! Projet : segmentation et securisation d'un reseau de PME
! Equipement : commutateur Cisco Catalyst 2960

enable
configure terminal

hostname SW1-PME
no ip domain-lookup
service password-encryption
enable secret A_REMPLACER

! Creation des VLAN
vlan 10
 name ADMINISTRATION
exit

vlan 20
 name EMPLOYES
exit

vlan 30
 name INVITES
exit

vlan 99
 name MANAGEMENT
exit

! Trunk 802.1Q vers le routeur
interface GigabitEthernet0/1
 description TRUNK_VERS_R1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
 no shutdown
exit

! Postes de l'administration
interface range FastEthernet0/2-5
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation restrict
 switchport port-security mac-address sticky
exit

! Postes des employes
interface range FastEthernet0/6-18
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation restrict
 switchport port-security mac-address sticky
exit

! Point d'acces du reseau invite
interface FastEthernet0/19
 description POINT_ACCES_INVITES
 switchport mode access
 switchport access vlan 30
 spanning-tree portfast
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
exit

! Interface de gestion du commutateur
interface vlan 99
 ip address 192.168.99.2 255.255.255.0
 no shutdown
exit

ip default-gateway 192.168.99.1

! Administration securisee en SSH
ip domain-name pme.local
username administrateur privilege 15 secret A_REMPLACER
crypto key generate rsa modulus 2048
ip ssh version 2

line vty 0 4
 login local
 transport input ssh
 exec-timeout 5 0
exit

! Desactivation des ports non utilises
interface range FastEthernet0/20-24
 description PORT_INUTILISE
 shutdown
exit

interface GigabitEthernet0/2
 description PORT_INUTILISE
 shutdown
exit

end
write memory

