注册
登录
| 关键词： recovery cause DHCP SNOOPING inspection limit rate interface GigabitEthernet arp |
出处：摘自互联网 使用的方法是采用DHCP方式为用户分配IP，然后限定这些用户只能使用动态IP的方式，如果改成静态IP的方式则不能连接上网络；也就是使用了DHCP SNOOPING功能。例子：version 12.1no service padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryptionservice compress-config!hostname C4-2_4506!enable password xxxxxxx!clock timezone GMT 8ip subnet-zerono ip domain-lookup!ip dhcp snooping vlan 180-181 // 对哪些VLAN 进行限制ip dhcp snoopingip arp inspection vlan 180-181ip arp inspection validate src-mac dst-mac iperrdisable recovery cause udlderrdisable recovery cause bpduguarderrdisable recovery cause security-violationerrdisable recovery cause channel-misconfigerrdisable recovery cause pagp-flaperrdisable recovery cause dtp-flaperrdisable recovery cause link-flaperrdisable recovery cause l2ptguarderrdisable recovery cause psecure-violationerrdisable recovery cause gbic-invaliderrdisable recovery cause dhcp-rate-limiterrdisable recovery cause unicast-flooderrdisable recovery cause vmpserrdisable recovery cause arp-inspectionerrdisable recovery interval 30spanning-tree extend system-id!!interface GigabitEthernet2/1 // 对该端口接入的用户进行限制，可以下联交换机ip arp inspection limit rate 100arp timeout 2ip dhcp snooping limit rate 100!interface GigabitEthernet2/2ip arp inspection limit rate 100arp timeout 2ip dhcp snooping limit rate 100!interface GigabitEthernet2/3ip arp inspection limit rate 100arp timeout 2ip dhcp snooping limit rate 100!interface GigabitEthernet2/4ip arp inspection limit rate 100arp timeout 2ip dhcp snooping limit rate 100 注：DHCP Snooping DAI，Dynamic ARP InspectionIP Source GuardDHCP Interface Tracker (Option 82)设备局限很大,3550---4000系列之间能用,用来防止基于内部的2层攻击,同一VLAN防止私自建立DHCP SERVER |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
