1.实验拓扑
（1）配置S1的G0/0/1接口的端口安全。
S1的配置
<Huawei>sys
[Huawei]undo info-center enable
[Huawei]sysname S1
[S1]interface g0/0/1
[S1-GigabitEthernet0/0/1]port-security enable
[S1-GigabitEthernet0/0/1]port-security max-mac-num 2
[S1-GigabitEthernet0/0/1]port-security protect-action shutdown
利用PC1，PC2访问PC4,查看S1的MAC地点表。
PC1访问PC4：
PC>ping 10.1.1.4
Ping 10.1.1.4: 32 data bytes, Press Ctrl_C to break
From 10.1.1.4: bytes=32 seq=1 ttl=128 time=47 ms
From 10.1.1.4: bytes=32 seq=2 ttl=128 time=63 ms
From 10.1.1.4: bytes=32 seq=3 ttl=128 time=94 ms
From 10.1.1.4: bytes=32 seq=4 ttl=128 time=47 ms
From 10.1.1.4: bytes=32 seq=5 ttl=128 time=93 ms
--- 10.1.1.4 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 47/68/94 ms
PC2访问PC4：
PC>ping 10.1.1.4
Ping 10.1.1.4: 32 data bytes, Press Ctrl_C to break
From 10.1.1.4: bytes=32 seq=1 ttl=128 time=78 ms
From 10.1.1.4: bytes=32 seq=2 ttl=128 time=94 ms
From 10.1.1.4: bytes=32 seq=3 ttl=128 time=62 ms
From 10.1.1.4: bytes=32 seq=4 ttl=128 time=62 ms
From 10.1.1.4: bytes=32 seq=5 ttl=128 time=62 ms
--- 10.1.1.4 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 62/71/94 ms
查看S1的MAC地点表：
[S1]display mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9803-6228 1 - - GE0/0/1 security -
5489-982b-2f53 1 - - GE0/0/1 security -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 2
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-98fd-042c 1 - - GE0/0/3 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
利用非法用户访问PC4：
PC>ping 10.1.1.4
Ping 10.1.1.4: 32 data bytes, Press Ctrl_C to break
From 10.1.1.6: Destination host unreachable
From 10.1.1.6: Destination host unreachable
From 10.1.1.6: Destination host unreachable
From 10.1.1.6: Destination host unreachable
From 10.1.1.6: Destination host unreachable
--- 10.1.1.4 ping statistics ---
5 packet(s) transmitted
0 packet(s) received
100.00% packet loss
（2）配置S1的G0/0/2接口为安全静态MAC地点。
[S1]i g00/0/2
[S1-GigabitEthernet0/0/2]port-security enable
[S1-GigabitEthernet0/0/2]port-security mac-address sticky
[S1-GigabitEthernet0/0/2]port-security mac-address sticky 5489-9827-7795 vlan 1
[S1-GigabitEthernet0/0/2]port-security max-mac-num 1
查看S1的MAC地点表：
[S1]display mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9827-7795 1 - - GE0/0/2 sticky -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
[S1]
- 配置S1的G0/0/3接口为Sticky MAC。
[S1]i g0/0/3
[S1-GigabitEthernet0/0/3]port-security enable
[S1-GigabitEthernet0/0/3]port-security mac-address sticky
[S1-GigabitEthernet0/0/3]port-security max-mac-num 1
在PC4没通信之前，交换机的MAC地点表并没有其MAC地点的对应关系。查看MAC地点表。
[S1]display mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9827-7795 1 - - GE0/0/2 sticky -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
在PC4上访问PC3：
PC>ping 10.1.1.4
Ping 10.1.1.4: 32 data bytes, Press Ctrl_C to break
From 10.1.1.4: bytes=32 seq=1 ttl=128 time=47 ms
From 10.1.1.4: bytes=32 seq=2 ttl=128 time=31 ms
From 10.1.1.4: bytes=32 seq=3 ttl=128 time=31 ms
From 10.1.1.4: bytes=32 seq=4 ttl=128 time=47 ms
From 10.1.1.4: bytes=32 seq=5 ttl=128 time=47 ms
--- 10.1.1.4 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 31/40/47 ms
再次查看MAC地点表：
[S1]display mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9827-7795 1 - - GE0/0/2 sticky -
5489-98fd-042c 1 - - GE0/0/3 sticky -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 2
可以看到G0/0/3接口学习到的MAC地点为PC4的MAC地点，并且类型为sticky。
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。 | 
