第7个模块：最小化园区网的服务丢失数据窃听-2-对抗VLAN攻击 CCNP交换部分中文版 演示教学.ppt

ITAA学习情报组 汤姆一通互联网技术训练中心 /bbs 最小化园区网的服务丢失和数据窃听 对抗VLAN攻击 解释 VLAN Hopping 攻击系统伪装自己的网卡为1个合法的Trunk协商端口（DTP） Trunk链路动态协商 形成Trunk后，攻击设备获得访问所有VLAN的渠道 双层标记VLAN Hopping 双层标记允许一个数据帧转发到另外一个VLAN 减轻 VLAN 跳跃 Switch(config-if)#switchport access vlan vlan-id Statically assigns the ports to specific unused VLAN Switch(config-if)#switchport mode access Configures the ports as access ports and turns off DTP Selects a range of interfaces to configure Switch(config)# interface-range type mod/port-port ACLs类型 PVLAN 端口类型 Isolated: Communicate with only promiscuous ports Promiscuous: Communicate with all other ports Community: Communicate with other members of community and all promiscuous ports 配置 PVLANs Switch(config-vlan)#private-vlan [primary | isolated | community] 配置 一个VLAN 为 PVLAN Switch(config-vlan)#private-vlan association {secondary_vlan_list | add svl | remove svl} Associates secondary VLANs with the primary VLAN Switch#show vlan private-vlan type Verifies PVLAN configuration 配置 PVLAN 端口 Switch(config-if)#switchport mode private-vlan {host | promiscuous} Configures an interface as a PVLAN port Switch(config-if)#switchport private-vlan host-association {primary_vlan_ID secondary_vlan_ID Associates an isolated or community port with a PVLAN Switch#show interfaces private-vlan mapping Verifies PVLAN port configuration Switch(config-if)#private-vlan mapping primary_vlan_ID {secondary_vlan_list | add svl | remove svl} Maps a promiscuous PVLAN port to a PVLAN 总结 VLAN跳跃允许对另外一个VLAN的非授权访问 VLAN跳跃可以通过以下手段减轻： 手动配置802.1Q Trunk 关闭Trunk协商 VLAN访问列表限制2层访问 VACLs可以在Catalyst交换机上使用 PVLANs允许在同一个VLAN内，将流量限制在某些端口之间 PVLAN实现在1个VLAN内的端口隔离 ITAA学习情报组 汤姆一通互联网技术训练中心 /bbs * * Lesson Aim Enter lesson aim here. * Lesson Aim Enter lesson aim here. * Lesson Aim Enter lesson aim here. * Lesson Aim Enter lesson aim here. * Lesson Aim Enter lesson aim here. * Purpose: This graphic covers the configuration of port security. Emphasize: The output of the show port command. Transition: We will now look at the