-
Protocoles de découverte de voisins :
SR30-Cisco-1#show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,
D - Remote, C - CVTA, M - Two-port Mac Relay
Device ID Local Intrfce Holdtme Capability Platform Port ID
SR30-1200-1.deule.net
Gig 0/44 136 T I AIR-AP124 Fas 0
SR22-R3560E.deule.net
Gig 0/2 126 R S I WS-C3560E Gig 0/10
RG20-R6506.deule.net
Ten 0/1 173 R S I WS-C6506- Ten 1/4
SR30-3560E-2.deule.net
Ten 0/2 167 S I WS-C3560E Ten 0/
SR32-HP-1# show lldp info remote-device
LLDP Remote Devices Information
LocalPort | ChassisId PortId PortDescr SysName
--------- + ------------------------- ------ --------- ----------------------
A1 | RG20-R6506.deule.net Ten...
A1 | 00 11 5d f2 54 00 Te3/4 TenGig... RG20-R6506.deule.net
B1 | e4 11 5b 6e e3 80 51 B1 SR32-HP2910-2
- Adresses apprises sur un commutateur :
RG20-Cisco-4# show mac-address-table
Dynamic Address Count: 142
Secure Address (User-defined) Count: 0
Static Address (User-defined) Count: 0
System Self Address Count: 50
Total MAC addresses: 192
Maximum MAC addreses: 8192
Non-static Address Table:
Destination Address Address Type VLAN Destination Port
------------------- ------------ ---- --------------------
0000.9431.1968 Dynamic 8 FastEthernet0/1
0000.b438.80e2 Dynamic 7 FastEthernet0/1
0000.b452.e1cf Dynamic 3 FastEthernet0/1
0000.b45c.95c1 Dynamic 11 FastEthernet0/1
0000.e899.8873 Dynamic 8 FastEthernet0/1
0000.e8ee.d420 Dynamic 8 FastEthernet0/1
0005.0254.9f41 Dynamic 8 FastEthernet0/1
0005.0276.2442 Dynamic 8 FastEthernet0/1
0010.4b5b.8557 Dynamic 3 FastEthernet0/1
0010.4bce.7310 Dynamic 8 FastEthernet0/1
...
SR32-HP-1# show mac-address vlan 4
Status and Counters - Address Table - VLAN 4
MAC Address Located on Port
------------- ---------------
00000c-9ff004 A1
00112f-c66ad0 A1
00115d-f25400 A1
00163e-e04561 A1
...
- Définition des VLANS :
RG20-2# show vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/6, Fa0/7, Fa0/8, Fa0/20
2 SERVERS active
3 STAFF active Fa0/22, Fa0/23, Fa0/24
4 STUDENTS active Fa0/9, Fa0/10, Fa0/11, Fa0/12,
Fa0/13, Fa0/14, Fa0/15, Fa0/16,
Fa0/17, Fa0/18, Fa0/19, Fa0/21
5 ADMIN active
6 INSECURE active
7 STAFF-PRIV active
...
RG20-2# show running-config
Current configuration:
!
version 11.2
service password-encryption
!
hostname RG20-2924M-2
!
enable password 7 110E091D
!
interface VLAN1
ip address 172.26.224.17 255.255.240.0
no ip route-cache
!
interface FastEthernet0/1
switchport mode trunk
!
interface FastEthernet0/2
switchport mode trunk
!
interface FastEthernet0/3
switchport mode trunk
!
interface FastEthernet0/4
switchport mode trunk
!
interface FastEthernet0/5
switchport mode trunk
!
interface FastEthernet0/9
switchport access vlan 4
!
interface FastEthernet0/10
switchport access vlan 4
!
...
- Spanning tree :
RG20-2# show spanning-tree vlan 4
Spanning tree 4 is executing the IEEE compatible Spanning Tree protocol
Bridge Identifier has priority 32768, address 00d0.58f5.3f83
Configured hello time 2, max age 20, forward delay 15
Current root has priority 32768, address 00d0.588f.9083
Root port is 42, cost of root path is 27
Topology change flag not set, detected flag not set, changes 2565
Times: hold 1, topology change 35, notification 2
hello 2, max age 20, forward delay 15
Timers: hello 0, topology change 0, notification 0
Interface Fa0/1 (port 13) in Spanning tree 4 is FORWARDING
Port path cost 19, Port priority 128
Designated root has priority 32768, address 00d0.588f.9083
Designated bridge has priority 32768, address 00d0.58f5.3f83
Designated port is 13, path cost 27
Timers: message age 0, forward delay 0, hold 0
BPDU: sent 3504307, received 3203
...
- Configuration liées au 802.1x sur un commutateur :
RG20-2950G-13#sh run
...
aaa new-model
aaa authentication dot1x default group radius
dot1x system-auth-control
...
interface FastEthernet0/37
switchport access vlan 4
switchport mode access
dot1x port-control auto
dot1x host-mode multi-host
spanning-tree portfast
!
...
radius-server host 172.26.16.2 auth-port 1812 acct-port 1813
radius-server key petitcurieux
...
- Fichier de contrôle 802.1x sur les clients :
[STATE] Processing CONNECTING state.
[STATE] Sending EAPOL-Start Frame.
[STATE] Processing ACQUIRED state.
Connection established, authenticating...
[STATE] Sending EAPOL-Response-Identification
[STATE] ACQUIRED -> AUTHENTICATING
[STATE] Processing AUTHENTICATING state.
[STATE] Sending EAPOL-Response-Authentication
[CONFIG] Loading certificate /etc/1x/cert/cacert.pem . . .
[CONFIG] Loaded root certificate /etc/1x/cert/cacert.pem
[CONFIG] Loading user Private Key from /etc/1x/cert/hosttp-priv-nopass.pem...
Authenticated!
[STATE] (global) -> AUTHENTICATED
- Fichier de contrôle 802.1x sur le serveur :
eap {
default_eap_type = peap
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
md5 { }
leap { }
gtc { auth_type = PAP }
tls {
private_key_file = ${raddbdir}/certs/radius-priv.pem
certificate_file = ${raddbdir}/certs/radius-cert.pem
CA_file = /etc/ssl/cacert.pem
CA_path = /etc/ssl/newcerts
dh_file = ${raddbdir}/certs/dh
random_file = ${raddbdir}/certs/random
fragment_size = 1024
include_length = yes
}
ttls {
default_eap_type = md5
copy_request_to_tunnel = no
use_tunneled_reply = no
}
peap {
default_eap_type = mschapv2
}
mschapv2 { }
}
