由于订购的IP Phone迟迟没有到货，没法自己做实验检验在配置voice vlan的接口上如何同时配置port security。网上有些文档说需要将连接Cisco IP Phone的交换机接口最大mac数目设置成至少3个，有的说设置成至少2个，但是都没有给出明确的原因，让人不知道该怎么办。
晚上在Cisco的网站上逛，看到了一篇文档Cisco Unified Communications SRND Based on Cisco Unified CallManager 5.x (需要CCO)
Voice Security章节里面有下面一段话：
Either port security or dynamic port security can be used to inhibit a MAC flooding attack. A customer with no requirement to use port security as an authorization mechanism would want to use dynamic port security with the number of MAC addresses appropriate to the function attached to a particular port. For example, a port with only a workstation attached to it would want to limit the number of learned MAC addresses to one. A port with a Cisco Unified IP Phone and a workstation behind it would want to set the number of learned MAC addresses to two (one for the IP phone itself and one for the workstation behind the phone) if a workstation is going to plug into the PC port on the phone. This setting in the past has been three MAC addresses, used with the older way of configuring the port in trunk mode. If you use the multi-VLAN access mode of configuration for the phone port, this setting will be two MAC addresses, one for the phone and one for the PC plugged into the phone. If there will be no workstation on the PC port, then the number of MAC addresses on that port should be set to one. These configurations are for a multi-VLAN access port on a switch. The configuration could be different if the port is set to trunk mode (not the recommended deployment of an access port with a phone and PC).
看过之后明白了——通常在交换机上端口上设置voice vlan有两种办法：
(1) Switch(config-if)#switchport trunk encapsulation dot1q
Switch(config-if)#switchport trunk native vlan id !— This is the VLAN with untagged frames used by the PC.
Switch(config-if)#switchport mode trunk !— This enables trunking on the port for two VLANs, data and voice.
Switch(config-if)#switchport voice vlan id
Switch(config-if)#spanning-tree portfast trunk
(2)
interface Fa0/1
switchport access vlan data vlan id
switchport mode access
switchport voice vlan voice vlan id
spanning-tree portfast
第一种配置方法是比较老式的，并且按照文档上说，不推荐在PC和phone同时使用的时候用这样的配置模式。在使用第一种配置方式的时候，电话的MAC会出现在voice vlan和native vlan中，因此算上PC需要占用至少3个MAC；
第二种配置方法被称为“multi-VLAN access port”模式。在这样的情况下电话的MAC只会出现在voice vlan中，因此只需要2个MAC。
其实在Cisco的交换机中内置了一些已经写好的非常好用的macro，可以很方便我们直接配置特定类型的端口。比如cisco-phone这个宏：
C3750#show parser macro name cisco-phone
Macro name : cisco-phone
Macro type : default interface
# Cisco IP phone + desktop template
# macro keywords $access_vlan $voice_vlan
# VoIP enabled interface – Enable data VLAN
# and voice VLAN
# Recommended value for access vlan should not be 1
switchport access vlan $access_vlan
switchport mode access
# Update the Voice VLAN value which should be
# different from data VLAN
# Recommended value for voice vlan should not be 1
switchport voice vlan $voice_vlan
# Enable port security limiting port to a 2 MAC
# addressess — One for desktop on data vlan and
# one for phone on voice vlan
switchport port-security
switchport port-security maximum 2
# Ensure port-security age is greater than one minute
# and use inactivity timer
switchport port-security violation restrict
switchport port-security aging time 2
switchport port-security aging type inactivity
# Enable auto-qos to extend trust to attached Cisco phone
auto qos voip cisco-phone
# Configure port as an edge network port
spanning-tree portfast
spanning-tree bpduguard enable
需要使用的时候接口模式调用即可：
C3750(config-if)#macro apply cisco-phone $access_vlan 20 $voice_vlan 80
C3750(config-if)#do sh run int g1/0/1
Building configuration…
Current configuration : 573 bytes
!
interface GigabitEthernet1/0/28
switchport access vlan 20
switchport mode access
switchport voice vlan 80
switchport port-security maximum 2
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
srr-queue bandwidth share 10 10 60 20
srr-queue bandwidth shape 10 0 0 0
queue-set 2
mls qos trust device cisco-phone
mls qos trust cos
macro description cisco-phone
auto qos voip cisco-phone
spanning-tree portfast
spanning-tree bpduguard enable
end
9-11那天去考了安全的lab，感觉题目内容有些地方比较变态，但是整体看来还算是合理。