【实验】华三（ H3C ）交换机配置静态 MAC 地址并使用 MAC 地址来限制服务器的接入

如需注册 @ccie.engineer 、@ccde.engineer 、@ccar.engineer 、@hcie.engineer 、@rhce.engineer 和 @cissp.engineer 邮箱，请点击这里。 
更多有关于 “ H3C 实验 ” 的文章，请点击这里。

实验环境：

操作系统：Windows 7 专业版（当时最新正式版），模拟器：HCL 2.1.1（当时最新版本）

  • 路由器的型号是：H3C MSR36-20
  • 交换机的型号是：H3C S5820V2-54QS-GE
华三（ H3C ）交换机使用 MAC 地址来限制服务器的接入
华三（ H3C ）交换机使用 MAC 地址来限制服务器的接入

实验需求：

  • 现有一网络的交换机（SW）上连有：用户 PC（ HOST ）、存储服务器（ SERVER ）和网络管理服务器（ NMS ，Network Management Server ），具体连线和 IP 地址等信息如上图所示；
  • 为方便做实验，HOST 、SERVER 和 NMS 均采用路由器来模拟；
  • SW 在转发目的 MAC 地址为 SERVER 的 MAC 地址的报文时不再使用广播，而始终通过单播发送去往 SERVER 的报文；
  • 为了增强网络管理的安全性，要求在 SW 上连接 NMS 的端口仅允许这台 NMS 接入。

实验步骤：

本实验主要涉及到的命令是：IPv4 地址的配置、VLAN 划分和 MAC 地址在交换机上的一些使用，跟思科的命令大同小异，在此不做过多的描述。

HOST ：

sys
hostname HOST

int g 0/0
ip add 10.0.0.2 255.255.255.0
shutdown
undo shutdown

NMS ：

sys
hostname NMS

int g 0/0
ip add 10.0.0.3 255.255.255.0
shutdown
undo shutdown

SERVER ：

sys
hostname SERVER

int g 0/0
ip add 10.0.0.1 255.255.255.0
shutdown
undo shutdown

我们先来查看一下 NMS 和 SERVER 在去往 SW 的端口上的 MAC 地址都分别是什么：

[NMS]display interface GigabitEthernet 0/0
GigabitEthernet0/0
Current state: UP
Line protocol state: UP
Description: GigabitEthernet0/0 Interface
Bandwidth: 1000000 kbps
Maximum transmission unit: 1500
Allow jumbo frames to pass
Broadcast max-ratio: 100%
Multicast max-ratio: 100%
Unicast max-ratio: 100%
Internet address: 10.0.0.1/24 (primary)
IP packet frame type: Ethernet II, hardware address: 68b4-6783-0305
IPv6 packet frame type: Ethernet II, hardware address: 68b4-6783-0305
Output queue - Urgent queuing: Size/Length/Discards 0/100/0
Output queue - Protocol queuing: Size/Length/Discards 0/500/0
Output queue - FIFO queuing: Size/Length/Discards 0/75/0
Last link flapping: 0 hours 8 minutes 22 seconds
Last clearing of counters: Never
Current system time:2019-05-29 14:48:38
Last time when physical state changed to up:2019-05-29 14:40:16
Last time when physical state changed to down:2019-05-29 14:40:15
 Peak input rate: 0 bytes/sec, at 00-00-00 00:00:00
 Peak output rate: 0 bytes/sec, at 00-00-00 00:00:00
 Last 300 second input: 0 packets/sec 0 bytes/sec 0%
 Last 300 second output: 0 packets/sec 0 bytes/sec 0%
 Input (total):  0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Input (normal):  0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Input:  0 input errors, 0 runts, 0 giants, 0 throttles
         0 CRC, 0 frame, 0 overruns, 0 aborts
         0 ignored, 0 parity errors
 Output (total): 0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Output (normal): 0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Output: 0 output errors, 0 underruns, 0 buffer failures
         0 aborts, 0 deferred, 0 collisions, 0 late collisions
         0 lost carrier, 0 no carrier

[NMS]

[SERVER]display interface GigabitEthernet 0/0
GigabitEthernet0/0
Current state: UP
Line protocol state: UP
Description: GigabitEthernet0/0 Interface
Bandwidth: 1000000 kbps
Maximum transmission unit: 1500
Allow jumbo frames to pass
Broadcast max-ratio: 100%
Multicast max-ratio: 100%
Unicast max-ratio: 100%
Internet address: 10.0.0.1/24 (primary)
IP packet frame type: Ethernet II, hardware address: 68b4-4073-0105
IPv6 packet frame type: Ethernet II, hardware address: 68b4-4073-0105
Output queue - Urgent queuing: Size/Length/Discards 0/100/0
Output queue - Protocol queuing: Size/Length/Discards 0/500/0
Output queue - FIFO queuing: Size/Length/Discards 0/75/0
Last link flapping: 0 hours 0 minutes 8 seconds
Last clearing of counters: Never
Current system time:2019-05-29 14:50:09
Last time when physical state changed to up:2019-05-29 14:50:01
Last time when physical state changed to down:2019-05-29 14:49:59
 Peak input rate: 0 bytes/sec, at 00-00-00 00:00:00
 Peak output rate: 0 bytes/sec, at 00-00-00 00:00:00
 Last 300 second input: 0 packets/sec 0 bytes/sec 0%
 Last 300 second output: 0 packets/sec 0 bytes/sec 0%
 Input (total):  0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Input (normal):  0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Input:  0 input errors, 0 runts, 0 giants, 0 throttles
         0 CRC, 0 frame, 0 overruns, 0 aborts
         0 ignored, 0 parity errors
 Output (total): 0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Output (normal): 0 packets, 0 bytes
         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses
 Output: 0 output errors, 0 underruns, 0 buffer failures
         0 aborts, 0 deferred, 0 collisions, 0 late collisions
         0 lost carrier, 0 no carrier

[SERVER]

如上所示，NMS 的 GigabitEthernet 0/0 口的 MAC 地址为 68b4-6783-0305 ，SERVER 的 GigabitEthernet 0/0 口的 MAC 地址为 68b4-4073-0105 ，然后再配置 SW ：

SW ：

sys
hostname SW

vlan 10
port g 1/0/2 g 1/0/5 g 1/0/10
quit

int r g 1/0/2 g 1/0/5 g 1/0/10
shutdown
undo shutdown

# 添加 SERVER 的 MAC 地址，使交换机始终通过端口 GigabitEthernet 1/0/2 单播发送去往 SERVER 的报文：
mac-address static 68b4-4073-0105 int g 1/0/2 vlan 10

# 配置端口 GigabitEthernet 1/0/10 最大 MAC 学习数为 0 并手工添加 NMS 的静态 MAC 表项，
# 实现 GigabitEthernet 1/0/10 端口只能转发源地址为 NMS 的报文，保证其他主机无法通过此端口通信：
int g 1/0/10
mac-address max-mac-count 0
mac-address static 68b4-6783-0305 vlan 10

# 配置当端口学习的 MAC 地址数达到设置的最大 MAC 地址数后，禁止转发收到的源 MAC 地址不
# 在 MAC 地址表里的数据帧：
# mac-address max-mac-count disable-forwarding（模拟器上没有这条命令，我敲的是下面那条）
undo mac-address max-mac-count enable-forwarding

测试：

在 HOST 上 ping 10.0.0.1（ SERVER ）和 10.0.0.3（ NMS ）都没有问题：

[HOST]ping 10.0.0.1
Ping 10.0.0.1 (10.0.0.1): 56 data bytes, press CTRL_C to break
56 bytes from 10.0.0.1: icmp_seq=0 ttl=255 time=4.000 ms
56 bytes from 10.0.0.1: icmp_seq=1 ttl=255 time=1.000 ms
56 bytes from 10.0.0.1: icmp_seq=2 ttl=255 time=1.000 ms
56 bytes from 10.0.0.1: icmp_seq=3 ttl=255 time=1.000 ms
56 bytes from 10.0.0.1: icmp_seq=4 ttl=255 time=2.000 ms

--- Ping statistics for 10.0.0.1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.000/1.800/4.000/1.166 ms
[HOST]%May 29 16:06:20:502 2019 HOST PING/6/PING_STATISTICS: Ping statistics for 10.0.0.1: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 1.000/1.800/4.000/1.166 ms.

[HOST]ping 10.0.0.3
Ping 10.0.0.3 (10.0.0.3): 56 data bytes, press CTRL_C to break
56 bytes from 10.0.0.3: icmp_seq=0 ttl=255 time=5.000 ms
56 bytes from 10.0.0.3: icmp_seq=1 ttl=255 time=2.000 ms
56 bytes from 10.0.0.3: icmp_seq=2 ttl=255 time=1.000 ms
56 bytes from 10.0.0.3: icmp_seq=3 ttl=255 time=2.000 ms
56 bytes from 10.0.0.3: icmp_seq=4 ttl=255 time=2.000 ms

--- Ping statistics for 10.0.0.3 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.000/2.400/5.000/1.356 ms
[HOST]%May 29 16:06:23:391 2019 HOST PING/6/PING_STATISTICS: Ping statistics for 10.0.0.3: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 1.000/2.400/5.000/1.356 ms.

[HOST]

现在我们假设 NMS 的 GigabitEthernet 0/0 口的 MAC 地址是 68b4-6783-0306 而不是 68b4-6783-0305 ，修改 SW 的配置：

SW ：

int g 1/0/10
undo mac-address static 68b4-6783-0305 vlan 10
mac-address static 68b4-6783-0306 vlan 10

现在看看 HOST 能不能 ping 通 10.0.0.1（ SERVER ）和 10.0.0.3（ NMS ）：

[HOST]ping 10.0.0.1
Ping 10.0.0.1 (10.0.0.1): 56 data bytes, press CTRL_C to break
56 bytes from 10.0.0.1: icmp_seq=0 ttl=255 time=2.000 ms
56 bytes from 10.0.0.1: icmp_seq=1 ttl=255 time=2.000 ms
56 bytes from 10.0.0.1: icmp_seq=2 ttl=255 time=1.000 ms
56 bytes from 10.0.0.1: icmp_seq=3 ttl=255 time=2.000 ms
56 bytes from 10.0.0.1: icmp_seq=4 ttl=255 time=1.000 ms

--- Ping statistics for 10.0.0.1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.000/1.600/2.000/0.490 ms
[HOST]%May 29 16:26:50:549 2019 HOST PING/6/PING_STATISTICS: Ping statistics for 10.0.0.1: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 1.000/1.600/2.000/0.490 ms.

[HOST]
[HOST]ping 10.0.0.3
Ping 10.0.0.3 (10.0.0.3): 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out

--- Ping statistics for 10.0.0.3 ---
5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss
[HOST]%May 29 16:27:03:360 2019 HOST PING/6/PING_STATISTICS: Ping statistics for 10.0.0.3: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.

[HOST]

可以看到 NMS 已经 ping 不通了，“ 在 SW 上连接 NMS 的端口仅允许这台 NMS 接入 ” 这个需求已配置完成。

“ SW 在转发目的 MAC 地址为 SERVER 的 MAC 地址的报文时不再使用广播，而始终通过单播发送去往 SERVER 的报文 ” 这个需求不容易验证，大家可以多做几次实验然后抓包来看一下。我们可以先看一下 SW 的 MAC 地址表：

[SW]display mac-address
MAC Address      VLAN ID    State            Port/Nickname            Aging
68b4-4073-0105   10         Static           GE1/0/2                  N
68b4-6783-0306   10         Static           GE1/0/10                 N
[SW]

可以看到这些 MAC 地址的条目都是静态的，所以交换机就不需要动态学习这些 MAC 地址了，自然直接通过单播发送去往 SERVER 的报文即可。

我们也可以来看一下 H3C 官方文档的注释：

H3C 官方文档截图
H3C 官方文档截图

至此，实验完成。

参考自：

  • http://www.h3c.com/cn/d_201312/807732_30005_0.htm

 

本文完。如有疑问，欢迎在下方留言；如本文有什么错误，欢迎在下方留言指正，谢谢。

打赏分享

这篇文章对你有帮助吗？

是 否

发表评论?

此站点使用Akismet来减少垃圾评论。了解我们如何处理您的评论数据。