會(huì)計(jì)學(xué)1網(wǎng)絡(luò)設(shè)備調(diào)試交換機(jī)端口安全本章結(jié)構(gòu)端口安全DHCP監(jiān)聽(tīng)的原理DHCP監(jiān)聽(tīng)配置與示例IP源防護(hù)配置與示例IP源防護(hù)原理交換機(jī)端口安全端口安全的配置端口安全配置示例DHCP監(jiān)聽(tīng)常見(jiàn)數(shù)據(jù)鏈路層安全威脅動(dòng)態(tài)ARP檢測(cè)配置與示例IP源防護(hù)動(dòng)態(tài)ARP檢測(cè)動(dòng)態(tài)ARP檢測(cè)原理第1頁(yè)/共47頁(yè)F0/3回顧交換機(jī)轉(zhuǎn)發(fā)原理PC1與PC2通信常見(jiàn)數(shù)據(jù)鏈路層安全威脅F0/1F0/2PC1PC2MAC–Address-Table0050.56c0.00010050.56c0.0002PC30050.56c0.0001FFFF.FFFF.FFFF0050.56c0.0002ARP廣播單播幀轉(zhuǎn)發(fā)數(shù)據(jù)第2頁(yè)/共47頁(yè)MAC地址擴(kuò)散大量偽造源MAC地址的數(shù)據(jù)幀使MAC地址表溢出導(dǎo)致MAC地址表中找不到數(shù)據(jù)幀目的地址所對(duì)應(yīng)的條目常見(jiàn)數(shù)據(jù)鏈路層安全威脅F0/1F0/2PC1PC2MAC–Address-Table0050.56c0.00010050.56c0.0002PC30050.56c0.00010050.56c0.0002溢出偽造大量源MAC地址F0/3因MAC地址表溢出，無(wú)法查找表轉(zhuǎn)發(fā)，數(shù)據(jù)幀被廣播形式發(fā)送發(fā)給PC2的單播幀PC3獲得了PC1、PC2之間傳輸?shù)臄?shù)據(jù)第3頁(yè)/共47頁(yè)ARP攻擊的原理欺騙其他所有計(jì)算機(jī)欺騙被攻擊計(jì)算機(jī)常見(jiàn)數(shù)據(jù)鏈路層安全威脅PC1PC2網(wǎng)關(guān)網(wǎng)關(guān)的MAC地址是XX-XX-XX-XX-XX-XX（虛假M(fèi)AC地址）PC1的MAC地址是XX-XX-XX-XX-XX-XX（虛假M(fèi)AC地址）Internet第4頁(yè)/共47頁(yè)ARP欺騙原理欺騙網(wǎng)關(guān)欺騙主機(jī)常見(jiàn)數(shù)據(jù)鏈路層安全威脅PC1PC2網(wǎng)關(guān)我是網(wǎng)關(guān)，我的MAC地址是XX-XX-XX-XX-XX-XX（PC2的MAC地址）我是PC1，我的MAC地址是XX-XX-XX-XX-XX-XX（PC2的MAC地址）InternetPC1訪問(wèn)互聯(lián)網(wǎng)的流量需要經(jīng)過(guò)PC2轉(zhuǎn)發(fā)PC1PC2我是PC1，我的MAC地址是XX-XX-XX-XX-XX-XX（PC3的MAC地址）我是PC2，我的MAC地址是XX-XX-XX-XX-XX-XX（PC3的MAC地址）PC3PC1到PC2的流量需要經(jīng)過(guò)PC3轉(zhuǎn)發(fā)第5頁(yè)/共47頁(yè)DHCP服務(wù)器欺騙與DHCP地址耗盡DHCP服務(wù)器欺騙即客戶端將自己配置為DHCP服務(wù)器，分派虛假的IP地址及其信息或者直接響應(yīng)DHCP請(qǐng)求DHCP地址耗盡即客戶端不斷的冒充新客戶發(fā)送DHCP請(qǐng)求，請(qǐng)求服務(wù)器分派IP地址，這樣很快耗盡DHCP配置的IP地址池，其他計(jì)算機(jī)無(wú)法使用IP地址欺騙客戶端使用自己配置的IP地址冒充其他客戶端或網(wǎng)絡(luò)管理員，對(duì)其他用戶、設(shè)備、服務(wù)器等進(jìn)行非法操作IP地址欺騙主要是利用自行配置IP地址實(shí)現(xiàn)的常見(jiàn)數(shù)據(jù)鏈路層安全威脅第6頁(yè)/共47頁(yè)交換機(jī)端口安全的作用基于MAC地址限制、允許客戶端流量避免MAC地址擴(kuò)散攻擊避免MAC地址欺騙攻擊（主機(jī)使用虛假M(fèi)AC地址發(fā)送非法數(shù)據(jù)）

端口安全F0/3F0/1F0/2第7頁(yè)/共47頁(yè)啟用交換機(jī)端口安全特性啟用端口安全的接口不能是動(dòng)態(tài)協(xié)商(dynamic)模式，必須配置接口為接入或干道模式配置允許訪問(wèn)網(wǎng)絡(luò)的MAC地址配置接口允許的最大活躍地址數(shù)量配置靜態(tài)綁定的MAC地址

交換機(jī)端口安全的配置5-1Switch(config-if)#switchportport-securitySwitch(config-if)#switchportport-securitymaximum{max-addr}max-addr參數(shù)的范圍是1～8192，在默認(rèn)情況下為1Switch(config-if)#switchportport-securitymac-address{mac-addr}mac-addr為靜態(tài)綁定的MAC地址第8頁(yè)/共47頁(yè)配置老化時(shí)間如果同一端口主機(jī)經(jīng)常變化，而舊MAC地址一直保留，這可能導(dǎo)致新連接到端口的客戶無(wú)法正常通訊配置交換機(jī)接口老化時(shí)間，讓交換機(jī)刪除一段時(shí)間內(nèi)沒(méi)有流量的MAC地址time參數(shù)范圍是1～1440分鐘，默認(rèn)為0表示不刪除absolute參數(shù)為老化時(shí)間到期后，刪除所有MAC地址并重新學(xué)習(xí)inactivity參數(shù)為與端口連接的客戶端一段時(shí)間（老化時(shí)間）沒(méi)有流量，就將其MAC地址從地址表中刪除交換機(jī)端口安全的配置5-2Switch(config-if)#switchportport-securityagingtime{time}Switch(config-if)#switchportport-securityagingtype{absolute|inactivity}Switch(config-if)#switchportport-securityagingstatic默認(rèn)情況下靜態(tài)綁定的MAC地址并不受老化時(shí)間的影響，Cisco交

換機(jī)也可讓靜態(tài)綁定的MAC地址老化第9頁(yè)/共47頁(yè)配置MAC地址違規(guī)后的策略MAC地址違規(guī)最大安全數(shù)目的MAC地址表之外的一個(gè)新的MAC地址訪問(wèn)該端口一個(gè)配置為其他接口安全MAC地址的MAC地址試圖訪問(wèn)這個(gè)端口當(dāng)出現(xiàn)違規(guī)情況時(shí)，有三種處理方式shutdown：端口成為err-disable狀態(tài)，相當(dāng)于關(guān)閉端口，默認(rèn)處理方式protect：將違規(guī)的MAC地址的分組丟棄，但端口處于UP狀態(tài)。交換機(jī)不記錄違規(guī)分組restrict：將違規(guī)的MAC地址的分組丟棄，但端口處于UP狀態(tài)。交換機(jī)記錄違規(guī)分組交換機(jī)端口安全的配置5-3Switch(config-if)#switchportport-securityviolation{protect|restrict|shutdown}第10頁(yè)/共47頁(yè)當(dāng)端口進(jìn)入err-disable狀態(tài)時(shí)，恢復(fù)接口狀態(tài)的方法有兩種手動(dòng)恢復(fù)先關(guān)閉端口（shutdown），然后再開(kāi)啟端口（noshutdown）

端口恢復(fù)為正常狀態(tài)自動(dòng)恢復(fù)設(shè)置err-disable計(jì)時(shí)器，端口進(jìn)入err-disable狀態(tài)時(shí)開(kāi)始計(jì)時(shí)，計(jì)時(shí)器超出后端口狀態(tài)自動(dòng)恢復(fù)交換機(jī)端口安全的配置5-4Switch(config)#errdisablerecoverycausepsecure-violationSwitch(config)#errdisablerecoveryinterval{time}恢復(fù)時(shí)間間隔出現(xiàn)err-disable狀態(tài)的原因err-disable狀態(tài)的端口，默認(rèn)情況下不會(huì)自動(dòng)恢復(fù)第11頁(yè)/共47頁(yè)配置端口安全的sticky（粘連）特性當(dāng)企業(yè)內(nèi)網(wǎng)所有端口均要啟用端口安全時(shí)，靜態(tài)綁定的MAC地址的工作量時(shí)十分巨大sticky特性能動(dòng)態(tài)的將交換機(jī)接口學(xué)習(xí)到的MAC加入到運(yùn)行配置中，形成綁定關(guān)系交換機(jī)端口安全的配置5-5Switch(config)#switchportport-securitymac-addresssticky第12頁(yè)/共47頁(yè)在交換機(jī)上配置端口安全端口安全配置示例5-1PC1PC2F0/1F0/2Switch#showrun……interfaceFastEthernet0/2switchportaccessvlan2switchportmodeaccessswitchportport-security

switchportport-securityagingtime1

switchportport-securityviolationrestrict

switchportport-securityagingtypeinactivity

switchportport-securitymac-address0025.1234.1258……啟用端口安全配置老化時(shí)間，1分鐘配置違規(guī)策略配置老化策略配置靜態(tài)綁定第13頁(yè)/共47頁(yè)查看端口安全的狀態(tài)端口安全配置示例5-2Switch#showport-securityinterfacefastEthernet0/2PortSecurity:EnabledPortStatus:Secure-upViolationMode:RestrictAgingTime:1minsAgingType:InactivitySecureStaticAddressAging:DisabledMaximumMACAddresses:1TotalMACAddresses:1ConfiguredMACAddresses:1StickyMACAddresses:0LastSourceAddress:Vlan:0025.1234.1258:2SecurityViolationCount:0端口狀態(tài)違規(guī)策略最大MAC地址數(shù)量靜態(tài)綁定MAC地址數(shù)量安全違規(guī)次數(shù)第14頁(yè)/共47頁(yè)修改違規(guī)策略為shutdown當(dāng)F0/2端口接入其他MAC地址的設(shè)備，端口將進(jìn)入errdisable狀態(tài)，系統(tǒng)日志如下所示端口安全配置示例5-3%PM-4-ERR_DISABLE:psecure-violationerrordetectedonFa0/2,puttingFa0/2inerr-disablestate%PORT_SECURITY-2-PSECURE_VIOLATION:Securityviolationoccurred,causedbyMACaddress0021.1ba5.6983onportFastEthernet0/2.%LINEPROTO-5-UPDOWN:LineprotocolonInterfaceFastEthernet0/2,changedstatetodown%LINK-3-UPDOWN:InterfaceFastEthernet0/2,changedstatetodown端口狀態(tài)改變第15頁(yè)/共47頁(yè)查看端口安全狀態(tài)端口安全配置示例5-4Switch#showport-securityinterfacefastEthernet0/2PortSecurity:EnabledPortStatus:Secure-shutdownViolationMode:ShutdownAgingTime:1minsAgingType:InactivitySecureStaticAddressAging:DisabledMaximumMACAddresses:1TotalMACAddresses:1ConfiguredMACAddresses:1StickyMACAddresses:0LastSourceAddress:Vlan:0021.1ba5.6983:2SecurityViolationCount:1端口狀態(tài)違規(guī)次數(shù)第16頁(yè)/共47頁(yè)查看處于errdisable狀態(tài)的端口顯示端口安全狀態(tài)的摘要信息端口安全配置示例5-5Switch#showinterfacesstatuserr-disabled

PortNameStatusReasonFa0/2err-disabledpsecure-violationErrdisable狀態(tài)原因Switch#showport-securitySecurePortMaxSecureAddrCurrentAddrSecurityViolationSecurityAction(Count)(Count)(Count)---------------------------------------------------------------------------Fa0/2111Shutdown---------------------------------------------------------------------------TotalAddressesinSystem(excludingonemacperport):0MaxAddresseslimitinSystem(excludingonemacperport):8192第17頁(yè)/共47頁(yè)DHCP監(jiān)聽(tīng)（DHCPSnooping）保證客戶端能夠從正確的DHCP服務(wù)器獲得IP地址避免DHCP服務(wù)器欺騙和DHCP地址耗盡限制客戶端發(fā)送DHCP請(qǐng)求的速度，從而減緩DHCP資源耗盡攻擊DHCP監(jiān)聽(tīng)將交換機(jī)端口分為兩種非信任端口連接終端設(shè)備的端口，該端口客戶端只能發(fā)送DHCP請(qǐng)求報(bào)文，而丟棄來(lái)自該端口的其他所有DHCP報(bào)文（DHCPoffer等）信任端口連接合法的DHCP服務(wù)器或者匯聚接口，能夠轉(zhuǎn)發(fā)和接收所有DHCP報(bào)文DHCP監(jiān)聽(tīng)的原理2-1第18頁(yè)/共47頁(yè)DHCP監(jiān)聽(tīng)?wèi)?yīng)用實(shí)例DHCP監(jiān)聽(tīng)的原理2-2客戶機(jī)1客戶機(jī)2客戶機(jī)3客戶機(jī)4DHCP服務(wù)器信任信任信任信任信任信任信任信任信任非信任非信任非信任非信任第19頁(yè)/共47頁(yè)啟用DHCP監(jiān)聽(tīng)設(shè)置DHCP監(jiān)聽(tīng)作用于那個(gè)VLAN配置端口信任或非信任啟用DHCP監(jiān)聽(tīng)后，默認(rèn)所有端口為非信任端口配置端口為信任端口DHCP監(jiān)聽(tīng)配置3-1Switch(config)#ipdhcpsnoopingvlannumberSwitch(config-if)#ipdhcpsnoopingtrustSwitch(config)#ipdhcpsnooping可設(shè)置多個(gè)Vlan第20頁(yè)/共47頁(yè)DHCP報(bào)文中的“選項(xiàng)82”選項(xiàng)中主要包括：DHCP請(qǐng)求報(bào)文進(jìn)入設(shè)備的端口、屬于的Vlan、交換機(jī)的MAC等信息DHCP服務(wù)器可以根據(jù)這些信息更加精確的為客戶端分配IP地址、設(shè)置策略等報(bào)文中插入選項(xiàng)82信息

DHCP監(jiān)聽(tīng)配置3-2Switch(config)#ipdhcpsnoopinginformationoption第21頁(yè)/共47頁(yè)限制DHCP報(bào)文速率，減緩DHCP耗盡攻擊啟用核實(shí)MAC地址功能，避免DHCP耗盡攻擊檢測(cè)非信任端口的請(qǐng)求報(bào)文中源MAC地址和DHCP請(qǐng)求報(bào)文中的客戶端MAC地址是否相同DHCP監(jiān)聽(tīng)配置3-3速率單位pps在非信任端口配置Switch(config-if)#ipdhcpsnoopinglimitraterateSwitch(config)#ipdhcpsnoopingverifymac-address第22頁(yè)/共47頁(yè)在交換機(jī)上啟用DHCP監(jiān)聽(tīng)，限制非信任端口DHCP報(bào)文速率為100ppsDHCP監(jiān)聽(tīng)配置示例4-1F0/22F0/21F0/18PC1PC2DHCP服務(wù)器第23頁(yè)/共47頁(yè)交換機(jī)上啟用DHCP監(jiān)聽(tīng)配置DHCP監(jiān)聽(tīng)配置示例4-2Switch(config)#ipdhcpsnoopingSwitch(config)#ipdhcpsnoopingvlan1Switch(config)#ipdhcpsnoopinginformationoptionSwitch(config)#interfacefastEthernet0/21Switch(config-if)#ipdhcpsnoopingtrustSwitch(config-if)#exitSwitch(config)#interfacerangefastEthernet0/1-20Switch(config-if-range)#ipdhcpsnoopinglimitrate100Switch(config-if-range)#exitSwitch(config)#interfacerangefastEthernet0/22-24Switch(config-if-range)#ipdhcpsnoopinglimitrate100Switch(config-if-range)#exit啟用DHCP監(jiān)聽(tīng)啟用“選項(xiàng)82”設(shè)置信任端口DHCP報(bào)文限速第24頁(yè)/共47頁(yè)查看DHCP監(jiān)聽(tīng)的狀態(tài)DHCP監(jiān)聽(tīng)配置示例4-3Switch#showipdhcpsnoopingSwitchDHCPsnoopingisenabledDHCPsnoopingisconfiguredonfollowingVLANs:1DHCPsnoopingisconfiguredonthefollowingInterfaces:Insertionofoption82isenabledcircuit-idformat:vlan-mod-portremote-idformat:MACOption82onuntrustedportisnotallowedVerificationofhwaddrfieldisenabledInterfaceTrustedRatelimit(pps)-----------------------------------------------FastEthernet0/1no100……FastEthernet0/20no100FastEthernet0/21yesunlimitedFastEthernet0/22no100……DHCP監(jiān)聽(tīng)已啟用監(jiān)聽(tīng)VLAN1監(jiān)聽(tīng)VLAN1DHCP報(bào)文限速第25頁(yè)/共47頁(yè)查看靜態(tài)DHCP監(jiān)聽(tīng)綁定表DHCP綁定表是部署IP源防護(hù)和動(dòng)態(tài)ARP檢測(cè)的基礎(chǔ)清除綁定表DHCP監(jiān)聽(tīng)配置示例4-4Switch#showipdhcpsnoopingbindingMacAddressIpAddressLease(sec)TypeVLANInterface--------------------------------------------------------------------------------00:0C:29:DA:8C:76192.168.2.13515748dhcp-snooping1FastEthernet0/22D0:27:88:47:CE:FA192.168.2.14516771dhcp-snooping1FastEthernet0/18Totalnumberofbindings:2Switch#clearipdhcpsnoopingbinding第26頁(yè)/共47頁(yè)請(qǐng)思考：常見(jiàn)的數(shù)據(jù)鏈路層安全威脅有哪些？端口如何從err-disable狀態(tài)恢復(fù)？DHCP監(jiān)聽(tīng)將交換機(jī)端口分為哪兩種？小結(jié)第27頁(yè)/共47頁(yè)是一種基于IP/MAC的端口流量過(guò)濾技術(shù)確?？蛻舳瞬荒苁褂米孕兄付ǖ腎P地址，也不能使用其他客戶正在使用的IP地址以DHCP監(jiān)聽(tīng)技術(shù)為基礎(chǔ)只支持二層接口，包括接入接口或干道接口IP源防護(hù)兩種過(guò)濾策略源IP地址過(guò)濾根據(jù)源IP地址對(duì)IP流量進(jìn)行過(guò)濾源IP和源MAC地址過(guò)濾根據(jù)源IP地址和源MAC地址對(duì)IP流量進(jìn)行過(guò)濾IP源防護(hù)原理啟用DHCP監(jiān)聽(tīng)時(shí)須啟用選項(xiàng)82第28頁(yè)/共47頁(yè)啟用DHCP監(jiān)聽(tīng)啟用IP源防護(hù)源IP地址過(guò)濾源IP和源MAC地址過(guò)濾首先需要啟用端口安全（switchportport-security）IP源防護(hù)配置2-1Switch(config-if)#ipverifysource//Cisco35系列交換機(jī)命令或Switch(config-if)#ipverifysourcevlandhcp-snooping//Cisco45/65系列交換機(jī)命令Switch(config-if)#ipverifysourceport-security//Cisco35系列交換機(jī)命令或Switch(config-if)#ipverifysourcevlandhcp-snoopingport-security//Cisco45/65系列交換機(jī)命令第29頁(yè)/共47頁(yè)對(duì)于使用靜態(tài)IP的主機(jī)，手動(dòng)配置靜態(tài)IP源綁定查看IP源綁定表查看IP源防護(hù)過(guò)濾器的狀態(tài)IP源防護(hù)配置2-2Switch(config)#ipsourcebindingmac-addressvlanvlan-number

ip-addressinterfaceinterface-typeinterface-numberSwitch#showipsourcebindingSwitch#showipverifysource第30頁(yè)/共47頁(yè)配置IP源防護(hù)，使用源IP和源MAC地址過(guò)濾交換機(jī)Switch的F0/18接口為信任接口在F0/1、F0/2接口上開(kāi)啟IP源防護(hù)PC1自動(dòng)獲取IP地址，而PC2使用固定IP地址IP源防護(hù)配置示例4-1F0/1F0/2F0/18SwitchCisco3560DHCPServerPC1PC2:192.168.100.2第31頁(yè)/共47頁(yè)在交換機(jī)Switch上啟用IP源防護(hù)配置IP源防護(hù)配置示例4-2Switch(config)#ipdhcpsnoopingSwitch(config)#ipdhcpsnoopingvlan10Switch(config)#ipdhcpsnoopinginformationoptionSwitch(config)#interfaceFastEthernet0/1Switch(config-if)#switchportaccessvlan10Switch(config-if)#switchportport-securitySwitch(config-if)#ipverifysourceport-securitySwitch(config)#interfaceFastEthernet0/2Switch(config-if)#switchportaccessvlan10Switch(config-if)#switchportport-securitySwitch(config-if)#ipverifysourceport-securitySwitch(config)#interfacefastEthernet0/18Switch(config-if)#ipdhcpsnoopingtrust啟用DHCP監(jiān)聽(tīng)啟用選項(xiàng)82啟用IP源防護(hù)啟用IP源防護(hù)設(shè)置信任端口第32頁(yè)/共47頁(yè)配置DHCP服務(wù)器配置手工綁定由于PC2使用固定IP地址所以需要手工進(jìn)行綁定IP源防護(hù)配置示例4-3Switch-DHCP(config)#ipdhcpexcluded-address192.168.100.1Switch-DHCP(config)#ipdhcpexcluded-address192.168.100.2Switch-DHCP(config)#ipdhcpexcluded-address192.168.100.5Switch-DHCP(config)#ipdhcppooltestSwitch-DHCP(dhcp-config)#network192.168.100.0255.255.255.0Switch-DHCP(dhcp-config)#default-router192.168.100.1

Switch-DHCP(config)#interfaceVlan10Switch-DHCP(config-if)#ipdhcprelayinformationtrustedSwitch-DHCP(config-if)#ipaddress192.168.100.5255.255.255.0配置DHCP中繼帶82信息的DHCP報(bào)文Switch(config)#ipsourcebinding000C.29BE.C63Avlan10192.168.100.2interfaceFa0/2第33頁(yè)/共47頁(yè)查看DHCP監(jiān)聽(tīng)綁定表查看IP源綁定表IP源防護(hù)配置示例4-4Switch#showipdhcpsnoopingbindingMacAddressIpAddressLease(sec)TypeVLANInterface--------------------------------------------------------------------------------D0:27:88:47:CE:FA192.168.100.385998dhcp-snooping10FastEthernet0/1Totalnumberofbindings:1Switch#showipsourcebindingMacAddressIpAddressLease(sec)TypeVLANInterface--------------------------------------------------------------------------------D0:27:88:47:CE:FA192.168.100.385972dhcp-snooping10FastEthernet0/100:0C:29:BE:C6:3A192.168.100.2infinitestatic10FastEthernet0/2Totalnumberofbindings:2查看IP源防護(hù)過(guò)濾器的狀態(tài)Switch#showipverifysourceInterfaceFilter-typeFilter-modeIP-addressMac-addressVlan-------------------------------------------------------------------------Fa0/1ip-macactive192.168.100.3D0:27:88:47:CE:FA10Fa0/2ip-macactive192.168.100.200:0C:29:BE:C6:3A10第34頁(yè)/共47頁(yè)動(dòng)態(tài)ARP檢測(cè)（DynamicARPinspection，DAI）DAI是一種與DHCP監(jiān)聽(tīng)和IP源防護(hù)相結(jié)合的安全特性根據(jù)DHCP監(jiān)聽(tīng)綁定表以及IP源防護(hù)中靜態(tài)IP源綁定表的內(nèi)容對(duì)ARP報(bào)文進(jìn)行檢測(cè)可設(shè)定ARP報(bào)文速率（pps）超出規(guī)定值時(shí)，交換機(jī)會(huì)將端口置為err-disable狀態(tài)動(dòng)態(tài)ARP檢測(cè)信任PC1PC2信任非信任非信任非信任DHCP服務(wù)器第35頁(yè)/共47頁(yè)在指定Vlan上啟用DAI配置信任接口限制入站ARP報(bào)文的速率動(dòng)態(tài)ARP檢測(cè)配置2-1Switch(config)#iparpinspectionvlannumberSwitch(config-if)#iparpinspectiontrustSwitch(config-if)#iparpinspectionlimitratepackets-per-second范圍為0-2048，默認(rèn)為15DAI檢查所有ARP報(bào)文，當(dāng)ARP報(bào)文較多會(huì)大量消耗CPU資源第36頁(yè)/共47頁(yè)查看啟用DAI的端口以及信任狀態(tài)等信息查看啟用DAI的Vlan相關(guān)信息查看啟用DAI的Vlan中數(shù)據(jù)包信息查看DAI整體情況動(dòng)態(tài)ARP檢測(cè)配置2-2Switch#showiparpinspectioninterfacesSwitch#showiparpinspectionvlan-idSwitch#showiparpinspectionstatisticsvlan-idSwitch#showiparpinspection第37頁(yè)/共47頁(yè)在交換機(jī)Switch中啟用DAI客戶端與服務(wù)器處于同一個(gè)Vlan（Vlan10）所有端口均為非信任端口為DHCP服務(wù)器（IP地址為192.168.100.2）配置靜態(tài)綁定表動(dòng)態(tài)ARP檢測(cè)配置示例3-1F0/1F0/2F0/3pc1pc2DHCP

Server第38頁(yè)/共47頁(yè)在交換機(jī)Switch上啟用DAI配置動(dòng)態(tài)ARP檢測(cè)配置示例3-2Switch(config)#ipdhcpsnoopingSwitch(config)#ipdhcpsnoopingvlan10Switch(config)#interfacefastEthernet0/2Switch(config-if)#ipdhcpsnoopingtrustSwitch(config-if)#exitSwitch(config)#ipsourcebinding000C.29BE.C63Avlan10192.168.100.2interfaceFa0/2

Switch(config)#interfacerangeFastEthernet0/1-3Switch(config-if)#switchportmodeaccessSwitch(config-if)#switchportaccessvlan10Switch(config-if)#spanning-treeportfast

Switch(config)#iparpinspectionvlan10開(kāi)啟DHCP監(jiān)聽(tīng)信任端口靜態(tài)綁定啟用DAI第39頁(yè)/共47頁(yè)查看啟用DAI的端口情況查看DHCP監(jiān)聽(tīng)綁定表動(dòng)態(tài)ARP檢測(cè)配置示例3-3Switch#showiparpinspectioninterfaces

InterfaceTrustStateRate(pps)BurstInterval--------------------------------------------------Fa0/1Untrusted151Fa0/2Untrusted151……Switch#showipdhcpsnoopingbindingMacAddressIpAddressLease(sec)TypeVLANInterface--------------------------------------------------------------------------------D0:27:88:47:CE:FA192.168.100.21686190dhcp-snooping10F0/100:1F:C6:44:A3:CF192.168.100.23685702dhcp-snooping10F0/3Totalnumberofbindings:2查看靜態(tài)IP源綁定表Switch#showipsourcebindingMacAddressIpAddressLease(sec)Type