了解交换机安全性

EthernetLANsUnderstandingSwitchSecurityCommonThreatstoPhysicalInstallationsHardwarethreats物理硬件的破坏Environmentalthreats温度，潮湿等Electricalthreats电压等Maintenancethreats维护的威胁ConfiguringaSwitchPasswordVTY称为虚拟终端端口0-4。ConfiguringtheLoginBannerDefinesandenablesacustomizedbannertobedisplayedbeforetheusernameandpasswordloginprompts.当用户使用用户名跟密码登陆时将启用SwitchX#bannerlogin"Accessforauthorizedusersonly.Pleaseenteryourusernameandpassword."Telnetvs.SSHAccessTelnetMostcommonaccessmethodInsecureSSH-encrypted!–TheusernamecommandcreatetheusernameandpasswordfortheSSHsessionUsernameciscopasswordciscoipdomain-namecryptokeygeneratersaipsshversion2linevty04loginlocaltransportinputsshSSH加密传输数据，TRANDSPORTINPUTSSH将只允许SSH连接CiscoCatalyst2960SeriesSwitchX(config-if)#switchportport-security[mac-addressmac-address|mac-addresssticky[mac-address]|maximumvalue|violation{restrict|shutdown}]

SwitchX(config)#interfacefa0/5SwitchX(config-if)#switchportmodeaccessSwitchX(config-if)#switchportport-securitySwitchX(config-if)#switchportport-securitymaximum1SwitchX(config-if)#switchportport-securitymac-addressstickySwitchX(config-if)#switchportport-securityviolationshutdownConfiguringPortSecurity静态使用switchportport-securitymac-address0008.EEEE.EEEESwitchX#showport-security

[interfaceinterface-id][address][|{begin|exclude|include}expression]SwitchX#showport-securityinterfacefastethernet0/5Port

Security

:

EnabledPort

Status

:

Secure-upViolation

Mode

:

ShutdownAging

Time

:

20

minsAging

Type

:

AbsoluteSecureStatic

Address

Aging

:

DisabledMaximum

MAC

Addresses

:

1Total

MAC

Addresses

:

1Configured

MAC

Addresses

:

0Sticky

MAC

Addresses

:

0Last

Source

Address

:

0000.0000.0000Security

Violation

Count

:

0VerifyingPortSecurity

ontheCatalyst2960SeriesSwitchX#shport-securitySecurePortMaxSecureAddrCurrentAddrSecurityViolationSecurityAction(Count)(Count)(Count)--------------------------------------------------------------------------Fa0/5110Shutdown---------------------------------------------------------------------------TotalAddressesinSystem(excludingonemacperport):0MaxAddresseslimitinSystem(excludingonemacperport):1024SwitchX#shport-securityaddressSecureMacAddressTable-------------------------------------------------------------------VlanMacAddressTypePortsRemainingAge(mins)-------------------------------------10008.dddd.eeeeSecureConfiguredFa0/5--------------------------------------------------------------------TotalAddressesinSystem(excludingonemacperport):0MaxAddresseslimitinSystem(excludingonemacperport):1024VerifyingPortSecurity

ontheCatalyst2960Series(Cont.)SecuringUnusedPortsUnsecuredportscancreateasecurityhole.Aswitchpluggedintoanunusedportwillbeaddedtothenetwork.Secureunusedportsbydisablinginterfaces(ports)需要把未使用的端口关闭免成安全隐患。DisablinganInterface(Port)shutdownSwitchX(config-int)#Todisableaninterface,usetheshutdowncommandininterfaceconfigurationmode.Torestartadisabledinterface,usethenoformofthiscommand.SummaryThefirstlevelofsecurityisphysical.Passwordscanbeusedtolimitaccesstousersthathavebeengiventhepassword.Theloginbannercanbeusedtodisplayamessagebeforetheuser