813LAB AAAandVLAL

huluo520

看到好多解题的，对于AAA认证这点，都是对f0/1做配置，比如将F0/1加入到VLAN20中。同时，只对f0/1做认证。但拓扑图中显示有三个端口，f0/1 f0/2和f0/3，考过的大虾能否告诉为一下，为何只有f0/1上做配置呢。是实际题目要求还是什么原因。

wwang

是题目要求。仔细看题，题目中说要保护的是vlan20，而vlan20也是分配f0/1的vlan，所以只对这个端口就可以了：
Acme is a small shipping company that has an existing enterprise network comprised of 2
switches;DSW1 and ASW1. The topology diagram indicates their layer 2 mapping. VLAN 40 is
a new VLAN that will be used to provide the shipping personnel access to the server. For
security reasons, it is necessary to restrict access to VLAN 20 这里特指Vlan20需要保护！！in the following manner:
– Users connecting to ASW1’s port must be authenticate before they are given access to the
network. Authentication is to be done via a Radius server:
– Radius server host: 172.120.39.46
– Radius key: rad123
– Authentication should be implemented as close to the host device possible.
– Devices on VLAN 20 are restricted to in the address range of 172.120.40.0/24.
– Packets from devices in the address range of 172.120.40.0/24 should be passed on VLAN
20.
– Packets from devices in any other address range should be dropped on VLAN 20. 这里也有提及
– Filtering should be implemented as close to the server farm as possible.
The Radius server and application servers will be installed at a future date. You have been
tasked with implementing the above access control as a pre-condition to installing the
servers. You must use the available IOS switch features.

wwang

sdwchow 发表于 2011-9-14 13:57

                               
登录/注册后可看大图

你可能看错了吧！
VLAN 40 is a new VLAN that will be used to provide the shipping personnel access ...

VLAN 40 is a new VLAN that will be used to provide the shipping personnel access to the server. For security reasons, it is necessary to restrict access to VLAN 20 in the following manner:
VLAN 40  是一个新的VLAN，这个VLAN用于给那些运输人员使用连接服务器（这里我估计可能是类似于联邦快递那样的模式。）。出于安全的原因，必须要用如下的方法限制对于VLAN20的访问。
我粗略的翻译了一下，别笑啊。。
1。这里我个人认为题目特指要对VLAN20进行操作，主要是因为这句话“ it is necessary to restrict access to VLAN 20 in the following manner:” 这里in the following manner也说明了以下方法都是用于保护VLAN20的方法。
2。shipping personal,从严格意义上不能算users,在美国大多数人管他们叫crew 或者worker.这个东西如果在英语考试里面还有说服力，技术方面的考试没有说服力的。呵呵。。。。
另外刚才我看过上面一些回答之后，我觉得在其他端口加上dot1x port-control也不能算是错误的。而且我们公司在台湾的厂房里面也是这样做的。。。。。考试终究是考试。还是找个1000分的人来问问吧。