About the switch settings bound to the IP-MAC [out of print]

Take the Cisco 2950 vswitch as an example. log on to the vswitch and enter the management password to enter the configuration mode. Then, run the following command:
Switch # config Terminal
# Enter the Configuration Mode
Switch (config) # interface fastethernet 0/1
# Enter the specific port configuration mode
Switch (config-If) # switchport port-secruity
# Configure port security mode
Switch (config-If) switchport port-security Mac-address MAC (MAC address of the host)
(Config-If) No switchport port-security Mac-address MAC (host MAC address)
# Delete the MAC address of the bound host
Note:
The above command sets a port on the switch to bind a specific MAC address, so that only this host can use the network, if the NIC of the host is changed or another PC wants to use the network via this port, it will not be available unless the MAC address bound to the port is deleted or modified.
Note:
The preceding functions are applicable to Cisco 2950, 3550, 4500, and 6500 series switches.
2. solution 2-Expanded access list based on MAC address
Switch (config) MAC access-list extended mac10
# Define a MAC address access control list and name it mac10 (Reprinted with the source n et130)
Switch (config) permit host 0009.6bc4.d4bf any
# A host with the MAC address 0009.6bc4.d4bf can access any host
Switch (config) permit any host 0009.6bc4.d4bf
# Define that all hosts can access hosts whose MAC address is 0009.6bc4.d4bf
Switch (config-If) interface fa0/20
# Enter the specific port configuration mode
Switch (config-If) MAC access-group mac10 in
# Apply the access list named mac10 on this port (that is, the previously defined access policy)
Switch (config) No Mac access-list extended mac10
# Clear the access list named mac10
This function is the same as the application, but it is a port-based MAC Address Access Control List restriction that can limit the MAC address and target address range of a specific source.
Note:
The above functions can be implemented on Cisco 2950, 3550, 4500, and 6500 series switches, but note that 2950 and 3550 require the switch to run an enhanced software image (enhanced image ).
3. scheme 3--bind the MAC address of the IP address
You can only use application 1 or 2 in combination with an IP-based Access Control List for IP-MAC binding. (Reprinted with the source n et130)
Switch (config) MAC access-list extended mac10
# Define a MAC address access control list and name it mac10
Switch (config) permit host 0009.6bc4.d4bf any
# A host with the MAC address 0009.6bc4.d4bf can access any host
Switch (config) permit any host 0009.6bc4.d4bf
# Define that all hosts can access hosts whose MAC address is 0009.6bc4.d4bf
Switch (config) IP Access-list extended ip10
# Define an IP address access control list and name it ip10
Switch (config) permit 192.168.0.1 0.0.0.0 any
# A host with a defined IP address of 192.168.0.1 can access any host
Permit any 192.168.0.1 0.0.0.0
# Define that all hosts can access hosts whose IP address is 192.168.0.1
Switch (config-If) interface fa0/20
# Enter the specific port configuration mode
Switch (config-If) MAC access-group mac10 in
# Apply the access list named mac10 on this port (that is, the previously defined access policy)
Switch (config-If) IP Access-group ip10 in
# Apply the access list named ip10 on this port (that is, the previously defined access policy)
Switch (config) No Mac access-list extended mac10
# Clear the access list named mac10
Switch (config) No IP Access-group ip10 in
# Clear the access list named ip10
The Application 1 mentioned above is based on the binding of the host MAC address and the switch port. solution 2 is the access control list based on the MAC address. The functions of the first two solutions are roughly the same. If you want to bind an IP address to a MAC address, you can bind solution 1 or solution 2 to the IP address access control list as needed to achieve the desired effect.
Note: The above functions can be implemented on Cisco 2950, 3550, 4500, and 6500 series switches, but note that 2950 and 3550 require an enhanced software image (enhanced image) for the switch ).
Post-Note: On the surface, binding MAC addresses and IP addresses can prevent internal IP addresses from being stolen. However, due to various protocols and NIC Driver implementation technologies, binding a MAC address to an IP address has many drawbacks and cannot prevent the use of an internal IP address from being stolen.
The Internet to be deleted