网络安全使用BPDUFilter提高STP安全性

1、网络安全实验教程 #网络安全实验教程 使用BPDUFilter提高STP安全性【实验名称】使用BPDUFilter提高STP安全性【实验目的】使用交换机的BPDUFilter特性増强交换网络的稳定性与弹性【背景描述】正常情况下，交换机会向所有启用的接口发送BPDU报文，以便进行生成树的选举与拓扑维护。但是如果交换机的某个端口连接的为终端设备，如PC机、打印机等，而这些设备无需参与STP计算，所以无需接收BPDU报文。【需求分析】我们可以使用BPDU过滤(BPDUFilter)功能禁止BPDU报文从端口发送出去，以防止无需参与STP计算的设备收到多余的BPDU报文。【实验拓扑】FO/23F0/2

2、4SW2SW3【实验设备】交换机3台PC1台【预备知识】交换机转发原理交换机呈本配宣STP原理PortFast原理BPDUFilter原理【实验原理】BPDUFilter功能禁止BPDU报文从端口发送出去，以防止无需参与STP计算的设备收到多余的BPDU报文。【实验步骤】第一步：配置Trunk端口SW1与SW2之间通过两条链路相连以提供兀余性：SW1#configureSW1(config)#interfacefastEthernet0/23SW1(config-if)#switchportmodetrunkSW1(config-if)#exitSW1(config)#interfacefas

3、tEthernet0/24SW1(config-if)#switchportmodetrunkSW1(config-if)#endSW1#SW2#configureSW2(config)#interfacefastEthernet0/23SW2(config-if)#switchportmodetrunkSW2(config-if)#exitSW2(config)#interfacefastEthernet0/24SW2(config-if)#switchportmodetrunkSW2(config-if)#endSW2#第二步：启用生成树协议一RSTPSW1#configureSW1(co

4、nfig)#spanning-treemoderstpSW1(config)#spanning-treeSW1(config)#SW2#configureSW2(config)#spanning-treemoderstpSW2(config)#spanning-treeSW2(config)#第三步：验证测试査看生成树的选举结果，由TSW2具有更小的MAC地址，所以SW2被选为根桥：SW1#showspanning-treeStpVersion:RSTPSysStpStatus:ENABLEDMaxAge:20HelloTime:2ForwardDelay:15BridgeMaxAge:20B

5、ridgeHelloTime:2BridgeForwardDelay:15MaxHops:20TxHoldCount:3PathCostMethod:LongBPDUGuard:DisabledBPDUFilter:DisabledBridgeAddr:00d0.f882.f4a1Priority:32768TimeSinceTopologyChange:0d:2h:37m:57sTopologyChanges:10DesignatedRoot:8000.00d0.f821.a542RootCost:200000RootPort:23SW2#showspanning-treeStpVersio

6、n:RSTPSysStpStatus:ENABLEDMaxAge:20HelioTime:2ForwardDelay:15BridgeMaxAge:20BridgeHelloTime:2BridgeForwardDelay:15MaxHops:20TxHoldCount:3PathCostMethod:LongBPDUGuard:DisabledBPDUFilter:DisabledBridgeAddr:00d0.f821.a542Priority:32768TimeSinceTopologyChange:0d:2h:38m:28sTopologyChanges:14DesignatedRoo

7、t:8000.00d0.f821.a542RootCost:0RootPort:0第四步：配置SW3将SW3配置为具有更小数值的优先级，以确保SW3有资格成为新的根桥，并启用RSTP：SW3#configureSW3(config)#spanning-treepriority4096SW3(config)#spanning-treemoderstpSW3(config)#spanning-treeSW3(config)#第五步：将SW3接入SW2的F0/1端口交换机提示拓扑变更：SW2#Dec323:09:37SW2%7:%LINKCHANGED:InterfaceFastEthernet0/

8、1,changedstatetoupDec323:09:37SW2%7:%LINEPROTOCOLCHANGE:InterfaceFastEthernet0/1,changedstatetoUPDec323:09:40SW2%7:2007-12-323:09:40topochange:topologyischangedDec323:09:41SW2%7:2007-12-323:09:41topochange:topologyischanged査看生成树的选举结果，可以看到SW3成为了新的根桥：SW2#showspanning-treeStpVersion:RSTPSysStpStatus:EN

9、ABLEDMaxAge:20HelioTime:2ForwardDelay:15BridgeMaxAge:20BridgeHelloTime:2BridgeForwardDelay:15MaxHops:20TxHoldCount:3PathCostMethod:LongBPDUGuard:DisabledBPDUFilter:DisabledBridgeAddr:00d0.f821.a542Priority:32768TimeSinceTopologyChange:0d:0h:0m:36sTopologyChanges:16DesignatedRoot:1000.00d0.f834.6af0R

10、ootCost:200000RootPort:1SW1#showspanning-treeStpVersion:RSTPSysStpStatus:ENABLEDMaxAge:20HelioTime:2ForwardDelay:15BridgeMaxAge:20BridgeHelloTime:2BridgeForwardDelay:15MaxHops:20TxHoldCount:3PathCostMethod:LongBPDUGuard:DisabledBPDUFilter:DisabledBridgeAddr:00d0.f882.f4a1Priority:32768TimeSinceTopol

11、ogyChange:0d:0h:1m:22sTopologyChanges:12DesignatedRoot:1000.00d0.f834.6af0RootCost:400000RootPort:23SW3#showspanning-treeStpVersion:RSTPSysStpStatus:ENABLEDMaxAge:20HelioTime:2ForwardDelay:15BridgeMaxAge:20BridgeHelloTime:2BridgeForwardDelay:15MaxHops:20TxHoldCount:3PathCostMethod:LongBPDUGuard:Disa

12、bledBPDUFilter:DisabledBridgeAddr:00d0.f834.6af0Priority:4096TimeSinceTopologyChange:0d:0h:1m:56sTopologyChanges:6DesignatedRoot:1000.00d0.f834.6af0RootCost:0RootPort:0通过以上测试可以看出，由T-SW3的加入，造成STP重新进彳j计算。第六步：将SW3从SW2的F0/1端口断开，使网络恢复以前的拓扑第七步：配置BPDUFilter启用SW2的F0/1端口的BPDUFilter特性:SW2#configureSW2(config)

13、#interfacefastEthernet0/1SW2(config-if)#spanning-treebpdufilterenableSW2(config-if)#endSW2#査看BPDUFilter状态：SW2#showspanning-treeinterfacefastEthernet0/1PortAdminPortFast:DisabledPortOperPortFast:DisabledPortAdminLinkType:autoPortOperLinkType:point-to-pointPortBPDUGuard:disablePortBPDUFilter:enablePor

14、tstate:discardingPortPriority:128PortDesignatedRoot:8000.00d0.f821.a542PortDesignatedCost:0PortDesignatedBridge:8000.00d0.f821.a542PortDesignatedPort:8001PortForwardTransitions:3PortAdminPathCost:200000PortOperPathCost:200000PortRole:disableport第八步：将SW3再次接入SW2的F0/1端口査看SW2与SW1的生成树状态，SW2仍然为根桥:SW2#show

15、spanning-treeStpVersion:RSTPSysStpStatus:ENABLEDMaxAge:20HelioTime:2ForwardDelay:15BridgeMaxAge:20BridgeHelloTime:2BridgeForwardDelay:15MaxHops:20TxHoldCount:3PathCostMethod:LongBPDUGuard:DisabledBPDUFilter:DisabledBridgeAddr:00d0.f821.a542Priority:32768TimeSinceTopologyChange:0d:0h:20m:26sTopologyC

16、hanges:16DesignatedRoot:8000.00d0.f821.a542RootCost:0RootPort:0SW1#showspanning-treeStpVersion:RSTPSysStpStatus:ENABLEDMaxAge:20HelioTime:2ForwardDelay:15BridgeMaxAge:20BridgeHelloTime:2BridgeForwardDelay:15MaxHops:20TxHoldCount:3PathCostMethod:LongBPDUGuard:DisabledBPDUFilter:DisabledBridgeAddr:00d

17、0.f882.f4a1Priority:32768TimeSinceTopologyChange:0d:0h:20m:56sTopologyChanges:12DesignatedRoot:8000.00d0.f821.a542RootCost:200000RootPort:23通过以上测试可以看出，由于SW2的F0/1端口配置了BPDUFilter,当SW3接入到F0/1端口后，收到了BPDU报文，BPDUFilter丢弃了收到的BPDU报文，使得原网络拓扑没有受到影响。第九步：验证BPDUFilter为了更清晰的验证BPDUFilter功能，现将一台PC接入到SW1的F0/1端口，通过在P

18、C上捕获报文，可以看到SW1正在向F0/1发送BPDU报文：网络安全实验教程第一章网络基础设施安全实验interfaceFastEthernet0/19 No.，TimeSourceDestinationProtocolInfomunnnnnM00:d0:t8:82:i-4:alSTPRSTRoot=I21.99998100:d0:f8:82:f4:al01:80：c2：00：00：00STPRSTRoot=33.99996200:d0:f8:82:f4:al01:80：c2：00：00:00STPRSTROOt=45.99994600:d0:f8:82:f4:al01:80：c2：00：00

19、:00STPRSTROOt=57.99992500:d0:f8:82:f4:al01:80：c2：00：00:00STPRSTROOt=69.99990700:d0:f8:82:f4:al01:80：c2：00：00:00STPRSTROOt=EFrame1(60bytesonwire,60bytescaptured)田IEEE802.3EthernetELogical-Linkcontrol日spanningTreeProtocolProtocolidentifier:spanningTreeProtocol(0 x0000)Protocolversionidentifier:Rapidsp

20、anningTree(2)BPDUType:Rapid/MulfiplespanningTree(0 x02)BBPDUflags:0 x7c(Agreemerrt,Forwarding,Learning,PortRole:Designated)RootIdentifier:32768/OO:dO:f8:21:a5:42RootPathcost:200000BridgeIdentifier:32768/00:d0:f8:82:f4:alPortidentifier:0 x8001MessageAge:1MaxAge:20HelloTime:2ForwardDelay:15version1Len

21、gth:0第十步：配置BPDUFilterSW1#configureSW1(config)#interfacefastEthernet0/1SW1(config-if)#spanning-treeportfastSW1(config-if)#spanning-treebpdufilterenableSW1(config-if)#endSW1#第十一步：验证测试在PC1上将无法捕获到BPDU报文。【参考配置】SW1#showrunning-configBuildingconfiguration.Currentconfiguration:1272bytesihostnameSW1iIIvlan1s

22、panning-treespanning-treemoderstpinterfaceFastEthernet0/1spanning-treebpdufilterenablespanning-treeportfastiinterfaceFastEthernet0/2iinterfaceFastEthernet0/3iinterfaceFastEthernet0/4iinterfaceFastEthernet0/5iinterfaceFastEthernet0/6iinterfaceFastEthernet0/7iinterfaceFastEthernet0/8iinterfaceFastEthe

23、rnet0/9iinterfaceFastEthernet0/10iinterfaceFastEthernet0/11iinterfaceFastEthernet0/12iinterfaceFastEthernet0/13iinterfaceFastEthernet0/14iinterfaceFastEthernet0/15iinterfaceFastEthernet0/16iinterfaceFastEthernet0/17iinterfaceFastEthernet0/18iinterfaceFastEthernet0/20!interfaceFastEthernet0/21!interf

24、aceFastEthernet0/22!interfaceFastEthernet0/23switchportmodetrunkiinterfaceFastEthernet0/24switchportmodetrunk!interfaceGigabitEthernet0/25!interfaceGigabitEthernet0/26!interfaceGigabitEthernet0/27!interfaceGigabitEthernet0/28!linecon0linevty04loginiIEndSW2#showrunning-configBuildingconfigurationCurr

25、entconfiguration:1247bytesihostnameSW2网络安全实验教程第一章网络基础设施安全实验interfaceFastEthernet0/13 # 网络安全实验教程interfaceFastEthernet0/15 vlan1spanning-treespanning-treemoderstpinterfaceFastEthernet0/1spanning-treebpdufilterenable!interfaceFastEthernet0/2!interfaceFastEthernet0/3!interfaceFastEthernet0/4!interfaceFa

26、stEthernet0/5!interfaceFastEthernet0/6!interfaceFastEthernet0/7!interfaceFastEthernet0/8!interfaceFastEthernet0/9!interfaceFastEthernet0/10!interfaceFastEthernet0/11!interfaceFastEthernet0/12!interfaceFastEthernet0/13!interfaceFastEthernet0/14!interfaceFastEthernet0/16!interfaceFastEthernet0/17!inte

27、rfaceFastEthernet0/18!interfaceFastEthernet0/19!interfaceFastEthernet0/20!interfaceFastEthernet0/21!interfaceFastEthernet0/22!interfaceFastEthernet0/23switchportmodetrunkiinterfaceFastEthernet0/24switchportmodetrunk!interfaceGigabitEthernet0/25!interfaceGigabitEthernet0/26!interfaceGigabitEthernet0/27!interfaceGigabitEthernet0/28!linecon0linevty04loginiIEndSW3#showrunning-configBuildingconfiguration.网络安全实验教程第一章网络基