端口安全配置

第一步

配置接口的安全使能：[sw1-Gigabitethernet0/0/1]port-security enable

第二步

配置接口最大允许多少个MAC地址：[sw1-Gigabitethernet0/0/1]port-security max-mac-num 5

//允许最多通过5个，最先进入的5个

第三步

打开sticky功能：[sw1-Gigabitethernet0/0/1]port-security mac-address sticky

第四步

绑定MAC地址：

[sw1-Gigabitethernet0/0/1]port-security mac-address sticky xxxx-xxxx-xxx1 vlan vlan-id

[sw1-Gigabitethernet0/0/1]port-security mac-address sticky xxxx-xxxx-xxx2 vlan vlan-id

[sw1-Gigabitethernet0/0/1]port-security mac-address sticky xxxx-xxxx-xxx3 vlan vlan-id

[sw1-Gigabitethernet0/0/1]port-security mac-address sticky xxxx-xxxx-xxx4 vlan vlan-id

[sw1-Gigabitethernet0/0/1]port-security mac-address sticky xxxx-xxxx-xxx5 vlan vlan-id

第五步

打开端口产生错误后[sw1-Gigabitethernet0/0/1]port-security protect-action shutdown

配置内容：

<sw1>dis current-configuration  

#

sysname sw1

#

vlan batch 10 20

#

cluster enable

ntdp enable

ndp enable

#

drop illegal-mac alarm

#

dhcp enable

#

diffserv domain default

#

drop-profile default

#

ip pool dhcpvlan1

gateway-list 100.1.1.1

network 100.1.1.0 mask 255.255.255.0

lease day 10 hour 0 minute 0

dns-list 8.8.8.8

#

aaa

authentication-scheme default

authorization-scheme default

accounting-scheme default

domain default

domain default_admin

local-user admin password simple admin

local-user admin service-type http

#

interface Vlanif1

ip address 100.1.1.1 255.255.255.0

dhcp select global

#

interface MEth0/0/1

#

interface GigabitEthernet0/0/1

port-security enable

port-security protect-action shutdown

port-security max-mac-num 5

port-security mac-address sticky

#

interface GigabitEthernet0/0/2

#

interface GigabitEthernet0/0/3

#

interface GigabitEthernet0/0/4

#

interface GigabitEthernet0/0/5

#

interface GigabitEthernet0/0/6

#

interface GigabitEthernet0/0/7

#

interface GigabitEthernet0/0/8

#

interface GigabitEthernet0/0/9

#

interface GigabitEthernet0/0/10

#

interface GigabitEthernet0/0/11

#

interface GigabitEthernet0/0/12

#

interface GigabitEthernet0/0/13

#

interface GigabitEthernet0/0/14

#

interface GigabitEthernet0/0/15

#

interface GigabitEthernet0/0/16

#

interface GigabitEthernet0/0/17

#

interface GigabitEthernet0/0/18

#

interface GigabitEthernet0/0/19

#

interface GigabitEthernet0/0/20

#

interface GigabitEthernet0/0/21

#

interface GigabitEthernet0/0/22

#

interface GigabitEthernet0/0/23

#

interface GigabitEthernet0/0/24

#

interface NULL0

#

user-interface con 0

idle-timeout 0 0

user-interface vty 0 4

#

return

<sw1>