mac地址表项配置
一、实验拓扑
image.png
二、配置静态mac表项
[LSW1]mac-address static 5489-9836-3010 GigabitEthernet 0/0/2 vlan 1
[LSW1]dis mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9836-3010 1 - - GE0/0/2 static -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
[LSW1]
三、配置mac表项黑洞
[LSW1]mac-address blackhole 5489-988F-7EB6
[LSW1]dis mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-988f-7eb6 - - - - blackhole -
5489-9836-3010 1 - - GE0/0/2 static -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 2
四、mac地址漂移
1.通过修改PC4的mac地址，让pc4的mac地址和pc3的mac地址一样来模拟mac地址漂移
2.先后用pc3和pc4 去ping pc1，交换机上会有flapping告警，最终mac地址表的接口为最后去ping的pc4连接口
[LSW1-GigabitEthernet0/0/3]
Sep 26 2019 06:39:46-08:00 LSW1 DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.2
5.191.3.1 configurations have been changed. The current change number is 19, the
change loop count is 0, and the maximum number of records is 4095.
Sep 26 2019 06:39:53-08:00 LSW1 L2IFPPI/4/MFLPVLANALARM:OID 1.3.6.1.4.1.2011.5.2
5.160.3.7 MAC move detected, VlanId = 1, MacAddress = 5489-9836-3010, Original-P
ort = GE0/0/2, Flapping port = GE0/0/3. Please check the network accessed to fla
pping port.
[LSW1-GigabitEthernet0/0/3]dis mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-983f-5bfe 1 - - GE0/0/1 dynamic 0/-
5489-9836-3010 1 - - GE0/0/3 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 2
3.通过修改G0/0/3的mac地址学习优先级来防止mac地址漂移，发现连接在G0/0/2的PC3去ping PC1就不通了，mac地址表项还是G0/0/3接口
[LSW1-GigabitEthernet0/0/3]mac-learning priority 3
PC3>ping 1.1.1.1
Ping 1.1.1.1: 32 data bytes, Press Ctrl_C to break
Request timeout!
Request timeout!
Request timeout!
Request timeout!
Request timeout!
4.把G0/02的mac学习优先级也改成和G0/0/3的一样，通过“[Huawei]undo mac-learning priority 3 allow-flapping ”命令来阻止flapping
实验现象就是：先到先得，pc3先ping的pc1，mac地址表对应的接口就是G0/0/2，再用pc4去ping就ping不通了
五、端口安全
1.在交换机接口1启动端口安全，先后用pc1和pc2去ping pc4，发现pc1的mac地址表项为安全表项，pc2就ping不通并产生告警
[LSW1-GigabitEthernet0/0/1]port-security enable
[LSW1-GigabitEthernet0/0/1]dis mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-983f-5bfe 1 - - GE0/0/1 security -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9836-3010 1 - - GE0/0/3 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
[LSW1-GigabitEthernet0/0/1]
Sep 26 2019 07:04:13-08:00 LSW1 L2IFPPI/4/PORTSEC_ACTION_ALARM:OID 1.3.6.1.4.1.2
011.5.25.42.2.1.7.6 The number of MAC address on interface (6/6) GigabitEthernet
0/0/1 reaches the limit, and the port status is : 1. (1:restrict;2:protect;3:shu
tdown)
2.修改超出mac地址安全学习上限数的保护动作
[LSW1-GigabitEthernet0/0/1]port-security protect-action shutdown
[LSW1-GigabitEthernet0/0/1]
Sep 26 2019 07:18:13-08:00 LSW1 L2IFPPI/4/PORTSEC_ACTION_ALARM:OID 1.3.6.1.4.1.2
011.5.25.42.2.1.7.6 The number of MAC address on interface (6/6) GigabitEthernet
0/0/1 reaches the limit, and the port status is : 3. (1:restrict;2:protect;3:shu
tdown)
Sep 26 2019 07:18:13-08:00 LSW1 %%01PHY/1/PHY(l)[18]: GigabitEthernet0/0/1: c
hange status to down
image.png
3.修改安全学习动态接口的上限
[LSW1-GigabitEthernet0/0/1]port-security max-mac-num 2
[LSW1-GigabitEthernet0/0/1]dis mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-98de-6369 1 - - GE0/0/1 security -
5489-983f-5bfe 1 - - GE0/0/1 security -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 2
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9836-3010 1 - - GE0/0/3 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
4.重启G0/0/1，安全mac地址表项会消失
5.修改为sticky端口
[LSW1-GigabitEthernet0/0/1]port-security mac-address sticky
之前学习到的安全端口立马转为sticky端口,掉电不消失
[LSW1-GigabitEthernet0/0/1]port-security mac-address sticky
[LSW1-GigabitEthernet0/0/1]dis mac
[LSW1-GigabitEthernet0/0/1]dis mac-ad
[LSW1-GigabitEthernet0/0/1]dis mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-98de-6369 1 - - GE0/0/1 sticky -
5489-983f-5bfe 1 - - GE0/0/1 sticky -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 2
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9836-3010 1 - - GE0/0/3 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
接口使能Sticky MAC功能时，接口上的安全动态MAC地址表项将转化为Sticky MAC地址，之后学习到的MAC地址也变为Sticky MAC地址。
接口去使能端口安全功能时，接口上的安全动态MAC地址将被删除，重新学习动态MAC地址。
接口去使能StickyMAC功能时，接口上的StickyMAC地址会被删掉，重新学习mac地址
