vlan绑定mac-addip-add

Posted 2020-10-28

vlan绑定mac-add、ip-add实现只有绑定的用户才能上网，否则与网关不通，本网段通的效果。

配置模板

LSW1:
[Huawei]dis cu

sysname Huawei

vlan batch 2

cluster enable
ntdp enable
ndp enable

drop illegal-mac alar

user-bind static ip-address 192.168.1.1 mac-address 5489-9891-49fd vlan 1 //绑定ip、mac
user-bind static ip-address 192.168.2.1 mac-address 5489-98a2-570a vlan 2

diffserv domain default

drop-profile default

vlan 1 //开启检查功能
arp anti-attack check user-bind enable
vlan 2
arp anti-attack check user-bind enable

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password simple admin
local-user admin service-type http

interface Vlanif1
ip address 192.168.1.254 255.255.255.0

interface Vlanif2
ip address 192.168.2.254 255.255.255.0

interface MEth0/0/1

interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094

interface GigabitEthernet0/0/2