1、网络系统建设与运维高级实验手册网络系统安全10 网络系统安全10.1 利用交换机保障网络安全10.1.1 项目背景企业局域网有大量用户，局域网内部网络面临着两个风险：计算机病毒的扩散和内部人员的恶意攻击。为了提高网络安全，管理员决定在交换机上使用技术手段，防止MAC泛洪、DHCP欺骗、ARP中间人攻击、IP源地址欺骗，避免合法用户的数据被中间人窃取。10.1.2 项目目的通过本项目可以掌握如下知识点和技能点，同时积累项目经验。配置交换机的接口安全。配置交换机的DHCP Snooping功能。配置交换机的动态ARP检测功能。配置交换机的IP源防护功能。10.1.3 项目拓扑本拓扑用一台交换机S1
2、模拟大量的接入层交换机，S1通过接口G0/0/4上连到DHCP Server（用S2模拟），通过接口G0/0/1、G0/0/2连接DHCP客户端UserA和UserB，通过接口G0/0/3连接静态配置IP地址的用户UserC。S1的接口G0/0/1、G0/0/2、G0/0/3都属于VLAN 1，G0/0/4接口是Trunk接口。10.1.4 项目规划本项目的核心任务是完成接入层交换机的安全配置，为保持项目的完整性，需完成前期准备工作。10.1.4.1 项目前期准备工作步骤 1VLAN配置：在两个交换机上配置Trunk，并把接口划分到相应VLAN。步骤 2DHCP服务器部署：把S2配置为DHCP
3、服务器。10.1.4.2 项目核心任务-完成接入层交换机的安全配置步骤 1配置接口安全防MAC泛洪攻击。步骤 2配置DHCP Snooping功能：G0/0/4接口为信任接口，并配置静态绑定表，防止DHCP欺骗。步骤 3使能动态ARP检测功能：使S1对收到的ARP报文对应的源IP、源MAC、VLAN以及接口信息进行DHCP Snooping绑定表匹配检查，防止ARP中间人攻击。步骤 4使能IP源防护功能：使S1对收到的IP报文对应的源IP、源MAC、VLAN以及接口信息进行DHCP Snooping绑定表匹配检查，防止IP源地址欺骗攻击。设备接口连接规划表和设备接口IP地址规划表如下。表10-
4、1 设备接口连接规划表设备接口接口类型VLAN对端设备及接口S1G0/0/1AccessVLAN 1UserA E0/0/1G0/0/2AccessVLAN 1UserB E0/0/1G0/0/3AccessVLAN 1UserC E0/0/1G0/0/4TrunkS2 G0/0/1S2G0/0/1TrunkS1 G0/0/4UserAE0/0/1S1 G0/0/1UserBE0/0/1S1 G0/0/2UserCE0/0/1S1 G0/0/3表10-2 设备接口IP地址规划表设备接口IP地址备注S1G0/0/1无G0/0/2无G0/0/3无G0/0/4无S2G0/0/1192.168.1.2
5、54/24UserAE0/0/1DHCPUserBE0/0/1DHCPUserCE0/0/1192.168.1.100/24网关：192.168.1.25410.1.5 项目实施10.1.5.1 项目准备工作步骤 1VLAN配置在两个交换机上配置Trunk，并把接口划分到相应VLAN。在R1上把接口G0/0/1、G0/0/2、G0/0/3链路类型改为access，G0/0/4链路类型改为trunk。在R2上把接口G0/0/4链路类型改为trunk。S1interface gigabitethernet 0/0/1S1-GigabitEthernet0/0/1port link-type acc
6、essS1-GigabitEthernet0/0/1quitS1interface gigabitethernet 0/0/2S1-GigabitEthernet0/0/2port link-type accessS1-GigabitEthernet0/0/2quitS1interface gigabitethernet 0/0/3S1-GigabitEthernet0/0/3port link-type accessS1-GigabitEthernet0/0/3quitS1interface gigabitethernet 0/0/4S1-GigabitEthernet0/0/4port l
7、ink-type trunkS1-GigabitEthernet0/0/4port trunk allow-pass vlan 1S1-GigabitEthernet0/0/4quitS2interface gigabitethernet 0/0/1S2-GigabitEthernet0/0/1port link-type trunkS2-GigabitEthernet0/0/1port trunk allow-pass vlan 1S2-GigabitEthernet0/0/1quit步骤 2DHCP服务器部署把S2配置为DHCP服务器。S2dhcp enable S2interface V
8、lanif1S2-Vlanif1ip address 192.168.1.254 255.255.255.0S2-Vlanif1dhcp select interfaceS2-Vlanif1dhcp server dns-list 1.1.1.1S2-Vlanif1quit在UserA主机上检查IP地址，如下。UserB主机操作类似。PCipconfigLink local IPv6 address.: fe80:5689:98ff:fe55:7659IPv6 address.: : / 128IPv6 gateway.: :IPv4 address.: 192.168.1.253Subnet
9、 mask.: 255.255.255.0Gateway.: 192.168.1.254Physical address.: 54-89-98-55-76-59DNS server.: 1.1.1.1以上看到已经获取IP地址在UserC主机上检查IP地址，如下。PCping 192.168.1.254Ping 192.168.1.254: 32 data bytes, Press Ctrl_C to breakFrom 192.168.1.254: bytes=32 seq=1 ttl=255 time=32 msFrom 192.168.1.254: bytes=32 seq=2 ttl=2
10、55 time=32 msFrom 192.168.1.254: bytes=32 seq=3 ttl=255 time=46 msFrom 192.168.1.254: bytes=32 seq=4 ttl=255 time=32 msFrom 192.168.1.254: bytes=32 seq=5 ttl=255 time=62 ms- 192.168.1.254 ping statistics - 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 32/40/
11、62 ms10.1.5.2 项目核心任务步骤 1配置接口安全防MAC泛洪攻击使能接口GE0/0/1、GE0/0/2、GE0/0/3的端口安全功能，限制MAC数为1；安全保护动作为restrict。S1interface gigabitethernet 0/0/1S1-GigabitEthernet0/0/1port-security enableS1-GigabitEthernet0/0/1port-security max-mac-num 1S1-GigabitEthernet0/0/1port-security protect-action restrictS1interface giga
12、bitethernet 0/0/2S1-GigabitEthernet0/0/2port-security enableS1-GigabitEthernet0/0/2port-security max-mac-num 1S1-GigabitEthernet0/0/2port-security protect-action restrictS1interface gigabitethernet 0/0/3S1-GigabitEthernet0/0/3port-security enableS1-GigabitEthernet0/0/3port-security max-mac-num 1S1-G
13、igabitEthernet0/0/3port-security protect-action restrict步骤 2配置DHCP Snooping功能把S1的G0/0/4接口为信任接口，并在G0/0/3接口配置静态绑定表。G0/0/1-3其他接口为不可信任接口。S1dhcp enableS1dhcp snooping enableS1vlan 1S1-vlan10dhcp snooping enableS1interface gigabitethernet 0/0/4S1-GigabitEthernet0/0/4dhcp snooping trustedS1-GigabitEthernet
14、0/0/4quitS1user-bind static ip-address 192.168.1.100 mac-add 5489-9827-6945 interface g0/0/3 vlan 1S1interface GigabitEthernet0/0/1S1-GigabitEthernet0/0/1dhcp snooping enableS1-GigabitEthernet0/0/1quitS1interface GigabitEthernet0/0/2S1-GigabitEthernet0/0/2dhcp snooping enableS1-GigabitEthernet0/0/2q
15、uitS1interface GigabitEthernet0/0/3S1-GigabitEthernet0/0/3dhcp snooping enableS1-GigabitEthernet0/0/3quit步骤 3使能动态ARP检测功能使S1对收到的ARP报文对应的源IP、源MAC、VLAN以及接口信息进行DHCP Snooping绑定表匹配检查，防止ARP中间人攻击。在S1的接口GE0/0/1、GE0/0/2、GE0/0/3下使能动态ARP检测功能。S1interface gigabitethernet 0/0/1S1-GigabitEthernet0/0/1arp anti-attac
16、k check user-bind enableS1-GigabitEthernet0/0/1arp anti-attack check user-bind check-item ip-address mac-address vlan S1-GigabitEthernet0/0/1quitS1interface gigabitethernet 0/0/2S1-GigabitEthernet0/0/2arp anti-attack check user-bind enableS1-GigabitEthernet0/0/2arp anti-attack check user-bind check-
17、item ip-address mac-address vlan S1-GigabitEthernet0/0/2quitS1interface gigabitethernet 0/0/3S1-GigabitEthernet0/0/3arp anti-attack check user-bind enableS1-GigabitEthernet0/0/3arp anti-attack check user-bind check-item ip-address mac-address vlan S1-GigabitEthernet0/0/3quit步骤 4使能IP源防护功能使S1对收到的IP报文对
18、应的源IP、源MAC、VLAN以及接口信息进行DHCP Snooping绑定表匹配检查，防止IP源地址欺骗攻击。在S1的接口GE0/0/1、GE0/0/2、GE0/0/3下使能IPSG功能。S1interface gigabitethernet 0/0/1S1-GigabitEthernet0/0/1ip source check user-bind enableS1-GigabitEthernet0/0/1ip source check user-bind check-item ip-address mac-address vlanS1-GigabitEthernet0/0/1quitS1i
19、nterface gigabitethernet 0/0/2S1-GigabitEthernet0/0/2ip source check user-bind enableS1-GigabitEthernet0/0/2ip source check user-bind check-item ip-address mac-address vlanS1-GigabitEthernet0/0/2quitS1interface gigabitethernet 0/0/3S1-GigabitEthernet0/0/3ip source check user-bind enableS1-GigabitEth
20、ernet0/0/3ip source check user-bind check-item ip-address mac-address vlanS1-GigabitEthernet0/0/3quit10.1.6 项目验证10.1.6.1 检查客户计算机IP地址和通信配置UserA、UserB计算机使用动态IP地址，UserC为静态IP（192.168.1.100）。以下是UserA的地址。PCipconfig /renewIP ConfigurationLink local IPv6 address.: fe80:5689:98ff:fe55:7659IPv6 address.: : /
21、128IPv6 gateway.: :IPv4 address.: 192.168.1.248Subnet mask.: 255.255.255.0Gateway.: 192.168.1.254Physical address.: 54-89-98-55-76-59DNS server.: 1.1.1.1PCping 192.168.1.254Ping 192.168.1.254: 32 data bytes, Press Ctrl_C to breakFrom 192.168.1.254: bytes=32 seq=1 ttl=255 time=93 msFrom 192.168.1.254
22、: bytes=32 seq=2 ttl=255 time=62 msFrom 192.168.1.254: bytes=32 seq=3 ttl=255 time=63 msFrom 192.168.1.254: bytes=32 seq=4 ttl=255 time=78 msFrom 192.168.1.254: bytes=32 seq=5 ttl=255 time=78 ms- 192.168.1.254 ping statistics - 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-tri
23、p min/avg/max = 62/74/93 ms以下是UserB的地址。PCipconfig /renewIP ConfigurationLink local IPv6 address.: fe80:5689:98ff:fed9:7a30IPv6 address.: : / 128IPv6 gateway.: :IPv4 address.: 192.168.1.247Subnet mask.: 255.255.255.0Gateway.: 192.168.1.254Physical address.: 54-89-98-D9-7A-30DNS server.: 1.1.1.1PCping
24、 192.168.1.254Ping 192.168.1.254: 32 data bytes, Press Ctrl_C to breakFrom 192.168.1.254: bytes=32 seq=1 ttl=255 time=32 msFrom 192.168.1.254: bytes=32 seq=2 ttl=255 time=47 msFrom 192.168.1.254: bytes=32 seq=3 ttl=255 time=47 msFrom 192.168.1.254: bytes=32 seq=4 ttl=255 time=47 msFrom 192.168.1.254
25、: bytes=32 seq=5 ttl=255 time=31 ms- 192.168.1.254 ping statistics - 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 31/40/47 ms以下是UserC的地址。PCipconfigLink local IPv6 address.: fe80:5689:98ff:fe27:6945IPv6 address.: : / 128IPv6 gateway.: :IPv4 address.: 192.168
26、.1.100Subnet mask.: 255.255.255.0Gateway.: 192.168.1.254Physical address.: 54-89-98-27-69-45DNS server.:PCping 192.168.1.254Ping 192.168.1.254: 32 data bytes, Press Ctrl_C to breakFrom 192.168.1.254: bytes=32 seq=1 ttl=255 time=63 msFrom 192.168.1.254: bytes=32 seq=2 ttl=255 time=46 msFrom 192.168.1
27、.254: bytes=32 seq=3 ttl=255 time=47 msFrom 192.168.1.254: bytes=32 seq=4 ttl=255 time=31 msFrom 192.168.1.254: bytes=32 seq=5 ttl=255 time=31 ms- 192.168.1.254 ping statistics - 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 31/43/63 ms10.1.6.2 检查DHCP Snoopi
28、ng情况 S1display dhcp snooping DHCP snooping global running information : DHCP snooping : Enable Static user max number : 1024 Current static user number : 1 Dhcp user max number : 1024 (default) Current dhcp user number : 2 Arp dhcp-snooping detect : Disable (default) Alarm threshold : 100 (default) Check dhcp-rate : Disable (default) Dhcp-rate limit(pps) : 100 (default) Alarm dhcp-rate : Disable (default) Alarm dhcp-rate thresho
