了解交換機(jī)安全性

EthernetLANsUnderstandingSwitchSecurityCommonThreatstoPhysicalInstallationsHardwarethreats物理硬件的破壞Environmentalthreats溫度，潮濕等Electricalthreats電壓等Maintenancethreats維護(hù)的威脅ConfiguringaSwitchPasswordVTY稱(chēng)為虛擬終端端口0-4。ConfiguringtheLoginBannerDefinesandenablesacustomizedbannertobedisplayedbeforetheusernameandpasswordloginprompts.當(dāng)用戶(hù)使用用戶(hù)名跟密碼登陸時(shí)將啟用SwitchX#bannerlogin"Accessforauthorizedusersonly.Pleaseenteryourusernameandpassword."Telnetvs.SSHAccessTelnetMostcommonaccessmethodInsecureSSH-encrypted!–TheusernamecommandcreatetheusernameandpasswordfortheSSHsessionUsernameciscopasswordciscoipdomain-namecryptokeygeneratersaipsshversion2linevty04loginlocaltransportinputsshSSH加密傳輸數(shù)據(jù)，TRANDSPORTINPUTSSH將只允許SSH連接CiscoCatalyst2960SeriesSwitchX(config-if)#switchportport-security[mac-addressmac-address|mac-addresssticky[mac-address]|maximumvalue|violation{restrict|shutdown}]

SwitchX(config)#interfacefa0/5SwitchX(config-if)#switchportmodeaccessSwitchX(config-if)#switchportport-securitySwitchX(config-if)#switchportport-securitymaximum1SwitchX(config-if)#switchportport-securitymac-addressstickySwitchX(config-if)#switchportport-securityviolationshutdownConfiguringPortSecurity靜態(tài)使用switchportport-securitymac-address0008.EEEE.EEEESwitchX#showport-security

[interfaceinterface-id][address][|{begin|exclude|include}expression]SwitchX#showport-securityinterfacefastethernet0/5Port

Security

:

EnabledPort

Status

:

Secure-upViolation

Mode

:

ShutdownAging

Time

:

20

minsAging

Type

:

AbsoluteSecureStatic

Address

Aging

:

DisabledMaximum

MAC

Addresses

:

1Total

MAC

Addresses

:

1Configured

MAC

Addresses

:

0Sticky

MAC

Addresses

:

0Last

Source

Address

:

0000.0000.0000Security

Violation

Count

:

0VerifyingPortSecurity

ontheCatalyst2960SeriesSwitchX#shport-securitySecurePortMaxSecureAddrCurrentAddrSecurityViolationSecurityAction(Count)(Count)(Count)--------------------------------------------------------------------------Fa0/5110Shutdown---------------------------------------------------------------------------TotalAddressesinSystem(excludingonemacperport):0MaxAddresseslimitinSystem(excludingonemacperport):1024SwitchX#shport-securityaddressSecureMacAddressTable-------------------------------------------------------------------VlanMacAddressTypePortsRemainingAge(mins)-------------------------------------10008.dddd.eeeeSecureConfiguredFa0/5--------------------------------------------------------------------TotalAddressesinSystem(excludingonemacperport):0MaxAddresseslimitinSystem(excludingonemacperport):1024VerifyingPortSecurity

ontheCatalyst2960Series(Cont.)SecuringUnusedPortsUnsecuredportscancreateasecurityhole.Aswitchpluggedintoanunusedportwillbeaddedtothenetwork.Secureunusedportsbydisablinginterfaces(ports)需要把未使用的端口關(guān)閉免成安全隱患。DisablinganInterface(Port)shutdownSwitchX(config-int)#Todisableaninterface,usetheshutdowncommandininterfaceconfigurationmode.Torestartadisabledinterface,usethenoformofthiscommand.SummaryThefirstlevelofsecurityisphysical.Passwordscanbeusedtolimitaccesstousersthathavebeengiventhepassword.Theloginbannercanbeusedtodisplayamessagebeforetheuser