在35603750+2950T-24环境下部署DHCP Snooping+DAI

《在35603750+2950T-24环境下部署DHCP Snooping+DAI》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、在3560/3750+2950T-24环境下部署DHCPSnooping+DAI2009-01-0807:39在3560/3750+2950T-24环境下部署DHCPSnooping+DAI前几年卖了很多校园网，一般都是3560G/3750G+2950T-24模式。ARP攻击爆发，客户电话频频，用DHCPSnooping＋DAI是个不错的解决方法，但仔细看下，发现2950T-24不支持DAI，Faint一把,经某人思路提醒，能否在2950T－24上启用PVLAN实现端口隔离，在3560G/3750G上启用DAI

2、功能，这样ARP攻击就没问题了，测试，确实没问题，但本地二层端口不通，search一下手册，发现命令iplocal-proxy-arp，在interfacevlan接口下启用，OK。配置如下：hostnameSW3750clocktimezoneGMT8switch1provisionws-c3750g-24tsipsubnet-zeroiproutingnoipdhcpconflictlogging!ipdhcppoolclientnetwork192.168.3.0255.255.255.0default-

3、router192.168.3.1!ipdhcpsnoopingvlan3ipdhcpsnoopinginformationoptionallow-untrustedipdhcpsnoopingiparpinspectionvlan3iparpinspectionvalidateip!!!errdisablerecoverycausedhcp-rate-limiterrdisablerecoverycausearp-inspectionerrdisablerecoveryinterval30nofileveri

4、fyautospanning-treemodepvstspanning-treeextendsystem-id!vlaninternalallocationpolicyascending!!interfaceGigabitEthernet1/0/1switchporttrunkencapsulationdot1qswitchportmodetrunkiparpinspectionlimitnone!interfaceGigabitEthernet1/0/2............!interfaceGigabi

5、tEthernet1/0/28!interfaceVlan1noipaddressshutdown!interfaceVlan3ipaddress192.168.3.1255.255.255.0noipredirectsiplocal-proxy-arpiproute-cachesame-interface!interfaceVlan108ipaddress192.168.108.1255.255.255.0!end2950T配置Currentconfiguration:4418bytes!hostnameC2

6、950!enablepasswordcisco!errdisablerecoverycausedhcp-rate-limitipsubnet-zero!ipdhcpsnoopingvlan3ipdhcpsnooping!!spanning-treemodepvstnospanning-treeoptimizebpdutransmissionspanning-treeextendsystem-idnospanning-treevlan361nospanning-treevlan368nospanning-tree

7、vlan369nospanning-treevlan500!!interfaceFastEthernet0/1switchportaccessvlan3switchportprotectednoipaddressspanning-treeportfastipdhcpsnoopinglimitrate10!interfaceFastEthernet0/2switchportaccessvlan3switchportprotectednoipaddressspanning-treeportfastipdhcpsno

8、opinglimitrate10!interfaceFastEthernet0/3switchportaccessvlan3switchportprotectednoipaddressspanning-treeportfastipdhcpsnoopinglimitrate10!interfaceFastEthernet0/4switchportaccessvlan3switchport