交换机配置实例拓扑图如下：
交换机基本配置
- Switch> enable Switch# config ter
- Switch(config)# hostname Switch Switch(config)# interface vlan 1
- Switch(config-if)# ip address 192.168.1.10 255.255.255.0 Switch(config-if)# no shutdown
- Switch(config-if)# exit Switch(config)# ip default-gateway 192.168.1.1
- Switch(config)# end Switch#show int vlan 1
- Vlan1 is administratively down, line protocol is down Hardware is CPU Interface, address is 0001.9719.ab57 (bia 0001.9719.ab57)
- Internet address is 192.168.1.10/24 MTU 1500 bytes, BW 100000 Kbit, DLY 1000000 usec,
- reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set
- ARP type: ARPA, ARP Timeout 04:00:00 Last input 21:40:21, output never, output hang never
- Last clearing of “show interface” counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
- Queueing strategy: fifo Output queue: 0/40 (size/max)
- 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec
- 1682 packets input, 530955 bytes, 0 no buffer Received 0 broadcasts (0 IP multicast)
- 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
- 563859 packets output, 0 bytes, 0 underruns 0 output errors, 23 interface resets
- 0 output buffer failures, 0 output buffers swapped out Switch#
配置各台PC 的设置
- a) PC1 IP ADDRESS：192.168.1.100
- SUBMASK: 255.255.255.0 DEFAULT-GATEWAY: 192.168.1.1
- b) PC2 IP ADDRESS：192.168.1.101
- SUBMASK: 255.255.255.0 DEFAULT-GATEWAY: 192.168.1.1
- c) PC3 IP ADDRESS：192.168.1.102
- SUBMASK: 255.255.255.0 DEFAULT-GATEWAY: 192.168.1.1
验证
- d) PC1
- ping 192.168.1.101
- ping 192.168.1.102
能通
- e) PC2
- ping 192.168.1.100
- ping 192.168.1.102
能通
查看交换机动态学习到的MAC 表
因为我们通过ping 命令互相访问，交换机会动态学习到各个PC 的MAC 地址!
- Switch#show mac-address-table Mac Address Table
- ——————————————-
- Vlan Mac Address Type Ports —- ———– ——– —–
- 1 0001.4246.a36c DYNAMIC Fa0/3
- 1 0009.7c35.7001 DYNAMIC Fa0/24 1 00d0.58b6.24da DYNAMIC Fa0/2
- 1 00d0.bc37.3d6b DYNAMIC Fa0/1
现在配置交换机的F0/1 接口只允许PC0 的接入，其它PC 非法接入该接口会关闭无法使。
- Switch# config term Switch(config)# interface f0/1
- Switch(config-if)# switchport mode access //将接口设置为访问接口 Switch(config-if)# switchport port-security //在该接口上启动端口安全
- Switch(config-if)# switchport port-security mac 00d0.58b6.24da //将PC0 的MAC 地址和该接口绑定，该MAC 地址可以通过第三步查看到
- Switch(config-if)# switchport port-security maximum 1 //因为我们只允许PC0 访问，这里将访问量设置为1
- Switch(config-if)# switchport port-security violation shutdown //将非法用户接入后的动作为关闭接口
验证：
- Switch# show port-security interface f0/1 Port Security : Enabled
- Port Status : Secure-up Violation Mode : Shutdown
- Aging Time : 0 mins Aging Type : Absolute
- SecureStatic Address Aging : Disabled Maximum MAC Addresses : 1
- Total MAC Addresses : 1 Configured MAC Addresses : 1
- Sticky MAC Addresses : 0 Last Source Address:Vlan : 00D0.58B6.24DA:1
- Security Violation Count : 0
#p#
测试端口安全
a) PC1
ping 192.168.1.101
能PING 通
b) 重新配置新的PC，IP 地址配置为192.168.1.103，子网掩码为255.255.255.0，将原PC0 从交换机的f0/1 口移出，将新的PC 接入到交换机的F0/1 口（如下）
c) PC4 中
Ping 192.168.1.101
d) 结果发现交换机出现如下提示：
- %LINK-5-CHANGED: Interface FastEthernet0/1, changed state to administratively down %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state todown
因为交换机的F0/1 口配置了端口安全，只允许MAC 为00d0.58b6.24da 访问该接口，新的PC 机的MAC 地址不符合条件，交换机就会按照配置将该接口shutdown。
e) PC4 中再次访问PC1 和PC2 都无法正常访问
- Switch#Ping 192.168.1.101 Pinging 192.168.1.101 with 32 bytes of data:
- Request timed out. Request timed out.
- Request timed out. Request timed out.
- Ping statistics for 192.168.1.101: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)
f) 交换机中验证：
- Switch# show port-security interface F0/1 Port Security : Enabled
- Port Status : Secure-shutdown Violation Mode : Shutdown
- Aging Time : 0 mins Aging Type : Absolute
- SecureStatic Address Aging : Disabled Maximum MAC Addresses : 1
- Total MAC Addresses : 1 Configured MAC Addresses : 1
- Sticky MAC Addresses : 0 Last Source Address:Vlan : 00E0.F961.D8C7:1
- Security Violation Count : 1 //安全动作统计为1
配置交换机的静态MAC
a) 配置静态绑定
- Switch# config termi Switch(config)# mac-address-table static 0001.4246.a36c vlan 1 interface f0/2 //将MAC 地址为0001.4246.a36c 静态绑定到vlan1 中的接口F0/2
- SW1# show mac Mac Address Table
- ——————————————- Vlan Mac Address Type Ports
- —- ———– ——– —– 1 0001.4246.a36c STATIC Fa0/2
b) 静态指定的MAC 地址，交换机重新启动后不会从MAC 表中丢失，动态学习到MAC地址交换机重新启动后会丢失将交换机重新启动验证静态绑定MAC
- SW1# write Destination filename [startup-config]?
- Building configuration… [OK]
- SW1# reload
c) 启动后，查看交换机的MAC 地址表
- SW1# show mac Mac Address Table
- ——————————————- Vlan Mac Address Type Ports
- —- ———– ——– —– 1 0001.4246.a36c STATIC Fa0/2
- 1 00d0.58b6.24da STATIC Fa0/1
交换机是组网设备中关键角色之一，所以它的配置是非常关键的，本文意在让初学者能够掌握基本的交换机配置方法，在CCNA认证时也是至关重要的。
