端口安全
安全地址表
在查看mac地址表之前,在pc1,pc2,pc3中ping192.168.1.4(server1).
在server1中pingpc1(192.168.1.1)
子网划分
LSW1配置
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys
[Huawei]sysname SW1
[SW1]sys
[SW1]sysname SW1-dhcp
[SW1-dhcp]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW1-dhcp]port-g
[SW1-dhcp]port-group g
[SW1-dhcp]port-group group-member g0/0/1 g0/0/2
[SW1-dhcp-port-group]port link-t
[SW1-dhcp-port-group]port link-type t
[SW1-dhcp-port-group]port link-type trunk
[SW1-dhcp-GigabitEthernet0/0/1]port link-type trunk
[SW1-dhcp-GigabitEthernet0/0/2]port link-type trunk
[SW1-dhcp-port-group]port t
[SW1-dhcp-port-group]port trunk a
[SW1-dhcp-port-group]port trunk allow-pass vlan all
[SW1-dhcp-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[SW1-dhcp-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[SW1-dhcp-port-group]q
[SW1-dhcp]dhcp en
[SW1-dhcp]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[SW1-dhcp]ip pool vlan10
Info:It's successful to create an IP address pool.
[SW1-dhcp-ip-pool-vlan10]netw
[SW1-dhcp-ip-pool-vlan10]network 192.168.100.0 mask 26
[SW1-dhcp-ip-pool-vlan10]gat
[SW1-dhcp-ip-pool-vlan10]gateway-list 192.168.100.62
[SW1-dhcp-ip-pool-vlan10]dns
[SW1-dhcp-ip-pool-vlan10]dns-list 8.8.8.8
[SW1-dhcp-ip-pool-vlan10]ip pool vlan20
Info:It's successful to create an IP address pool.
[SW1-dhcp-ip-pool-vlan20]net
[SW1-dhcp-ip-pool-vlan20]network 192.168.100.64 mask 26
[SW1-dhcp-ip-pool-vlan20]gat
[SW1-dhcp-ip-pool-vlan20]gateway-list 192.168.100.126
[SW1-dhcp-ip-pool-vlan20]dns
[SW1-dhcp-ip-pool-vlan20]dns-list 8.8.8.8
[SW1-dhcp-ip-pool-vlan20]ip pool vlan30
Info:It's successful to create an IP address pool.
[SW1-dhcp-ip-pool-vlan30]network 192.168.100.128 mask 26
[SW1-dhcp-ip-pool-vlan30]gat
[SW1-dhcp-ip-pool-vlan30]gateway-list 192.168.100.190
[SW1-dhcp-ip-pool-vlan30]dns-list 8.8.8.8
[SW1-dhcp-ip-pool-vlan30]ip pool vlan40
Info:It's successful to create an IP address pool.
[SW1-dhcp-ip-pool-vlan40]net
[SW1-dhcp-ip-pool-vlan40]network 192.168.100.192 mask 26
[SW1-dhcp-ip-pool-vlan40]gat
[SW1-dhcp-ip-pool-vlan40]gateway-list 192.168.100.254
[SW1-dhcp-ip-pool-vlan40]dns
[SW1-dhcp-ip-pool-vlan40]dns-list 8.8.8.8
[SW1-dhcp-ip-pool-vlan40]q
[SW1-dhcp]int vlan 10
[SW1-dhcp-Vlanif10]ip ad
[SW1-dhcp-Vlanif10]ip address 192.168.100.62 26
[SW1-dhcp-Vlanif10]dhcp se
[SW1-dhcp-Vlanif10]dhcp select g
[SW1-dhcp-Vlanif10]dhcp select global
[SW1-dhcp-Vlanif10]int vlan 20
[SW1-dhcp-Vlanif20]ip ad
[SW1-dhcp-Vlanif20]ip address 192.168.100.126 26
[SW1-dhcp-Vlanif20]dhcp se
[SW1-dhcp-Vlanif20]dhcp select g
[SW1-dhcp-Vlanif20]dhcp select global
[SW1-dhcp-Vlanif20]int vlan 30
[SW1-dhcp-Vlanif30]ip ad
[SW1-dhcp-Vlanif30]ip address 192.168.100.190 26
[SW1-dhcp-Vlanif30]dhcp se
[SW1-dhcp-Vlanif30]dhcp select g
[SW1-dhcp-Vlanif30]dhcp select global
[SW1-dhcp-Vlanif30]int vlan 40
[SW1-dhcp-Vlanif40]ip ad
[SW1-dhcp-Vlanif40]ip address 192.168.100.254 26
[SW1-dhcp-Vlanif40]dhcp se
[SW1-dhcp-Vlanif40]dhcp select g
[SW1-dhcp-Vlanif40]dhcp select global
LSW2配置
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys
[Huawei]sysname SW2
[SW2]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW2]int g0/0/2
[SW2-GigabitEthernet0/0/2]port link-t
[SW2-GigabitEthernet0/0/2]port link-type a
[SW2-GigabitEthernet0/0/2]port link-type access
[SW2-GigabitEthernet0/0/2]port def
[SW2-GigabitEthernet0/0/2]port default vlan 10
[SW2-GigabitEthernet0/0/2]int g0/0/3
[SW2-GigabitEthernet0/0/3]port link-t
[SW2-GigabitEthernet0/0/3]port link-type a
[SW2-GigabitEthernet0/0/3]port link-type access
[SW2-GigabitEthernet0/0/3]port def
[SW2-GigabitEthernet0/0/3]port default vlan 20
[SW2-GigabitEthernet0/0/3]int g0/0/1
[SW2-GigabitEthernet0/0/1]port link-t
[SW2-GigabitEthernet0/0/1]port link-type t
[SW2-GigabitEthernet0/0/1]port link-type trunk
[SW2-GigabitEthernet0/0/1]port t
[SW2-GigabitEthernet0/0/1]port trunk a
[SW2-GigabitEthernet0/0/1]port trunk allow-pass vlan all
LSW3配置
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys
[Huawei]sysname SW3
[SW3]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW3]int g0/0/2
[SW3-GigabitEthernet0/0/2]port link-t
[SW3-GigabitEthernet0/0/2]port link-type a
[SW3-GigabitEthernet0/0/2]port link-type access
[SW3-GigabitEthernet0/0/2]port def
[SW3-GigabitEthernet0/0/2]port default vlan 30
[SW3-GigabitEthernet0/0/2]int g0/0/3
[SW3-GigabitEthernet0/0/3]port link-t
[SW3-GigabitEthernet0/0/3]port link-type a
[SW3-GigabitEthernet0/0/3]port link-type access
[SW3-GigabitEthernet0/0/3]port def
[SW3-GigabitEthernet0/0/3]port default vlan 40
[SW3-GigabitEthernet0/0/3]int g0/0/1
[SW3-GigabitEthernet0/0/1]port link-t
[SW3-GigabitEthernet0/0/1]port link-type t
[SW3-GigabitEthernet0/0/1]port link-type trunk
[SW3-GigabitEthernet0/0/1]port t
[SW3-GigabitEthernet0/0/1]port trunk a
[SW3-GigabitEthernet0/0/1]port trunk allow-pass vlan all
LSW1配置
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys
[Huawei]sysname SW1
[SW1]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW1]port-g
[SW1]port-group g
[SW1]port-group group-member g0/0/1 g0/0/2
[SW1-port-group]port link-t
[SW1-port-group]port link-type t
[SW1-port-group]port link-type trunk
[SW1-GigabitEthernet0/0/1]port link-type trunk
[SW1-GigabitEthernet0/0/2]port link-type trunk
[SW1-port-group]port t
[SW1-port-group]port trunk a
[SW1-port-group]port trunk allow-pass vlan all
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[SW1-port-group]q
[SW1]dhcp en
[SW1]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[SW1]ip pool vlan10
Info:It's successful to create an IP address pool.
[SW1-ip-pool-vlan10]net
[SW1-ip-pool-vlan10]network 192.168.100.0 mask 25
[SW1-ip-pool-vlan10]gat
[SW1-ip-pool-vlan10]gateway-list 192.168.100.126
[SW1-ip-pool-vlan10]dns
[SW1-ip-pool-vlan10]dns-list 8.8.8.8
[SW1-ip-pool-vlan10]ip pool vlan20
Info:It's successful to create an IP address pool.
[SW1-ip-pool-vlan20]net
[SW1-ip-pool-vlan20]network192.168.100.128 mask 26
Error: Unrecognized command found at '^' position.
[SW1-ip-pool-vlan20]net
[SW1-ip-pool-vlan20]network 192.168.100.128 mask 26
[SW1-ip-pool-vlan20]gat
[SW1-ip-pool-vlan20]gateway-list 192.168.100.190
[SW1-ip-pool-vlan20]dns
[SW1-ip-pool-vlan20]dns-list 8.8.8.8
[SW1-ip-pool-vlan20]ip pool vlan30
Info:It's successful to create an IP address pool.
[SW1-ip-pool-vlan30]net
[SW1-ip-pool-vlan30]network 192.168.100.192 mask 27
[SW1-ip-pool-vlan30]gat
[SW1-ip-pool-vlan30]gateway-list 192.168.100.222
[SW1-ip-pool-vlan30]dns
[SW1-ip-pool-vlan30]dns-list 8.8.8.8
[SW1-ip-pool-vlan30]ip pool vlan40
Info:It's successful to create an IP address pool.
[SW1-ip-pool-vlan40]net
[SW1-ip-pool-vlan40]network 192.168.100.224 mask 27
[SW1-ip-pool-vlan40]gat
[SW1-ip-pool-vlan40]gateway-list 192.168.100.254
[SW1-ip-pool-vlan40]dns
[SW1-ip-pool-vlan40]dns-list 8.8.8.8
[SW1-ip-pool-vlan40]q
[SW1]int vlan 10
[SW1-Vlanif10]ip ad
[SW1-Vlanif10] User interface con0 is available
Please Press ENTER.
<SW1>u t m
Info: Current terminal monitor is off.
<SW1>sys
Enter system view, return user view with Ctrl+Z.
[SW1]int vlan 10
[SW1-Vlanif10]ip ad 192.168.100.126 25
[SW1-Vlanif10]int vlan 20
[SW1-Vlanif20]ip ad 192.168.100.190 26
[SW1-Vlanif20]int vlan 30
[SW1-Vlanif30]ip ad
[SW1-Vlanif30]ip address 192.168.100.222 27
[SW1-Vlanif30]int vlan 40
[SW1-Vlanif40]ip ad
[SW1-Vlanif40]ip address 192.168.100.254 27
[SW1-Vlanif40]dhcp se
[SW1-Vlanif40]dhcp select g
[SW1-Vlanif40]dhcp select global
[SW1-Vlanif40]int vlan 10
[SW1-Vlanif10]dhcp se
[SW1-Vlanif10]dhcp select g
[SW1-Vlanif10]dhcp select global
[SW1-Vlanif10]int vlan 20
[SW1-Vlanif20]dhcp se
[SW1-Vlanif20]dhcp select g
[SW1-Vlanif20]dhcp select global
[SW1-Vlanif20]int vlan 30
[SW1-Vlanif30]dhcp se
[SW1-Vlanif30]dhcp select G
[SW1-Vlanif30]dhcp select global
LSW2配置
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys
[Huawei]sysname SW2
[SW2]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW2]int g0/0/2
[SW2-GigabitEthernet0/0/2]port link-t
[SW2-GigabitEthernet0/0/2]port link-type a
[SW2-GigabitEthernet0/0/2]port link-type access
[SW2-GigabitEthernet0/0/2]port def
[SW2-GigabitEthernet0/0/2]port default vlan 10
[SW2-GigabitEthernet0/0/2]int g0/0/3
[SW2-GigabitEthernet0/0/3]port link-t
[SW2-GigabitEthernet0/0/3]port link-type a
[SW2-GigabitEthernet0/0/3]port link-type access
[SW2-GigabitEthernet0/0/3]port def
[SW2-GigabitEthernet0/0/3]port default vlan 20
[SW2-GigabitEthernet0/0/3]q
[SW2]int g0/0/1
[SW2-GigabitEthernet0/0/1]port link-t
[SW2-GigabitEthernet0/0/1]port link-type t
[SW2-GigabitEthernet0/0/1]port link-type trunk
[SW2-GigabitEthernet0/0/1]port t
[SW2-GigabitEthernet0/0/1]port trunk all
[SW2-GigabitEthernet0/0/1]port trunk allow-pass vlan all
LSW3配置
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys
[Huawei]sysname Sw3
[Sw3]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[Sw3]int g0/0/02
[Sw3-GigabitEthernet0/0/2]int g0/0/2
[Sw3-GigabitEthernet0/0/2]port lin-t
[Sw3-GigabitEthernet0/0/2]port link-t
[Sw3-GigabitEthernet0/0/2]port link-type a
[Sw3-GigabitEthernet0/0/2]port link-type access
[Sw3-GigabitEthernet0/0/2]port def
[Sw3-GigabitEthernet0/0/2]port default vlan 30
[Sw3-GigabitEthernet0/0/2]int g0/0/3
[Sw3-GigabitEthernet0/0/3]port link-t
[Sw3-GigabitEthernet0/0/3]port link-type a
[Sw3-GigabitEthernet0/0/3]port link-type access
[Sw3-GigabitEthernet0/0/3]port def
[Sw3-GigabitEthernet0/0/3]port default vlan 40
[Sw3-GigabitEthernet0/0/3]int g0/0/1
[Sw3-GigabitEthernet0/0/1]port link-t
[Sw3-GigabitEthernet0/0/1]port link-type t
[Sw3-GigabitEthernet0/0/1]port link-type trunk
[Sw3-GigabitEthernet0/0/1]port t
[Sw3-GigabitEthernet0/0/1]port trunk a
[Sw3-GigabitEthernet0/0/1]port trunk allow-pass vlan all
AR1配置
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname R1
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip address 192.168.1.254 24
[R1-GigabitEthernet0/0/0]int g0/0/1
[R1-GigabitEthernet0/0/1]ip address 192.168.2.254 24
[R1-GigabitEthernet0/0/1]int g0/0/2
[R1-GigabitEthernet0/0/2]ip address 192.168.100.254 24
[R1-GigabitEthernet0/0/2]q
[R1]acl 2000
[R1-acl-basic-2000]rule 10 deny source 192.168.2.0 0.0.0.255
[R1-acl-basic-2000]q
[R1]int g0/0/2
[R1-GigabitEthernet0/0/2]traffic-filter outbound acl 2000