Securing Unused Ports保護未使用的連接埠

Organizations commonly implement security solutions using routers, firewalls, intrusion prevention system (IPS), and virtual private network (VPN) devices. These devices protect the elements in Open Systems Interconnection Layer 3 through Layer 7. Layer 2 LANs are often considered to be a safe and secure environment. However, Ethernet, the most commonly deployed data link layer technology, provides no mechanisms for security. A similar lack of security exists in many technologies that are built on top of Ethernet and depend on Ethernet, such as transparent bridging and switching, Spanning Tree Protocol (STP), and ARP. If Layer 2 is compromised, then all layers above it are also affected. Layer 2 security solutions must be implemented to help secure a network. Fortunately, features have been designed and implemented within network devices to provide security services for Layer 2.

組織通常會使用路由器、防火牆、入侵防禦系統（IPS）與虛擬私人網路（VPN）裝置來實作安全解決方案。這些裝置保護開放式系統互連（OSI）第 3 層到第 7 層的元素。第 2 層 LAN 通常被視為安全無虞的環境，然而 Ethernet 這種最常見的資料鏈結層技術，本身並未提供任何安全機制。許多建立在 Ethernet 之上、依賴 Ethernet 運作的技術也同樣缺乏安全性，例如透通式橋接與交換、生成樹協定（STP），以及 ARP。如果第 2 層遭到入侵，其上的所有層級也會受到影響。因此必須實作第 2 層安全解決方案，以協助保護網路。所幸，網路裝置已設計並實作了為第 2 層提供安全服務的功能。

Device security features aim to mitigate known LAN attacks, such as Cisco Discovery Protocol reconnaissance attack, MAC address table flooding attack, VLAN attacks, and DHCP attacks.

裝置安全功能旨在緩解已知的 LAN 攻擊，例如 Cisco Discovery Protocol 偵察攻擊、MAC 位址表洪泛攻擊、VLAN 攻擊，以及 DHCP 攻擊。

Many of the attacks presume that the attacker has access to the network. Since the attacker needs to physically connect to the network somehow, a simple method to help secure the network from unauthorized access is to disable all unused ports on a switch.

許多攻擊都假設攻擊者已能存取網路。由於攻擊者必須以某種方式實體連接到網路，一個保護網路免於未授權存取的簡單方法，就是停用交換器上所有未使用的連接埠。

By default, switch ports are forwarding, and they are not shut down. To disable a port, you administratively shut it down in the interface configuration mode using the shutdown command.

根據預設，交換器連接埠處於轉送狀態，並未被關閉。若要停用某個連接埠，可在介面設定模式下使用 shutdown 命令將其以管理方式關閉。

Disabling ports one by one is time-consuming. If continuous ranges of ports should be shut down, use the interface rangeinterface-id command.

逐一停用連接埠相當耗時。若要停用連續範圍的多個連接埠，可使用 interface rangeinterface-id 命令。

Using the interface range command also ensures that you are providing uniform configuration across multiple ports.

使用 interface range 命令也能確保你在多個連接埠上套用一致的設定。

You can verify that you have disabled a port by looking for the shutdown command within an interface configuration in the running configuration.

你可以在執行中設定中，查看介面設定內是否有 shutdown 命令，藉此確認該連接埠已停用。

The following is an example of shutting down a range of ports and verifying the configuration:

以下範例示範如何關閉一個範圍的連接埠並驗證設定：

The process of enabling and disabling ports can be time-consuming, but it enhances security on the network and is well worth the effort.

啟用與停用連接埠的程序可能相當耗時，但它能提升網路安全性，十分值得投入這番功夫。

Another security practice is to create a VLAN dedicated for unused ports. Do not create a switch virtual interface (SVI) for that VLAN, to prevent the unauthorized person from attacking the switch itself. Once the VLAN is created, add unused ports to the VLAN. Sometimes, this VLAN is called the "parking" or "black hole" VLAN.

另一項安全實務做法，是建立一個專門用於未使用連接埠的 VLAN。請勿為該 VLAN 建立交換器虛擬介面（SVI），以防止未經授權的人攻擊交換器本身。建立該 VLAN 後，將未使用的連接埠加入其中。有時這個 VLAN 被稱為「停放（parking）」VLAN 或「黑洞（black hole）」VLAN。

Use the vlan command to configure a new VLAN. Then, on each unused interface, use the switchport mode access command to prevent the interface from trunking by default if the other side wants to trunk, and the switchport access vlanvlan-id command to add ports into the VLAN.

使用 vlan 命令設定新的 VLAN。接著在每個未使用的介面上，使用 switchport mode access 命令，避免在對端要求中繼時該介面預設進行中繼；再使用 switchport access vlanvlan-id 命令，將連接埠加入該 VLAN。

In addition, you can shut down the VLAN using the shutdown command in VLAN configuration mode. After you shut down a VLAN, the traffic ceases to flow on that VLAN. This way, you prevent unused ports from communicating with each other.

此外，你也可以在 VLAN 設定模式下使用 shutdown 命令停用該 VLAN。停用 VLAN 後，該 VLAN 上的流量就會停止傳輸，藉此防止未使用的連接埠彼此通訊。

The example configuration on a switch with only two unused ports, GigabitEthernet 0/1 and GigabitEthernet 0/2, is as follows:

以下是在只有兩個未使用連接埠（GigabitEthernet 0/1 與 GigabitEthernet 0/2）的交換器上進行設定的範例：