端口安全和ACL

端口安全

 

 安全地址表

 在查看mac地址表之前，在pc1，pc2，pc3中ping192.168.1.4（server1）.

在server1中pingpc1（192.168.1.1）

 子网划分

 

 LSW1配置

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys    
[Huawei]sysname SW1
[SW1]sys    
[SW1]sysname SW1-dhcp
[SW1-dhcp]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW1-dhcp]port-g    
[SW1-dhcp]port-group g    
[SW1-dhcp]port-group group-member g0/0/1 g0/0/2
[SW1-dhcp-port-group]port link-t    
[SW1-dhcp-port-group]port link-type t    
[SW1-dhcp-port-group]port link-type trunk 
[SW1-dhcp-GigabitEthernet0/0/1]port link-type trunk 
[SW1-dhcp-GigabitEthernet0/0/2]port link-type trunk 
[SW1-dhcp-port-group]port t    
[SW1-dhcp-port-group]port trunk a    
[SW1-dhcp-port-group]port trunk allow-pass vlan all
[SW1-dhcp-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[SW1-dhcp-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[SW1-dhcp-port-group]q
[SW1-dhcp]dhcp en    
[SW1-dhcp]dhcp enable 
Info: The operation may take a few seconds. Please wait for a moment.done.
[SW1-dhcp]ip pool vlan10
Info:It's successful to create an IP address pool.
[SW1-dhcp-ip-pool-vlan10]netw    
[SW1-dhcp-ip-pool-vlan10]network 192.168.100.0 mask 26
[SW1-dhcp-ip-pool-vlan10]gat    
[SW1-dhcp-ip-pool-vlan10]gateway-list 192.168.100.62
[SW1-dhcp-ip-pool-vlan10]dns    
[SW1-dhcp-ip-pool-vlan10]dns-list 8.8.8.8
[SW1-dhcp-ip-pool-vlan10]ip pool vlan20
Info:It's successful to create an IP address pool.
[SW1-dhcp-ip-pool-vlan20]net    
[SW1-dhcp-ip-pool-vlan20]network 192.168.100.64 mask 26
[SW1-dhcp-ip-pool-vlan20]gat    
[SW1-dhcp-ip-pool-vlan20]gateway-list 192.168.100.126
[SW1-dhcp-ip-pool-vlan20]dns    
[SW1-dhcp-ip-pool-vlan20]dns-list 8.8.8.8
[SW1-dhcp-ip-pool-vlan20]ip pool vlan30
Info:It's successful to create an IP address pool.  
[SW1-dhcp-ip-pool-vlan30]network 192.168.100.128 mask 26
[SW1-dhcp-ip-pool-vlan30]gat    
[SW1-dhcp-ip-pool-vlan30]gateway-list 192.168.100.190    
[SW1-dhcp-ip-pool-vlan30]dns-list 8.8.8.8
[SW1-dhcp-ip-pool-vlan30]ip pool vlan40
Info:It's successful to create an IP address pool.
[SW1-dhcp-ip-pool-vlan40]net    
[SW1-dhcp-ip-pool-vlan40]network 192.168.100.192 mask 26
[SW1-dhcp-ip-pool-vlan40]gat    
[SW1-dhcp-ip-pool-vlan40]gateway-list 192.168.100.254
[SW1-dhcp-ip-pool-vlan40]dns    
[SW1-dhcp-ip-pool-vlan40]dns-list 8.8.8.8
[SW1-dhcp-ip-pool-vlan40]q
[SW1-dhcp]int vlan 10
[SW1-dhcp-Vlanif10]ip ad    
[SW1-dhcp-Vlanif10]ip address 192.168.100.62 26
[SW1-dhcp-Vlanif10]dhcp se    
[SW1-dhcp-Vlanif10]dhcp select g    
[SW1-dhcp-Vlanif10]dhcp select global 
[SW1-dhcp-Vlanif10]int vlan 20
[SW1-dhcp-Vlanif20]ip ad    
[SW1-dhcp-Vlanif20]ip address 192.168.100.126 26
[SW1-dhcp-Vlanif20]dhcp se    
[SW1-dhcp-Vlanif20]dhcp select g    
[SW1-dhcp-Vlanif20]dhcp select global 
[SW1-dhcp-Vlanif20]int vlan 30
[SW1-dhcp-Vlanif30]ip ad    
[SW1-dhcp-Vlanif30]ip address 192.168.100.190 26
[SW1-dhcp-Vlanif30]dhcp se    
[SW1-dhcp-Vlanif30]dhcp select g    
[SW1-dhcp-Vlanif30]dhcp select global 
[SW1-dhcp-Vlanif30]int vlan 40
[SW1-dhcp-Vlanif40]ip ad    
[SW1-dhcp-Vlanif40]ip address 192.168.100.254 26
[SW1-dhcp-Vlanif40]dhcp se    
[SW1-dhcp-Vlanif40]dhcp select g    
[SW1-dhcp-Vlanif40]dhcp select global 
 

LSW2配置

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys    
[Huawei]sysname SW2
[SW2]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW2]int g0/0/2
[SW2-GigabitEthernet0/0/2]port link-t    
[SW2-GigabitEthernet0/0/2]port link-type a    
[SW2-GigabitEthernet0/0/2]port link-type access 
[SW2-GigabitEthernet0/0/2]port def    
[SW2-GigabitEthernet0/0/2]port default vlan 10
[SW2-GigabitEthernet0/0/2]int g0/0/3
[SW2-GigabitEthernet0/0/3]port link-t    
[SW2-GigabitEthernet0/0/3]port link-type a    
[SW2-GigabitEthernet0/0/3]port link-type access 
[SW2-GigabitEthernet0/0/3]port def    
[SW2-GigabitEthernet0/0/3]port default vlan 20
[SW2-GigabitEthernet0/0/3]int g0/0/1
[SW2-GigabitEthernet0/0/1]port link-t    
[SW2-GigabitEthernet0/0/1]port link-type t    
[SW2-GigabitEthernet0/0/1]port link-type trunk 
[SW2-GigabitEthernet0/0/1]port t    
[SW2-GigabitEthernet0/0/1]port trunk a    
[SW2-GigabitEthernet0/0/1]port trunk allow-pass vlan all
 

LSW3配置

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys    
[Huawei]sysname SW3
[SW3]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW3]int g0/0/2
[SW3-GigabitEthernet0/0/2]port link-t    
[SW3-GigabitEthernet0/0/2]port link-type a    
[SW3-GigabitEthernet0/0/2]port link-type access 
[SW3-GigabitEthernet0/0/2]port def    
[SW3-GigabitEthernet0/0/2]port default vlan 30
[SW3-GigabitEthernet0/0/2]int g0/0/3
[SW3-GigabitEthernet0/0/3]port link-t    
[SW3-GigabitEthernet0/0/3]port link-type a    
[SW3-GigabitEthernet0/0/3]port link-type access 
[SW3-GigabitEthernet0/0/3]port def    
[SW3-GigabitEthernet0/0/3]port default vlan 40
[SW3-GigabitEthernet0/0/3]int g0/0/1
[SW3-GigabitEthernet0/0/1]port link-t    
[SW3-GigabitEthernet0/0/1]port link-type t    
[SW3-GigabitEthernet0/0/1]port link-type trunk 
[SW3-GigabitEthernet0/0/1]port t    
[SW3-GigabitEthernet0/0/1]port trunk a    
[SW3-GigabitEthernet0/0/1]port trunk allow-pass vlan all
 

 LSW1配置

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys    
[Huawei]sysname SW1

[SW1]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW1]port-g    
[SW1]port-group g    
[SW1]port-group group-member g0/0/1 g0/0/2
[SW1-port-group]port link-t    
[SW1-port-group]port link-type t    
[SW1-port-group]port link-type trunk 
[SW1-GigabitEthernet0/0/1]port link-type trunk 
[SW1-GigabitEthernet0/0/2]port link-type trunk 
[SW1-port-group]port t    
[SW1-port-group]port trunk a    
[SW1-port-group]port trunk allow-pass vlan all
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[SW1-port-group]q
[SW1]dhcp en    
[SW1]dhcp enable 
Info: The operation may take a few seconds. Please wait for a moment.done.
[SW1]ip pool vlan10
Info:It's successful to create an IP address pool.
[SW1-ip-pool-vlan10]net    
[SW1-ip-pool-vlan10]network 192.168.100.0 mask 25
[SW1-ip-pool-vlan10]gat    
[SW1-ip-pool-vlan10]gateway-list 192.168.100.126
[SW1-ip-pool-vlan10]dns    
[SW1-ip-pool-vlan10]dns-list 8.8.8.8
[SW1-ip-pool-vlan10]ip pool vlan20
Info:It's successful to create an IP address pool.
[SW1-ip-pool-vlan20]net    
[SW1-ip-pool-vlan20]network192.168.100.128 mask 26
Error: Unrecognized command found at '^' position.
[SW1-ip-pool-vlan20]net    
[SW1-ip-pool-vlan20]network 192.168.100.128 mask 26
[SW1-ip-pool-vlan20]gat    
[SW1-ip-pool-vlan20]gateway-list 192.168.100.190
[SW1-ip-pool-vlan20]dns    
[SW1-ip-pool-vlan20]dns-list 8.8.8.8
[SW1-ip-pool-vlan20]ip pool vlan30
Info:It's successful to create an IP address pool.
[SW1-ip-pool-vlan30]net    
[SW1-ip-pool-vlan30]network 192.168.100.192 mask 27
[SW1-ip-pool-vlan30]gat    
[SW1-ip-pool-vlan30]gateway-list 192.168.100.222
[SW1-ip-pool-vlan30]dns    
[SW1-ip-pool-vlan30]dns-list 8.8.8.8
[SW1-ip-pool-vlan30]ip pool vlan40
Info:It's successful to create an IP address pool.
[SW1-ip-pool-vlan40]net    
[SW1-ip-pool-vlan40]network 192.168.100.224 mask 27
[SW1-ip-pool-vlan40]gat    
[SW1-ip-pool-vlan40]gateway-list 192.168.100.254
[SW1-ip-pool-vlan40]dns    
[SW1-ip-pool-vlan40]dns-list 8.8.8.8
[SW1-ip-pool-vlan40]q
[SW1]int vlan 10
[SW1-Vlanif10]ip ad    
[SW1-Vlanif10] User interface con0 is available

Please Press ENTER.

<SW1>u t m
Info: Current terminal monitor is off.
<SW1>sys
Enter system view, return user view with Ctrl+Z.
[SW1]int vlan 10
[SW1-Vlanif10]ip ad 192.168.100.126 25
[SW1-Vlanif10]int vlan 20
[SW1-Vlanif20]ip ad 192.168.100.190 26
[SW1-Vlanif20]int vlan 30
[SW1-Vlanif30]ip ad    
[SW1-Vlanif30]ip address 192.168.100.222 27
[SW1-Vlanif30]int vlan 40
[SW1-Vlanif40]ip ad    
[SW1-Vlanif40]ip address 192.168.100.254 27
[SW1-Vlanif40]dhcp se    
[SW1-Vlanif40]dhcp select g    
[SW1-Vlanif40]dhcp select global 
[SW1-Vlanif40]int vlan 10
[SW1-Vlanif10]dhcp se    
[SW1-Vlanif10]dhcp select g    
[SW1-Vlanif10]dhcp select global 
[SW1-Vlanif10]int vlan 20
[SW1-Vlanif20]dhcp se    
[SW1-Vlanif20]dhcp select g    
[SW1-Vlanif20]dhcp select global 
[SW1-Vlanif20]int vlan 30
[SW1-Vlanif30]dhcp se    
[SW1-Vlanif30]dhcp select G    
[SW1-Vlanif30]dhcp select global 

LSW2配置

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys    
[Huawei]sysname SW2
[SW2]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[SW2]int g0/0/2
[SW2-GigabitEthernet0/0/2]port link-t    
[SW2-GigabitEthernet0/0/2]port link-type a    
[SW2-GigabitEthernet0/0/2]port link-type access 
[SW2-GigabitEthernet0/0/2]port def    
[SW2-GigabitEthernet0/0/2]port default vlan 10
[SW2-GigabitEthernet0/0/2]int g0/0/3
[SW2-GigabitEthernet0/0/3]port link-t    
[SW2-GigabitEthernet0/0/3]port link-type a    
[SW2-GigabitEthernet0/0/3]port link-type access 
[SW2-GigabitEthernet0/0/3]port def    
[SW2-GigabitEthernet0/0/3]port default vlan 20
[SW2-GigabitEthernet0/0/3]q
[SW2]int g0/0/1
[SW2-GigabitEthernet0/0/1]port link-t    
[SW2-GigabitEthernet0/0/1]port link-type t    
[SW2-GigabitEthernet0/0/1]port link-type trunk 
[SW2-GigabitEthernet0/0/1]port t    
[SW2-GigabitEthernet0/0/1]port trunk all    
[SW2-GigabitEthernet0/0/1]port trunk allow-pass vlan all
 

LSW3配置

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys    
[Huawei]sysname Sw3
[Sw3]vlan batch 10 20 30 40
Info: This operation may take a few seconds. Please wait for a moment...done.
[Sw3]int g0/0/02
[Sw3-GigabitEthernet0/0/2]int g0/0/2
[Sw3-GigabitEthernet0/0/2]port lin-t    
[Sw3-GigabitEthernet0/0/2]port link-t    
[Sw3-GigabitEthernet0/0/2]port link-type a    
[Sw3-GigabitEthernet0/0/2]port link-type access 
[Sw3-GigabitEthernet0/0/2]port def    
[Sw3-GigabitEthernet0/0/2]port default vlan 30
[Sw3-GigabitEthernet0/0/2]int g0/0/3
[Sw3-GigabitEthernet0/0/3]port link-t    
[Sw3-GigabitEthernet0/0/3]port link-type a    
[Sw3-GigabitEthernet0/0/3]port link-type access 
[Sw3-GigabitEthernet0/0/3]port def    
[Sw3-GigabitEthernet0/0/3]port default vlan 40
[Sw3-GigabitEthernet0/0/3]int g0/0/1
[Sw3-GigabitEthernet0/0/1]port link-t    
[Sw3-GigabitEthernet0/0/1]port link-type t    
[Sw3-GigabitEthernet0/0/1]port link-type trunk 
[Sw3-GigabitEthernet0/0/1]port t    
[Sw3-GigabitEthernet0/0/1]port trunk a    
[Sw3-GigabitEthernet0/0/1]port trunk allow-pass vlan all

AR1配置

<Huawei>sys
Enter system view, return user view with Ctrl+Z. 
[Huawei]sysname R1
[R1]int g0/0/0 
[R1-GigabitEthernet0/0/0]ip address 192.168.1.254 24
[R1-GigabitEthernet0/0/0]int g0/0/1   
[R1-GigabitEthernet0/0/1]ip address 192.168.2.254 24
[R1-GigabitEthernet0/0/1]int g0/0/2  
[R1-GigabitEthernet0/0/2]ip address 192.168.100.254 24
[R1-GigabitEthernet0/0/2]q
[R1]acl 2000
[R1-acl-basic-2000]rule 10 deny source 192.168.2.0 0.0.0.255
[R1-acl-basic-2000]q
[R1]int g0/0/2
[R1-GigabitEthernet0/0/2]traffic-filter outbound acl 2000