【实验】华三( H3C )交换机配置静态 MAC 地址并使用 MAC 地址来限制服务器的接入

如需注册 @ccie.engineer 、@ccde.engineer 、@ccar.engineer 、@hcie.engineer 、@rhce.engineer 和 @cissp.engineer 邮箱,请点击这里
更多有关于 “ H3C 实验 ” 的文章,请点击这里

实验环境:

操作系统:Windows 7 专业版(当时最新正式版),模拟器:HCL 2.1.1(当时最新版本)

  • 路由器的型号是:H3C MSR36-20
  • 交换机的型号是:H3C S5820V2-54QS-GE
华三( H3C )交换机使用 MAC 地址来限制服务器的接入
华三( H3C )交换机使用 MAC 地址来限制服务器的接入

实验需求:

  • 现有一网络的交换机(SW)上连有:用户 PC( HOST )、存储服务器( SERVER )和网络管理服务器( NMS ,Network Management Server ),具体连线和 IP 地址等信息如上图所示;
  • 为方便做实验,HOST 、SERVER 和 NMS 均采用路由器来模拟;
  • SW 在转发目的 MAC 地址为 SERVER 的 MAC 地址的报文时不再使用广播,而始终通过单播发送去往 SERVER 的报文;
  • 为了增强网络管理的安全性,要求在 SW 上连接 NMS 的端口仅允许这台 NMS 接入。

实验步骤:

本实验主要涉及到的命令是:IPv4 地址的配置、VLAN 划分和 MAC 地址在交换机上的一些使用,跟思科的命令大同小异,在此不做过多的描述。

HOST :

sys
hostname HOST

int g 0/0
ip add 10.0.0.2 255.255.255.0
shutdown
undo shutdown
NMS :

sys
hostname NMS

int g 0/0
ip add 10.0.0.3 255.255.255.0
shutdown
undo shutdown
SERVER :

sys
hostname SERVER

int g 0/0
ip add 10.0.0.1 255.255.255.0
shutdown
undo shutdown

我们先来查看一下 NMS 和 SERVER 在去往 SW 的端口上的 MAC 地址都分别是什么:

[NMS]display interface GigabitEthernet 0/0
GigabitEthernet0/0
Current state: UP
Line protocol state: UP
Description: GigabitEthernet0/0 Interface
Bandwidth: 1000000 kbps
Maximum transmission unit: 1500
Allow jumbo frames to pass
Broadcast max-ratio: 100%
Multicast max-ratio: 100%
Unicast max-ratio: 100%
Internet address: 10.0.0.1/24 (primary)
IP packet frame type: Ethernet II, hardware address: 68b4-6783-0305
IPv6 packet frame type: Ethernet II, hardware address: 68b4-6783-0305
Output queue - Urgent queuing: Size/Length/Discards 0/100/0
Output queue - Protocol queuing: Size/Length/Discards 0/500/0
Output queue - FIFO queuing: Size/Length/Discards 0/75/0
Last link flapping: 0 hours 8 minutes 22 seconds
Last clearing of counters: Never
Current system time:2019-05-29 14:48:38
Last time when physical state changed to up:2019-05-29 14:40:16
Last time when physical state changed to down:2019-05-29 14:40:15
 Peak input rate: 0 bytes/sec, at 00-00-00 00:00:00
 Peak output rate: 0 bytes/sec, at 00-00-00 00:00:00
 Last 300 second input: 0 packets/sec 0 bytes/sec 0%
 Last 300 second output: 0 packets/sec 0 bytes/sec 0%
 Input (total):  0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Input (normal):  0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Input:  0 input errors, 0 runts, 0 giants, 0 throttles
         0 CRC, 0 frame, 0 overruns, 0 aborts
         0 ignored, 0 parity errors
 Output (total): 0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Output (normal): 0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Output: 0 output errors, 0 underruns, 0 buffer failures
         0 aborts, 0 deferred, 0 collisions, 0 late collisions
         0 lost carrier, 0 no carrier

[NMS]
[SERVER]display interface GigabitEthernet 0/0
GigabitEthernet0/0
Current state: UP
Line protocol state: UP
Description: GigabitEthernet0/0 Interface
Bandwidth: 1000000 kbps
Maximum transmission unit: 1500
Allow jumbo frames to pass
Broadcast max-ratio: 100%
Multicast max-ratio: 100%
Unicast max-ratio: 100%
Internet address: 10.0.0.1/24 (primary)
IP packet frame type: Ethernet II, hardware address: 68b4-4073-0105
IPv6 packet frame type: Ethernet II, hardware address: 68b4-4073-0105
Output queue - Urgent queuing: Size/Length/Discards 0/100/0
Output queue - Protocol queuing: Size/Length/Discards 0/500/0
Output queue - FIFO queuing: Size/Length/Discards 0/75/0
Last link flapping: 0 hours 0 minutes 8 seconds
Last clearing of counters: Never
Current system time:2019-05-29 14:50:09
Last time when physical state changed to up:2019-05-29 14:50:01
Last time when physical state changed to down:2019-05-29 14:49:59
 Peak input rate: 0 bytes/sec, at 00-00-00 00:00:00
 Peak output rate: 0 bytes/sec, at 00-00-00 00:00:00
 Last 300 second input: 0 packets/sec 0 bytes/sec 0%
 Last 300 second output: 0 packets/sec 0 bytes/sec 0%
 Input (total):  0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Input (normal):  0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Input:  0 input errors, 0 runts, 0 giants, 0 throttles
         0 CRC, 0 frame, 0 overruns, 0 aborts
         0 ignored, 0 parity errors
 Output (total): 0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Output (normal): 0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Output: 0 output errors, 0 underruns, 0 buffer failures
         0 aborts, 0 deferred, 0 collisions, 0 late collisions
         0 lost carrier, 0 no carrier

[SERVER]

如上所示,NMS 的 GigabitEthernet 0/0 口的 MAC 地址为 68b4-6783-0305 ,SERVER 的 GigabitEthernet 0/0 口的 MAC 地址为 68b4-4073-0105 ,然后再配置 SW :

SW :

sys
hostname SW

vlan 10
port g 1/0/2 g 1/0/5 g 1/0/10
quit

int r g 1/0/2 g 1/0/5 g 1/0/10
shutdown
undo shutdown

# 添加 SERVER 的 MAC 地址,使交换机始终通过端口 GigabitEthernet 1/0/2 单播发送去往 SERVER 的报文:
mac-address static 68b4-4073-0105 int g 1/0/2 vlan 10

# 配置端口 GigabitEthernet 1/0/10 最大 MAC 学习数为 0 并手工添加 NMS 的静态 MAC 表项,
# 实现 GigabitEthernet 1/0/10 端口只能转发源地址为 NMS 的报文,保证其他主机无法通过此端口通信:
int g 1/0/10
mac-address max-mac-count 0
mac-address static 68b4-6783-0305 vlan 10

# 配置当端口学习的 MAC 地址数达到设置的最大 MAC 地址数后,禁止转发收到的源 MAC 地址不
# 在 MAC 地址表里的数据帧:
# mac-address max-mac-count disable-forwarding(模拟器上没有这条命令,我敲的是下面那条)
undo mac-address max-mac-count enable-forwarding

测试:

在 HOST 上 ping 10.0.0.1( SERVER )和 10.0.0.3( NMS )都没有问题:

[HOST]ping 10.0.0.1
Ping 10.0.0.1 (10.0.0.1): 56 data bytes, press CTRL_C to break
56 bytes from 10.0.0.1: icmp_seq=0 ttl=255 time=4.000 ms
56 bytes from 10.0.0.1: icmp_seq=1 ttl=255 time=1.000 ms
56 bytes from 10.0.0.1: icmp_seq=2 ttl=255 time=1.000 ms
56 bytes from 10.0.0.1: icmp_seq=3 ttl=255 time=1.000 ms
56 bytes from 10.0.0.1: icmp_seq=4 ttl=255 time=2.000 ms

--- Ping statistics for 10.0.0.1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.000/1.800/4.000/1.166 ms
[HOST]%May 29 16:06:20:502 2019 HOST PING/6/PING_STATISTICS: Ping statistics for 10.0.0.1: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 1.000/1.800/4.000/1.166 ms.

[HOST]ping 10.0.0.3
Ping 10.0.0.3 (10.0.0.3): 56 data bytes, press CTRL_C to break
56 bytes from 10.0.0.3: icmp_seq=0 ttl=255 time=5.000 ms
56 bytes from 10.0.0.3: icmp_seq=1 ttl=255 time=2.000 ms
56 bytes from 10.0.0.3: icmp_seq=2 ttl=255 time=1.000 ms
56 bytes from 10.0.0.3: icmp_seq=3 ttl=255 time=2.000 ms
56 bytes from 10.0.0.3: icmp_seq=4 ttl=255 time=2.000 ms

--- Ping statistics for 10.0.0.3 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.000/2.400/5.000/1.356 ms
[HOST]%May 29 16:06:23:391 2019 HOST PING/6/PING_STATISTICS: Ping statistics for 10.0.0.3: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 1.000/2.400/5.000/1.356 ms.

[HOST]

现在我们假设 NMS 的 GigabitEthernet 0/0 口的 MAC 地址是 68b4-6783-0306 而不是 68b4-6783-0305 ,修改 SW 的配置:

SW :

int g 1/0/10
undo mac-address static 68b4-6783-0305 vlan 10
mac-address static 68b4-6783-0306 vlan 10

现在看看 HOST 能不能 ping 通 10.0.0.1( SERVER )和 10.0.0.3( NMS ):

[HOST]ping 10.0.0.1
Ping 10.0.0.1 (10.0.0.1): 56 data bytes, press CTRL_C to break
56 bytes from 10.0.0.1: icmp_seq=0 ttl=255 time=2.000 ms
56 bytes from 10.0.0.1: icmp_seq=1 ttl=255 time=2.000 ms
56 bytes from 10.0.0.1: icmp_seq=2 ttl=255 time=1.000 ms
56 bytes from 10.0.0.1: icmp_seq=3 ttl=255 time=2.000 ms
56 bytes from 10.0.0.1: icmp_seq=4 ttl=255 time=1.000 ms

--- Ping statistics for 10.0.0.1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.000/1.600/2.000/0.490 ms
[HOST]%May 29 16:26:50:549 2019 HOST PING/6/PING_STATISTICS: Ping statistics for 10.0.0.1: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 1.000/1.600/2.000/0.490 ms.

[HOST]
[HOST]ping 10.0.0.3
Ping 10.0.0.3 (10.0.0.3): 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out

--- Ping statistics for 10.0.0.3 ---
5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss
[HOST]%May 29 16:27:03:360 2019 HOST PING/6/PING_STATISTICS: Ping statistics for 10.0.0.3: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.

[HOST]

可以看到 NMS 已经 ping 不通了,“ 在 SW 上连接 NMS 的端口仅允许这台 NMS 接入 ” 这个需求已配置完成。

“ SW 在转发目的 MAC 地址为 SERVER 的 MAC 地址的报文时不再使用广播,而始终通过单播发送去往 SERVER 的报文 ” 这个需求不容易验证,大家可以多做几次实验然后抓包来看一下。我们可以先看一下 SW 的 MAC 地址表:

[SW]display mac-address
MAC Address      VLAN ID    State            Port/Nickname            Aging
68b4-4073-0105   10         Static           GE1/0/2                  N
68b4-6783-0306   10         Static           GE1/0/10                 N
[SW]

可以看到这些 MAC 地址的条目都是静态的,所以交换机就不需要动态学习这些 MAC 地址了,自然直接通过单播发送去往 SERVER 的报文即可。

我们也可以来看一下 H3C 官方文档的注释:

H3C 官方文档截图
H3C 官方文档截图

至此,实验完成。

参考自:

  • http://www.h3c.com/cn/d_201312/807732_30005_0.htm

 

本文完。如有疑问,欢迎在下方留言;如本文有什么错误,欢迎在下方留言指正,谢谢。

打赏 赞(0)
比特币钱包
以太坊钱包
比特币钱包二维码图片

比特币钱包扫描二维码打赏

以太坊钱包二维码图片

以太坊钱包扫描二维码打赏

Was this article helpful?

Leave A Comment?

此站点使用Akismet来减少垃圾评论。了解我们如何处理您的评论数据