【正文】 dress Cost 4 Port 25(GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32828 (priority 32768 sysidext 60) Address Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 20Interface Role Sts Cost Type Fa0/1 Desg FWD 19 P2pFa0/2 Desg FWD 19 P2pGi0/1 Root FWD 4 P2pVLAN0070 Spanning tree enabled protocol ieee Root ID Priority 4166 Address Cost 4 Port 25(GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32838 (priority 32768 sysidext 70) Address Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 20Interface Role Sts Cost Type Fa0/1 Desg FWD 19 P2pFa0/2 Desg FWD 19 P2pGi0/1 Root FWD 4 P2pVLAN0080 Spanning tree enabled protocol ieee Root ID Priority 4176 Address Cost 4 Port 25(GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32848 (priority 32768 sysidext 80) Address Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 20Interface Role Sts Cost Type Fa0/1 Desg FWD 19 P2pFa0/2 Desg FWD 19 P2pGi0/1 Root FWD 4 P2pDHCP驗(yàn)證結(jié)果圖53 VLAN 10的主機(jī)DHCP獲取地址截圖端口安全驗(yàn)證部分端口的安全信息：interface FastEthernet0/2 switchport access vlan 10 switchport portsecurity macaddress sticky switchport portsecurity violation protect interface FastEthernet0/3 switchport access vlan 10 switchport portsecurity macaddress sticky switchport portsecurity violation protect interface FastEthernet0/4 switchport access vlan 10 switchport portsecurity macaddress sticky switchport portsecurity violation protect interface FastEthernet0/5 switchport access vlan 10 switchport portsecurity macaddress sticky switchport portsecurity violation protect 6圖書館網(wǎng)絡(luò)項(xiàng)目的設(shè)計方案（負(fù)責(zé)人。在核心1上配置DHCP服務(wù)，給VLAN10，分發(fā)地址。將三層交換機(jī)之間相連的接口配置為trunk模式，將二層與三層連接的接口配置為trunk模式。實(shí)驗(yàn)中用兩個三層交換機(jī)代替核心交換機(jī)，用兩個三層交換接作為匯聚層交換機(jī)，四個二層交換機(jī)作為接入交換機(jī)。模擬器中不支持基于時間的ACL，故沒有實(shí)現(xiàn)。圖52辦公區(qū)網(wǎng)絡(luò)實(shí)驗(yàn)拓?fù)鋱D論證實(shí)驗(yàn)的綜合應(yīng)用技術(shù)說明實(shí)驗(yàn)中應(yīng)用的技術(shù)有MSTP技術(shù)，VLAN技術(shù)，ACL技術(shù)，端口安全技術(shù)，DHCP技術(shù)。端口安全：防止局域網(wǎng)大部分的內(nèi)部攻擊對用戶、網(wǎng)絡(luò)設(shè)備造成的破壞，如MAC地址攻擊、ARP攻擊、IP/MAC地址欺騙等。DHCP Snooping：DHCP Snooping技術(shù)是DHCP安全特性，通過建立和維護(hù)DHCP Snooping綁定表過濾不可信任的DHCP信息，這些信息是指來自不信任區(qū)域的DHCP信息。這些指令列表用來告訴路由器哪能些數(shù)據(jù)包可以收、哪能數(shù)據(jù)包需要拒絕。 VLAN是為解決以太網(wǎng)的廣播問題和安全性而提出的一種協(xié)議。它可以把一臺交換機(jī)的一個或多個VLAN劃分為instance，有著相同instance配置的交換機(jī)就組成了一個域（MST region），運(yùn)行獨(dú)立的生成樹（這個內(nèi)部的生成樹稱為IST，Interal Spanning tree）；這個MST region組合就相當(dāng)于一個大的交換機(jī)整體，與其他的MST region 再進(jìn)行生成樹算法運(yùn)算，得出一個整體的生成樹，稱為CST（Common Spanning Tree）。在接入層交換機(jī)上采取必要的安全配置，開啟端口安全，開啟DHCPsnooping，防止一些惡意的攻擊，和地址欺騙等。建立基于時間的ACL，對用戶訪問網(wǎng)絡(luò)進(jìn)行時間段的控制。圖48 策略路由驗(yàn)證測試圖49 出口路由器路由表（2）NAPT驗(yàn)證結(jié)果5辦公區(qū)網(wǎng)絡(luò)項(xiàng)目的設(shè)計方案（負(fù)責(zé)人：郭鑫）圖51 辦公區(qū)網(wǎng)絡(luò)拓?fù)鋱D在辦公區(qū)網(wǎng)絡(luò)中，匯聚交換機(jī)采用冗余的連接到核心層，采用MSTP解決環(huán)路問題，實(shí)現(xiàn)鏈路備份。主干區(qū)域內(nèi)部實(shí)驗(yàn)驗(yàn)證結(jié)果（1）MSTP配置結(jié)果：S3550Ashow spanningtreeStpVersion : MSTPSysStpStatus : EnabledBaseNumPorts : 24MaxAge : 20HelloTime : 2ForwardDelay : 15BridgeMaxAge : 20BridgeHelloTime : 2BridgeForwardDelay : 15MaxHops : 20TxHoldCount : 3PathCostMethod : LongBPDUGuard : DisabledBPDUFilter : Disabled MST 1 vlans mapped : 10,30BridgeAddr : Priority : 0TimeSinceTopologyChange : 0d:2h:27m:9sTopologyChanges : 0DesignatedRoot : 000100D0F8B85135RootCost : 0RootPort : 0 MST 2 vlans mapped : 20,40BridgeAddr : Priority : 4096TimeSinceTopologyChange : 0d:2h:27m:9sTopologyChanges : 0DesignatedRoot : 000200D0F8B85D95RootCost : 190000RootPort : Ag1不同實(shí)例下端口的角色不同S3550Ashow spanningtree mst 1 int aggregatePort 1 MST 1 vlans mapped : 10,30PortState : forwardingPortPriority : 128PortDesignatedRoot : 000100D0F8B85135PortDesignatedCost : 0PortDesignatedBridge : 000100D0F8B85135PortDesignatedPort : 83E9PortForwardTransitions : 1PortAdminPathCost : 0PortOperPathCost : 190000PortRole : designatedPortS3550Ashow spanningtree mst 2 int aggregatePort 1 MST 2 vlans mapped : 20,40PortState : forwardingPortPriority : 128PortDesignatedRoot : 000200D0F8B85D95PortDesignatedCost : 0PortDesignatedBridge : 000200D0F8B85D95PortDesignatedPort : 83E9PortForwardTransitions : 1PortAdminPathCost : 0PortOperPathCost : 190000PortRole : rootPortS3550Bshow spanningtreeStpVersion : MSTPSysStpStatus : EnabledBaseNumPorts : 24MaxAge : 20HelloTime : 2ForwardDelay : 15BridgeMaxAge : 20BridgeHelloTime : 2BridgeForwardDelay : 15MaxHops : 20TxHoldCount : 3PathCostMethod : LongBPDUGuard : DisabledBPDUFilter : Disabled MST 1 vlans mapped : 10,30BridgeAddr : Priority : 4096TimeSinceTopologyChange : 0d:2h:25m:35sTopologyChanges : 0DesignatedRoot : 000100D0F8B85135RootCost : 190000RootPort : Ag1 MST 2 vlans mapped : 20,40BridgeAddr : Priority : 0TimeSinceTopologyChange : 0d:2h:25m:35sTopologyChanges : 0DesignatedRoot : 000200D0F8B85D95RootCost : 0RootPort : 0S2126Ashow spanningtreeStpVersion : MSTPSysStpStatus : EnabledBaseNumPorts : 24MaxAge : 20HelloTime : 2ForwardDelay : 15BridgeMaxAge : 20BridgeHelloTime : 2BridgeForwardDelay : 15MaxHops : 20TxHoldCount : 3PathCostMethod : LongBPD