端口安全与等长子网划分

一 . 端口安全

 

配置端口安全：

<Huawei>system-view 
Enter system view, return user view with Ctrl+Z.
[Huawei]sy SW1
[SW1]int g0/0/1
[SW1-GigabitEthernet0/0/1]port-s    
[SW1-GigabitEthernet0/0/1]port-security e    
[SW1-GigabitEthernet0/0/1]port-security enable 
[SW1-GigabitEthernet0/0/1]port-s    
[SW1-GigabitEthernet0/0/1]port-security m    
[SW1-GigabitEthernet0/0/1]port-security max-    
[SW1-GigabitEthernet0/0/1]port-security max-mac-num 3
[SW1-GigabitEthernet0/0/1]q
 

查看动态安全Mac地址表：

[SW1]dis    
[SW1]display mac-a    
[SW1]display mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address    VLAN/       PEVLAN CEVLAN Port            Type      LSP/LSR-ID  
               VSI/SI                                              MAC-Tunnel  
-------------------------------------------------------------------------------
5489-9831-3da0 1           -      -      GE0/0/1         security  -           
5489-9814-426d 1           -      -      GE0/0/1         security  -           
5489-9821-0b04 1           -      -      GE0/0/1         security  -           
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 3 

MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address    VLAN/       PEVLAN CEVLAN Port            Type      LSP/LSR-ID  
               VSI/SI                                              MAC-Tunnel  
-------------------------------------------------------------------------------
5489-983a-6db7 1           -      -      GE0/0/2         dynamic   0/-         
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1 

[SW1]

[SW1-GigabitEthernet0/0/1]port-security mac-address sticky

[SW1]display mac-address sticky
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address    VLAN/       PEVLAN CEVLAN Port            Type      LSP/LSR-ID  
               VSI/SI                                              MAC-Tunnel  
-------------------------------------------------------------------------------
5489-9831-3da0 1           -      -      GE0/0/1         sticky    -           
5489-9814-426d 1           -      -      GE0/0/1         sticky    -           
5489-9821-0b04 1           -      -      GE0/0/1         sticky    -           
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 3 

[SW1]

验证：

pc1/pc2/pc3 ping通 server 1

 

 

 二 . 等长子网划分实验

测试环境：

配置命令：

SW1的配置：

[SW1]vlan batch 10 20 30 40 
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW1]port-g gr g0/0/1 g 0/0/2
[SW1-port-group]p l t
[SW1-GigabitEthernet0/0/1]p l t
[SW1-GigabitEthernet0/0/2]p l t
[SW1-port-group]p t a v a
[SW1-GigabitEthernet0/0/1]p t a v a
[SW1-GigabitEthernet0/0/2]p t a v a
[SW1-port-group]q
[SW1]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[SW1]net    
[SW1]ip pool v10
Info:It's successful to create an IP address pool.
[SW1-ip-pool-v10]net    
[SW1-ip-pool-v10]network192.168.100.0 mask 26
                 ^
Error: Unrecognized command found at '^' position.
[SW1-ip-pool-v10]
<SW1>sy    
<SW1>system-view 
Enter system view, return user view with Ctrl+Z.
[SW1]dhcp enable
[SW1]ip pool v10
[SW1-ip-pool-v10]netw    
[SW1-ip-pool-v10]network 192.168.100.0 mask 26
[SW1-ip-pool-v10]gat    
[SW1-ip-pool-v10]gateway-list 192.168.100.26
[SW1-ip-pool-v10]dns-l    
[SW1-ip-pool-v10]dns-list 8.8.8.8
[SW1-ip-pool-v10]int pool v20
                 ^
Error: Unrecognized command found at '^' position.
[SW1-ip-pool-v10]q
[SW1]ip pool v20
Info:It's successful to create an IP address pool.
[SW1-ip-pool-v20]net    
[SW1-ip-pool-v20]network 192.168.100.64 mask 26
[SW1-ip-pool-v20]gat    
[SW1-ip-pool-v20]gateway-list 192.168.100.126
[SW1-ip-pool-v20]dns    
[SW1-ip-pool-v20]dns-list 8.8.8.8
[SW1-ip-pool-v20]ip pool v30
Info:It's successful to create an IP address pool.
[SW1-ip-pool-v30]net    
[SW1-ip-pool-v30]network 192.168.100.128 mask 26
[SW1-ip-pool-v30]gat    
[SW1-ip-pool-v30]gateway-list 192.168.100.190
[SW1-ip-pool-v30]dns    
[SW1-ip-pool-v30]dns-list 8.8.8.8
[SW1-ip-pool-v30]ip pool v40
Info:It's successful to create an IP address pool.
[SW1-ip-pool-v40]net    
[SW1-ip-pool-v40]network 192.168.100.192 mask 26
[SW1-ip-pool-v40]g    
[SW1-ip-pool-v40]gateway-list 192.168.100.254
[SW1-ip-pool-v40]d    
[SW1-ip-pool-v40]dns-list 8.8.8.8 9.9.9.9
[SW1-ip-pool-v40]q
[SW1]dhcp
          ^
Error:Incomplete command found at '^' position.
[SW1]int v10
[SW1-Vlanif10]ip ad    
[SW1-Vlanif10]ip address 192.168.100.62 26
[SW1-Vlanif10]dhcp sel    
[SW1-Vlanif10]dhcp select g    
[SW1-Vlanif10]dhcp select global 
[SW1-Vlanif10]int v20
[SW1-Vlanif20]ip add    
[SW1-Vlanif20]ip address 192.168.100.126 26
[SW1-Vlanif20]dhcp sel    
[SW1-Vlanif20]dhcp select g    
[SW1-Vlanif20]dhcp select global

<SW1>system-view 
Enter system view, return user view with Ctrl+Z.
[SW1-Vlanif30]ip ad    
[SW1-Vlanif30]ip address 192.168.100.190 26
[SW1-Vlanif30]dhcp sel    
[SW1-Vlanif30]dhcp select g    
[SW1-Vlanif30]dhcp select global 
[SW1-Vlanif30]int v40
[SW1-Vlanif40]ip ad    
[SW1-Vlanif40]ip address 192.168.100.254 26
[SW1-Vlanif40]dhcp sel    
[SW1-Vlanif40]dhcp select g    
[SW1-Vlanif40]dhcp select global 
[SW1-Vlanif40]

SW2的配置：

[SW2]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW2]int g0/0/1
[SW2-GigabitEthernet0/0/1]p l t
[SW2-GigabitEthernet0/0/1]p t a v a 
[SW2-GigabitEthernet0/0/1]dis th
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 2 to 4094
#
return
[SW2-GigabitEthernet0/0/1]int g0/0/2
[SW2-GigabitEthernet0/0/2]p l a
[SW2-GigabitEthernet0/0/2]p d v 10
[SW2-GigabitEthernet0/0/2]dis th
#
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 10
#
return
[SW2-GigabitEthernet0/0/2]int g0/0/3
[SW2-GigabitEthernet0/0/3]p l a
[SW2-GigabitEthernet0/0/3]p d v 20
[SW2-GigabitEthernet0/0/3]dis th
#
interface GigabitEthernet0/0/3
 port link-type access
 port default vlan 20
 

SW3的配置：

<Huawei>u t m
Info: Current terminal monitor is off.
<Huawei>sy    
<Huawei>system-view 
Enter system view, return user view with Ctrl+Z.
[Huawei]sy SW3
[SW3]vlan b    
[SW3]vlan batch 10 20 30 40 
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW3]int g0/0/1
[SW3-GigabitEthernet0/0/1]p l t
[SW3-GigabitEthernet0/0/1]p t a v a
[SW3-GigabitEthernet0/0/1]int g0/0/2
[SW3-GigabitEthernet0/0/2]p l a
[SW3-GigabitEthernet0/0/2]p d v 30
[SW3-GigabitEthernet0/0/2]dis th
#
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 30
#
return
[SW3-GigabitEthernet0/0/2]int g0/0/3
[SW3-GigabitEthernet0/0/3]p l a
[SW3-GigabitEthernet0/0/3]p d v 40
[SW3-GigabitEthernet0/0/3]