84/wKiom1aTYk2yJBCoAAAm6Ep9Kmc060.png "title=" m3.png "alt=" Wkiom1atyk2yjbcoaaam6ep9kmc060.png "/>

Start port security on S1, only let the port learn AAAA.BBBB.CCCC MAC address, take protect action

Interface Gigabitethernet0/31

Switchport mode access

Switchport port-security

Switchport port-security violation protect

Switchport port-security mac-address AAAA.BBBB.CCCC

Test connectivity again

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/79/84/wKiom1aTZKvSWuVWAAAfdSm1WZU460.png "title=" m4.png "alt=" Wkiom1atzkvswuvwaaafdsm1wzu460.png "/>

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M02/79/84/wKiom1aTZMqxOHaiAABEZSKIQJM171.png "title=" m5.png "alt=" Wkiom1atzmqxohaiaabezskiqjm171.png "/> You can also set the maximum number of MAC addresses the port can learn and set sticky paste

S1 (config-if) #switchport port-security maximum?

<1-3072> Maximum Addresses

S1 (config-if) #switchport port-security mac-address sticky?

<cr>

This article is from the "Open Source Hall" blog, please be sure to keep this source http://kaiyuandiantang.blog.51cto.com/10699754/1733833

85, switch security MAC Layer attack configuration experiment port-security