2实施vlan安全实验

IPVLANVLAN第2部分：在交换机上实施VLAN安全施。您还将使用各种show命令检查思科交换机的行为。然后您将应用安全措施。注意：CiscoIOSRelease15.0(2)（lanbasek9映像）CiscoCatalyst2960系列。也可使用其他交换机以及CiscoIOS版本。根据型号以及CiscoIOS版本不同，可用命令和产生的输出可能与1部分:1步:建立如拓扑图所示的网络。2步:3步:PC-A、PC-BPC-CIP4步:5步:VLAN6步:S1(config)#noiphttpS2(config)#noiphttp:2部分:VLAN1步:S1S2TRUNKS1(config)#interfaceS1(config-if)#switchportmodeS2(config)#interfaceS2(config-if)#switchportmodeS1#showinterface

allowedon Vlansallowedandactiveinmanagementdomain Vlansinspanningtreeforwardingstateandnotpruned 2步:S1S2TRUNKVLANS1#configS1(config)#interfaceS1(config-if)#switchporttrunknativevlanNATIVE_VLAN_MISMATCH:S2(config)#interfaceS2(config-if)#switchporttrunknativevlanS1#showinterface EncapsulationStatus on

allowedon Vlansallowedandactiveinmanagementdomain Vlansinspanningtreeforwardingstateandnot 3步:TRUNK4步:S1S2DTPS1#showinterfacef0/1Name:Fa0/1AdministrativeMode:trunkOperationalMode:trunkAdministrativeTrunkingEncapsulation:dot1qOperationalTrunkingEncapsulation:dot1qNegotiationofTrunking:OnS1(config)#interfaceS1(config-if)#switchportS2(config)#interfaceS2(config-if)#switchportS1#showinterfacef0/1Name:Fa0/1AdministrativeMode:trunkOperationalMode:trunkAdministrativeTrunkingEncapsulation:dot1qOperationalTrunkingEncapsulation:dot1qNegotiationofTrunking:Off5步:S1S2VLAN1中。比较好的做法是将所有未使用的端口放入“黑洞”VLAN。只在两台交换机上配置端口2至端口5。S1#showinterfacef0/2Name:Fa0/2AdministrativeMode:dynamicautoOperationalMode:downAdministrativeTrunkingEncapsulation:dot1qNegotiationofTrunking:OnS1(config)#interfacerangef0/2–S1(config-if-range)#switchportmodeS1(config-if-range)#switchportaccessvlanS1showinterfacef0/2switchportName:Fa0/2Switchport:EnabledAdministrativeMode:staticaccessOperationalMode:downAdministrativeTrunkingEncapsulation:dot1qNegotiationofTrunking:OffAccessModeVLAN:999(BlackHole)TrunkingNativeModeVLAN:1(default)AdministrativeNativeVLANtagging:enabledVoiceVLAN:noneS1#showvlan1Fa0/7,Fa0/8,Fa0/9,Fa0/11,Fa0/12,Fa0/13,Fa0/15,Fa0/16,Fa0/17,Fa0/19,Fa0/20,Fa0/21,Fa0/23,Fa0/24,Gi0/1,999999 Fa0/2,Fa0/3,Fa0/4,1002fddi- 1004fddinet- 1005trnet-default RestrictVLANsallowedontrunkports.S1(config)#interfaceS1(config-if)#switchporttrunkallowedvlanS1#s