基于华为端口安全的网络实验题

基于华为端口安全的网络实验题

本端设备	端口号	对端设备
SW1	GE 0/0/1	PC1
SW1	GE 0/0/2	PC2
SW1	GE 0/0/3	PC3

计算机	IP地址	MAC地址
PC1	192.168.10.1	54-89-98-BE-44-D6
PC2	192.168.10.2	54-89-98-11-47-32
PC3	192.168.10.3	54-89-98-FD-80-4E

查看 MAC 所在的交换机端口

在交换机上使用命令 display mac-address,

[Huawei]dis mac-add
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address    VLAN/       PEVLAN CEVLAN Port            Type      LSP/LSR-ID  
               VSI/SI                                              MAC-Tunnel  
-------------------------------------------------------------------------------
5489-98fd-804e 1           -      -      GE0/0/3         dynamic   0/-         
5489-9811-4732 1           -      -      GE0/0/2         dynamic   0/-         
5489-98be-44d6 1           -      -      GE0/0/1         dynamic   0/-         
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 3 

开启SW1交换机端口的端口安全，并绑定对应PC的MAC地址。

绑定PC1

[SW1]interface GigabitEthernet 0/0/1
[SW1-GigabitEthernet0/0/1]port-security enable 
[SW1-GigabitEthernet0/0/1]port-security mac-address sticky
[SW1-GigabitEthernet0/0/1]port-security mac-address sticky 5489-98BE-44D6 vlan 1 

绑定PC2

[SW1]interface GigabitEthernet 0/0/2
[SW1-GigabitEthernet0/0/2]port-security enable 
[SW1-GigabitEthernet0/0/2]port-security mac-address sticky
[SW1-GigabitEthernet0/0/2]port-security mac-address sticky 5489-9811-4732 vlan 1 

绑定PC3

[SW1]interface GigabitEthernet 0/0/3
[SW1-GigabitEthernet0/0/3]port-security enable 
[SW1-GigabitEthernet0/0/3]port-security mac-address sticky
[SW1-GigabitEthernet0/0/3]port-security mac-address sticky 5489-98FD-804E vlan 1 

在交换机上查看配置是否生效

在交换机上使用 display mac-address 命令，查看交换机与计算机之间连接的端口，类型是否变为 sticky。

[SW1]dis mac-add
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address    VLAN/       PEVLAN CEVLAN Port            Type      LSP/LSR-ID  
               VSI/SI                                              MAC-Tunnel  
-------------------------------------------------------------------------------
5489-9811-4732 1           -      -      GE0/0/2         sticky    -           
5489-98be-44d6 1           -      -      GE0/0/1         sticky    -           
5489-98fd-804e 1           -      -      GE0/0/3         sticky    -           
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 3 

测试计算机的互通性

		通过 Ping 的命令，测试内部通信信息的情况。
		使用 PC1 计算机 Ping PC2计算机：

PC>ping 192.168.10.2

Ping 192.168.10.2: 32 data bytes, Press Ctrl_C to break
From 192.168.10.2: bytes=32 seq=1 ttl=128 time=47 ms
From 192.168.10.2: bytes=32 seq=2 ttl=128 time=31 ms
From 192.168.10.2: bytes=32 seq=3 ttl=128 time=31 ms
From 192.168.10.2: bytes=32 seq=4 ttl=128 time=31 ms
From 192.168.10.2: bytes=32 seq=5 ttl=128 time=32 ms

--- 192.168.10.2 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 31/34/47 ms

使用 PC1 计算机 Ping PC3 计算机：

PC>ping 192.168.10.3

Ping 192.168.10.3: 32 data bytes, Press Ctrl_C to break
From 192.168.10.3: bytes=32 seq=1 ttl=128 time=47 ms
From 192.168.10.3: bytes=32 seq=2 ttl=128 time=32 ms
From 192.168.10.3: bytes=32 seq=3 ttl=128 time=31 ms
From 192.168.10.3: bytes=32 seq=4 ttl=128 time=31 ms
From 192.168.10.3: bytes=32 seq=5 ttl=128 time=31 ms

--- 192.168.10.3 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 31/34/47 ms

可以看出是互相通信的。

更换 PC3 计算机的MAC地址 测试互通性。

PC3 原本MAC地址

PC>ipconfig

Link local IPv6 address...........: fe80::5689:98ff:fefd:804e
IPv6 address......................: :: / 128
IPv6 gateway......................: ::
IPv4 address......................: 192.168.10.3
Subnet mask.......................: 255.255.255.0
Gateway...........................: 0.0.0.0
Physical address..................: 54-89-98-FD-80-4E
DNS server........................:

更改MAC地址后

PC>ipconfig

Link local IPv6 address...........: fe80::5689:98ff:fefd:8048
IPv6 address......................: :: / 128
IPv6 gateway......................: ::
IPv4 address......................: 192.168.10.3
Subnet mask.......................: 255.255.255.0
Gateway...........................: 0.0.0.0
Physical address..................: 54-89-98-FD-80-48
DNS server........................:

使用PC1 计算机 Ping PC3 计算机：

PC>ping 192.168.10.3

Ping 192.168.10.3: 32 data bytes, Press Ctrl_C to break
From 192.168.10.1: Destination host unreachable
From 192.168.10.1: Destination host unreachable
From 192.168.10.1: Destination host unreachable
From 192.168.10.1: Destination host unreachable
From 192.168.10.1: Destination host unreachable

--- 192.168.10.3 ping statistics ---
  5 packet(s) transmitted
  0 packet(s) received
  100.00% packet loss

可以看出，更换了MAC地址后，计算机是不能通信的。

END