端口接入安全

端口接入安全：
1、端口安全
2、全局安全地址
3、DHCP Snooping
4、IP Source Guard
端口安全主要是在二层交换机上建立端口和地址的绑定关系，包括用户的源IP+MAC地址，控制接口记录的最大MAC地址数，默认是128
在交换机中的配置及其应用场景和作用：
1）Switchport port-security 开启端口安全
Switchport-security maximum 1 只允许记录绑定学习一个MAC地址
Sw port-security mac-address 0006.1d23.84a0.a345 vlan 10
Sw port-security binding 192.168.1.1
Sw port-security binding 0000.0000.0000.0233 vlan 10 192.168.1.10
Int f0/1
!
interface FastEthernet 0/1
switchport port-security binding 192.168.10.1
switchport port-security binding 206a.8a8d.6c32 vlan 10192.168.100.1
switchport port-security maximum 1
Sw port-security violation protect 设置端口违例方式{ protect |restric | shutdown }
查看show port-security address int f0/1
Ruijie(config)#switchport port-security help
Examples:
--------------------------------------------------------------------------------
>switchport port-security interface GigabitEthernet 0/1 mac-address
0000.0000.0002 vlan 3
Configure the secure address of port Gi0/1.
Gi0/1: port number; 0000.0000.0002: MAC address;
3: VLAN id;
--------------------------------------------------------------------------------
>switchport port-security interface GigabitEthernet 0/1 binding 0000.0000.0001
vlan 2 192.168.5.113
Bind the secure address of port Gi0/1 configured in source IP and source MAC
integrated mode.
Gi0/1: port number; 0000.0000.0001: MAC address;
2: VLAN id; 192.168.5.113: IP address;
--------------------------------------------------------------------------------
2）交换机全局绑定IP+MAC地址，只有源地址满足绑定关系的用户才能通过该交换机接入网络，防止非授权用户接入，用户接入不再受限于特定的端口
Address-bind install 开启全局绑定地址的功能
Address-bind 192.168.1.1 0023.8823.9920.00f1
Address-bind uplink f0/25 上联口是用户的出接口
Ruijie(config)#address-bind help
Examples:
--------------------------------------------------------------------------------
>address-bind 1.1.1.1 0000.0000.1111
Set the IP+MAC address bind.
1.1.1.1: IP address; 0000.0000.1111: MAC address;
--------------------------------------------------------------------------------
>address-bind ipv6-mode compatible
Set the compatible address-bind mode, strict by default.
--------------------------------------------------------------------------------
>address-bind uplink GigabitEthernet 0/1
Set the Gi0/1 as the address-bind exceptional interface.
--------------------------------------------------------------
3）Dhcp soonping 防用户私设dhcp服务器
开启dhcp snooping 后所有端口都是Untrust接口
Ip Dhcp snooping
Int gi0/25
Ip Dhcp snooping trust 设置上联口为trust口
只转发从trust口接受到的dhcp响应报文（offer、ACK、NAK）
可以记录dhcp报文中的信息，记录用户IP+MAC 端口VLAN ID等作为安全检查的依据
5）IP source guard
IPSG维护ip源地址绑定数据库，检查接收到的所有的非Dhcp的IP报文中的源IP+MAC，丢弃不匹配的数据
IP source guard
Ruijie(config-if-GigabitEthernet 0/26)#ip verify source ?
port-security Port security
<cr>
Ruijie(config-if-GigabitEthernet 0/26)#ip verify source port-security
在dhcp snooping 的Untrust 口开启IPSG功能，仅仅检查源IP地址
IP verify source
Ruijie(config)#ip dhcp snooping verify mac-address ?
<cr>
在dhcp snooping 的Untrust口开启IPSG功能，检查源IP+源MAC
Int gi0/25
Ip verify source port-seurity
6）配置静态源地址绑定：
Conf t
Ip source binding 0025.5511.4411.5531 vlan 10 102.178.1.1 interface f0/1 以上是今天四个接入安全的知识。