以太网lan 06理解交换安全.pdf

设置交换机口令

配置登录标语

▪在用户名和口令登录提示符之前,定义和显示自定义标语.

SwitchX#bannerloginAccessforauthorizedusersonly.Pleaseenteryour

usernameandpassword.

net与SSH

▪net

–最常见的方法

–Insecure

▪SSH-encrypted

!–TheusernamecommandcreatetheusernameandpasswordfortheSSH

sessionUsernameciscopasswordcisco

ip-name

cryptokeygeneratersa

ipsshversion2

linevty04

loginlocal

transportinputssh

配置端口安全

CiscoCatalyst2960系列

SwitchX(config-if)#switchportport-security[mac-address

mac-address|mac-addresssticky[mac-address]|um

value|violation{restrict|shutdown}]

SwitchX(config)#interfacefa0/5

SwitchX(config-if)#switchportmodeaccess

SwitchX(config-if)#switchportport-security

SwitchX(config-if)#switchportport-securityum1

SwitchX(config-if)#switchportport-securitymac-addresssticky

SwitchX(config-if)#switchportport-securityviolationshutdown

检验Catalyst2960系列交换机的端口安全

SwitchX#showport-security[interfaceinterface-id][address][|

{begin|exclude|lude}expression]

SwitchX#showport-securityinterfacefastethe0/5

PortSecurity:Enabled

PortStatus:Secure-up

ViolationMode:Shutdown

AgingTime:20mins

AgingType:Absolute

SecureStaticAddressAging:Disabled

umMACAddresses:1

TotalMACAddresses:1

ConfiguredMACAddresses:0

StickyMACAddresses:0

LastSourceAddress:0000.0000.0000

SecurityViolationCount:0

检验Catalyst2960系列交换机的端口安全（续）

SwitchX#shport-securityaddress

SecureMacAddressTable

VlanMacAddressTypePortsRemainingAge

(mins)

1000