思科mac地址绑定

第一步：得到PC1主机的mac地址MicrosoftWindowsXP[版本5.1.2600](C)版权所有1985-2001MicrosoftCorp.C:\ipconfig/allWindowsIPConfigurationHostName............:xuxpPrimaryDnsSuffix.......:digitalchina.comNodeType............:BroadcastIPRoutingEnabled........:NoWINSProxyEnabled........:NoEthernetadapter本地连接:Connection-specificDNSSuffix.:Description...........:Intel(R)PRO/100VENetworkConnectionPhysicalAddress.........:00-A0-D1-D1-07-FFDhcpEnabled...........:YesAutoconfigurationEnabled....:YesAutoconfigurationIPAddress...:169.254.27.232SubnetMask...........:255.255.0.0DefaultGateway.........:C:\我们得到了PC1主机的mac地址为：00-A0-D1-D1-07-FF。第二步：交换机全部恢复出厂设置，配置交换机的IP地址switch(Config)#interfacevlan1switch(Config-If-Vlan1)#ipaddress192.168.1.11255.255.255.0switch(Config-If-Vlan1)#noshutswitch(Config-If-Vlan1)#exitswitch(Config)#第三步：使能端口的MAC地址绑定功能switch(Config)#interfaceethernet0/0/1switch(Config-Ethernet0/0/1)#switchportport-securityswitch(Config-Ethernet0/0/1)#第四步：添加端口静态安全MAC地址，缺省端口最大安全MAC地址数为1switch(Config-Ethernet0/0/1)#switchportport-securitymac-address00-a0-d1-d1-07-ff验证配置：switch#showport-securitySecurityPortMaxSecurityAddrCurrentAddrSecurityAction(count)(count)---------------------------------------------------------------------------Ethernet0/0/111Protect---------------------------------------------------------------------------MaxAddresseslimitperport:128TotalAddressesinSystem:1switch#switch#showport-securityaddressSecurityMacAddressTable---------------------------------------------------------------------------VlanMacAddressTypePorts100-a0-d1-d1-07-ffSecurityConfiguredEthernet0/0/1---------------------------------------------------------------------------TotalAddressesinSystem:1MaxAddresseslimitinSystem:128switch#第五步：使用ping命令验证PC端口Ping结果原因PC10/0/1192.168.1.11通PC10/0/7192.168.1.11不通PC20/0/1192.168.1.11通PC20/0/7192.168.1.11通第六步：在一个以太口上静态捆绑多个MACSwitch(Config-Ethernet0/0/1)#switchportport-securitymaximum4Switch(Config-Ethernet0/0/1)#switchportport-securitymac-addressaa-aa-aa-aa-aa-aaSwitch(Config-Ethernet0/0/1)#switchportport-securitymac-addressaa-aa-aa-bb-bb-bbSwitch(Config-Ethernet0/0/1)#switchportport-securitymac-addressaa-aa-aa-cc-cc-cc验证配置：switch#showport-securitySecurityPortMaxSecurityAddrCurrentAddrSecurityAction(count)(count)---------------------------------------------------------------------------Ethernet0/0/144Protect---------------------------------------------------------------------------MaxAddresseslimitperport:128TotalAddressesinSystem:4switch#showport-securityaddressSecurityMacAddressTable---------------------------------------------------------------------------VlanMacAddressTypePorts100-a0-d1-d1-07-ffSecurityConfiguredEthernet0/0/11aa-aa-aa-aa-aa-aaSecurityConfiguredEthernet0/0/11aa-aa-aa-bb-bb-bbSecurityConfiguredEthernet0/0/11aa-aa-aa-cc-cc-ccSecurityConfiguredEthernet0/0/1---------------------------------------------------------------------------TotalAddressesinSystem:4MaxAddresseslimitinSystem:128switch#上面使用的都是静态捆绑MAC的方法，下面介绍动态mac地址绑定的基本方法，首先清空刚才做过的捆绑。第七步：清空端口与MAC绑定switch(Config)#switch(Config)#intethernet0/0/1switch(Config-Ethernet0/0/1)#noswitchportport-securityswitch(Config-Ethernet0/0/1)#exitswitch(Config)#exit验证配置：switch#showport-securitySecurityPortMaxSecurityAddrCurrentAddrSecurityAction(count)(count)------------------------------------------------------------------------------------------------------------------------------------------------------MaxAddresseslimitperport:128TotalAddressesinSystem:0第八步：使能端口的MAC地址绑定功能，动态学习MAC并转换switch(Config)#interfaceethernet0/0/1switch(Config-Ethernet0/0/1)#switchportport-securityswitch(Config-Ethernet0/0/1)#switchportport-securitylockswitch(Config-Ethernet0/0/1)#switchportport-securityconvertswitch(Config-Ethernet0/0/1)#exit验证配置：switch#showport-securityaddressSecurityMacAddressTable---------------------------------------------------------------------------VlanMacAddressTypePorts100-a0-d1-d1-07-ffSecurityConfiguredEthernet0/0/1---------------------------------------------------------------------------TotalAddressesinSystem:1MaxAddresseslimitinSystem:128switch#第九步：使用ping命令验证PC端口Ping结果原因PC10/0/1192.168.1.11通PC10/0/7192.168.1.11不通PC20/0/1192.168.1.11不通PC20/0/7192.168.1.11通七、注意事项和排错1、如果出现端口无法配置MAC地址绑定功能的情况，请检查交换机的端口是否运行了Spanning-tree，802.1x，端口汇聚或者端口已经配置为Trunk端口。MAC绑定在端口上与这些配置是互斥的，如果该端口要打开MAC地址绑定功能，就必须首先确认端口下的上述功能已经被关闭。2、当动态学习MAC时，无法执行“convert”命令时，请检查PC机网卡是否和该端口正确连接。3、端口Lock之后，该端口MAC地址学习功能被关闭，不允许其他的MAC进入该端口。八、配置序列略九、课后练习1、使用三台PC测试端口与MAC绑定功能。2、实现多个端口统一绑定。十、相关配置命令详解switchportport-security命令：switchportport-securitynoswitchportport-security功能：使能端口MAC地址绑定功能；本命令的no操作为关闭端口MAC地址绑定功能。命令模式：端口配置模式缺省情况：交换机端口不打开MAC地址绑定功能。使用指南：MAC地址绑定功能与802.1x、SpanningTree、端口汇聚功能存在互斥关系，因此如果要打开端口的MAC地址绑定功能，就必须关闭端口上的802.1x、SpanningTree、端口汇聚功能，且打开MAC地址绑定功能的端口不能是Trunk口。举例：使能端口1的MAC地址绑定功能。Switch(Config)#interfaceEthernet0/0/1Switch(Config-Ethernet0/0/1)#switchportport-securityswitchportport-securityconvert命令：switchportport-securityconvert功能：将端口学习到的动态MAC地址转化为静态安全MAC地址。命令模式：端口配置模式使用指南：必须在安全端口锁定之后才能执行端口动态MAC地址转化命令。执行此命令之后，