问题描述：
1.我在h3c模拟器配置接入交换机，在其中端口配置port-security max-mac-count 1 限制。
下面再接交换机。为什么多台电脑还可以获得IP地址。麻烦朋友帮忙解答下。
组网及组网描述：
- 2022-11-09提问
- 举报
-
(0)
1）使能端口安全功能
<H3C> system-view
[H3C] port-security enable
2）设置Sticky MAC地址的老化时间为30分钟
[H3C] port-security timer autolearn aging 30
3）设置端口允许的最大安全MAC地址数为1
[H3C] interface GigabitEthernet 1/0/1
[H3C-GigabitEthernet1/0/1] port-security max-mac-count 1
4）设置端口安全模式为autoLearn
[H3C-GigabitEthernet1/0/1] port-security port-mode autolearn
5）设置触发入侵检测特性后的保护动作为暂时关闭端口，关闭时间为30秒
[H3C-GigabitEthernet1/0/1] port-security intrusion-mode disableport-temporarily
[H3C-GigabitEthernet1/0/1] quit
[H3C] port-security timer disableport 30
- 2022-11-09回答
- 评论(10)
- 举报
-
(0)
你好，我按照你方法配置接入交换机1-4步，为什么下面电脑还可以多台获取地址啊 。我有点纳闷。
配置如下：
#
version 7.1.075, Alpha 7571
#
sysname H3C
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
mac-authentication
#
lldp global enable
#
system-working-mode standard
xbar load-single
password-recovery enable
lpu-type f-series
#
vlan 1
#
vlan 2 to 3
#
stp global enable
#
interface Bridge-Aggregation1
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 2 to 3
link-aggregation mode dynamic
#
interface NULL0
#
interface FortyGigE1/0/53
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 2 to 3
port link-aggregation group 1
#
interface FortyGigE1/0/54
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 2 to 3
port link-aggregation group 1
#
interface GigabitEthernet1/0/1
port link-mode bridge
port access vlan 2
combo enable fiber
port-security max-mac-count 1
port-security port-mode autolearn
#
interface GigabitEthernet1/0/2
port link-mode bridge
port access vlan 3
combo enable fiber
#
interface GigabitEthernet1/0/3
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/4
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/5
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/6
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/7
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/8
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/9
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/10
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/11
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/12
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/13
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/14
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/15
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/16
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/17
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/18
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/19
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/20
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/21
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/22
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/23
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/24
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/25
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/26
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/27
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/28
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/29
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/30
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/31
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/32
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/33
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/34
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/35
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/36
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/37
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/38
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/39
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/40
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/41
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/42
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/43
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/44
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/45
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/46
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/47
port link-mode bridge
combo enable fiber
#
interface GigabitEthernet1/0/48
port link-mode bridge
combo enable fiber
#
interface M-GigabitEthernet0/0/0
#
interface Ten-GigabitEthernet1/0/49
port link-mode bridge
combo enable fiber
#
interface Ten-GigabitEthernet1/0/50
port link-mode bridge
combo enable fiber
#
interface Ten-GigabitEthernet1/0/51
port link-mode bridge
combo enable fiber
#
interface Ten-GigabitEthernet1/0/52
port link-mode bridge
combo enable fiber
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
user-role network-admin
#
line class tty
user-role network-operator
#
line class vty
user-role network-operator
#
line aux 0
user-role network-operator
#
line con 0
user-role network-admin
#
line vty 0 63
user-role network-operator
#
radius scheme system
user-name-format without-domain
#
domain name system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
return
- 2022-11-09回答
- 评论(0)
- 举报
-
(0)
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
你好： 第五条可以不配吗：5）设置触发入侵检测特性后的保护动作为暂时关闭端口，关闭时间为30秒 [H3C-GigabitEthernet1/0/1] port-security intrusion-mode disableport-temporarily [H3C-GigabitEthernet1/0/1] quit [H3C] port-security timer disableport 30
可以不配置，这只是保护动作
帮看下下面配置
[H3C] port-security enable 全局没开。。
问下第2和5步不配置。端口安全下接第一台电脑后，过多久才能在其端口下接变更第二台电脑。老化时间多久
第二步限制了30分钟
不配置不会老化
port-security enable port-security timer autolearn aging 2 interface GigabitEthernet1/0/1 port link-mode bridge port access vlan 2 combo enable fiber port-security max-mac-count 2 port-security port-mode autolearn :我限制老化时间2分钟，端口限制2台MAC，为什么接第三台也可以获取IP地址
第五步配置上
port-security enable port-security timer autolearn aging 30port-security port-mode autolearn 这条端口模式可以不配。只配port-security max-mac-count 1