一.概述：
在論壇上看到有人想問通過什么方式來防止長距離的光纖線路被竊聽，或連到其它非法交換機(jī)上，如是相同通過端口安全來實現(xiàn)防止亂接，于是登錄機(jī)架進(jìn)行測試，將測試結(jié)果記錄下來。
論壇提問的鏈接：http://bbs.51cto.com/thread-1080361-1.html
----光纖線路，如果中間沒有被惡意接入其他設(shè)備，應(yīng)該很難竊聽，因此覺得防竊聽可以從防亂接方向入手。
二.基本思路：
A.假定交換機(jī)為三層交換機(jī)
B.如果兩個交換機(jī)用三層口相連，并綁定對端IP所對應(yīng)的mac，雖然可以防止接入三層設(shè)備，但是無法防止中間串接二層設(shè)備進(jìn)行竊聽。
C.通過主機(jī)之間的ipsec來加密流量，除非接線兩端為路由器，否則兩端連接交換機(jī)的主機(jī)太多的話，每臺主機(jī)去配置IPsec不大可行。
-----高端的交換機(jī)沒有玩過，一般普通的三層交換機(jī)貌似無法配置ipsec ***
D.數(shù)據(jù)加密雖然是防竊聽的最好方式，但是目前這種情況，貌似加密不容易實現(xiàn)
E.通過二層的安全來防止亂接：
---交換機(jī)相連的口采用access口，并且兩端都配置VLAN的svi
---每個交換機(jī)保證用于互聯(lián)的vlan只有一個互聯(lián)接口
---三層交換機(jī)要開啟路由轉(zhuǎn)發(fā)，兩個三層交換機(jī)互指路由（靜態(tài)或默認(rèn)），來實現(xiàn)交換機(jī)兩邊的PC互訪
---配置互聯(lián)端口的端口安全，只允許學(xué)習(xí)到2個mac，這樣只有中間線路沒有其他二層設(shè)備，當(dāng)接入其他二層設(shè)備時，端口就會down，防止被監(jiān)聽
---本實驗只是驗證可行性，實際工作如果可能的話，還是建議用路由器互聯(lián)，并配置ipsec。
三.測試拓?fù)洌?/span>
四.基本配置：
A.R4：interface FastEthernet0/0
ip address 20.1.1.4 255.255.255.0
no shut
no ip routing
ip default-gateway 20.1.1.1
B.SW1:
ip routing
interface FastEthernet0/4
switchport access vlan 20
switchport mode access
interface FastEthernet0/20
switchport access vlan 10
switchport mode access
switchport port-security maximum 2
switchport port-security
switchport port-security mac-address sticky
interface Vlan10
ip address 10.1.1.1 255.255.255.252
interface Vlan20
ip address 20.1.1.1 255.255.255.0
ip route 0.0.0.0 0.0.0.0 10.1.1.2
C.SW2:
ip routing
interface FastEthernet0/5
switchport access vlan 30
switchport mode access
interface FastEthernet0/20
switchport access vlan 10
switchport mode access
switchport port-security maximum 2
switchport port-security
switchport port-security mac-address sticky
interface Vlan30
ip address 30.1.1.1 255.255.255.0
interface Vlan100
ip address 10.1.1.2 255.255.255.252
ip route 0.0.0.0 0.0.0.0 10.1.1.1
D.R5:
interface FastEthernet0/1
ip address 30.1.1.5 255.255.255.0
no shut
no ip routing
ip default-gateway 30.1.1.1
五.驗證：
R4#ping 30.1.1.5Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 30.1.1.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
R4#
R5#ping 20.1.1.4Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 20.1.1.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
R5#
sw1#show running-config interface f0/20
Building configuration...
Current configuration : 336 bytes
!
interface FastEthernet0/20
switchport access vlan 10
switchport mode access
switchport port-security maximum 2
switchport port-security
switchport port-security mac-address sticky
switchport port-security mac-address sticky 0014.a80a.f716 vlan access
switchport port-security mac-address sticky 0014.a80a.f741 vlan access
end
sw2#show int f0/20 | in Hardware
Hardware is Fast Ethernet, address is 0014.a80a.f716 (bia 0014.a80a.f716)
sw2#show int vlan 10 | in Hardware
Hardware is EtherSVI, address is 0014.a80a.f741 (bia 0014.a80a.f741)
sw1#show mac address-table | in 0/20
10 0014.a80a.f716 STATIC Fa0/20
10 0014.a80a.f741 STATIC Fa0/20
sw1#
sw2#show running-config int f0/20
Building configuration...
Current configuration : 312 bytes
!
interface FastEthernet0/20
switchport access vlan 10
switchport mode access
switchport port-security maximum 2
switchport port-security
switchport port-security mac-address sticky
switchport port-security mac-address sticky 001a.a164.b216
switchport port-security mac-address sticky 001a.a164.b241
end
sw1#show int f0/20 | in Hardware
Hardware is Fast Ethernet, address is 001a.a164.b216 (bia 001a.a164.b216)
sw1#show int vlan 10 | in Hardware
Hardware is EtherSVI, address is 001a.a164.b241 (bia 001a.a164.b241)
sw2#show mac address-table | in 0/20
10 001a.a164.b216 STATIC Fa0/20
10 001a.a164.b241 STATIC Fa0/20
---因為機(jī)架無法默認(rèn)中間加入其它二層設(shè)備，但是可以通過往互聯(lián)接口所在vlan添加其他接口來測試，因為接口收到其他mac地址的包，接口會down。
