CCNA Experiment 18 port security for switches

CCNA Experiment 18 port Security for switches

Environment: Windows XP , Packet Tracer 3.5

Purpose : know how to protect switch port security.

Description

There are three ways to protect the switch port: (Note that switch port security can only be Access interface Configuration)

(1) Limit the maximum number of connections to the switch port, and the maximum number of connections is 1-128.

(2) switch port for MAC address binding

(3) switch port for IP Address binding (to be configured on a three-tier device)

How security violations are handled:

  (1)        protect , secure port will discard packets of unknown address (default

  (2)        restrict trap notice

(3) shutdown When a violation occurs, the port is closed and a TRAP notification is sent. To restore the port in global mode with errdisable recovery when the port is closed

Steps:

1 , open Packettracer To create a topology:

650) this.width=650; "src=" Http://hi.csdn.net/attachment/201011/21/0_1290341447TfDb.gif "/>

2.Configure the port security policy for SW0:

switch>en

Switch#conf T

Switch (config) #host SW0

SW0 (config) #int FA0/1

SW0 (config-if) #switchport mode access

SW0 (config-if) #switchport port-security

SW0 (config-if) #switchport port-security maximum 1

SW0 (config-if) #switchport port-security mac-address Sticky

SW0 (config-if) #switchport port-security violation shutdown

SW0 (config-if) #exit

SW0 (config) #int FA0/10

SW0 (config-if) #switchport mode acc

SW0 (config-if) #switchport port-security

SW0 (config-if) #switchport port-security mac-address 0006.2a40. C113

SW0 (config-if) #switchport port-security violation shutdown

3 , two units PC Proceed first Ping Test , and then view FA0/1 and the FA0/10 the security port status:

650) this.width=650; "src=" Http://hi.csdn.net/attachment/201011/21/0_1290341539ZC2a.gif "/>

4 , testing:

Connect the Port FA0/1 of the computer PC0 remove and pull back into a computer PC2 Connection

Connect the Port FA0/10 of the computer PC1 remove and pull back into a computer PC3 Connection

650) this.width=650; "src=" Http://hi.csdn.net/attachment/201011/21/0_12903416087C8C.gif "/>

The FA0/1 port is configured to only learn the first connection to its Mac address if another computer tries to connect it and the Mac address does not meet and exceeds the maximum number of connections 1,FA0/1 The port performs an automatic shutdown of exception handling.

The FA0/10 Port is bound to the MAC address of the PC1 , and when the other computer connects to this port but the MAC address does not match the binding address,FA0/10 The port performs an automatic shutdown of exception handling.

This article from "Liu Fengyuan" blog, declined reprint!

CCNA Experiment 18 port security for switches