cisco常见应用场景和配置.ppt

方剑锋 浙大快威 工程师内容安排,Cisco交换设备介绍 常见应用场景和配置 常见故障诊断,基本配置（一）,更改主机名,Switch(config)#hostname S2-C-HZXH-7609-1,设置时钟和NTP时钟同步,Switch(config)#clock timezone Beijing 8 Switch(config)# ntp server 61.174.64.11,时间戳设置,Switch(config)#service timestamps debug datetime msec localtime Switch(config)#service timestamps log datetime msec localtime,基本配置（二）,AAA认证配置,ip tacacs source-interface Loopback0 tacacs-server host 202.96.96.86 tacacs-server key hzdx aaa new-model aaa authentication login default group tacacs+ line enable aaa authentication enable default group tacacs+ enable aaa accounting commands 15 default start-stop group tacacs+,telnet参数设置,line vty 0 4 access-class 9 in exec-timeout 3 0 password wyzx2008,基本配置（三）,Log日志设置,logging trap notifications logging source-interface Loopback0 logging 202.96.96.34,SNMP设置,Switch(config)#snmp-server community sjzx2004 RO 9,VLAN配置,创建和删除VLAN,Switch(config)#vlan 1200 Switch(config-vlan)#name test Switch(config)#no vlan 1200,创建SVI,interface Vlan1200 description test ip address 60.190.36.177 255.255.255.252 no ip redirects no ip unreachables no ip proxy-arp,定义VTP模式和使用扩展VLAN,Switch(config)# vtp mode transparent Switch(config)# spanning-tree extend system-id,接口配置（一）,Access接口,interface FastEthernet6/3 description L1212628 switchport (45和35系列交换机上不需要此命令) switchport access vlan 3103 switchport mode access speed 10 duplex full,trunk接口,interface GigabitEthernet1/1 description to 7609-3/2 switchport (45和35系列交换机上不需要此命令) switchport trunk encapsulation dot1q switchport trunk allowed vlan 700,810,821,842,849,859,868,974 switchport trunk allowed vlan add 11201-1244,3101-3148 switchport mode trunk,接口配置（二）,路由接口配置,interface GigabitEthernet1/1 description to 7609-3/2 no switchport (65/76上不需要此命令） ip address 60.190.36.177 255.255.255.252 no ip redirects no ip unreachables no ip proxy-arp,QINQ接口配置,interface GigabitEthernet7/22 description GuDang-OLT-C200-1-port 2 mtu 1538 switchport (35系列交换机上不需要此命令) switchport access vlan 702 switchport mode dot1q-tunnel no cdp enable spanning-tree bpdufilter enable,接口配置（三）,接口限速配置（45系列交换机）,policy-map 4M class class-default police 4 mbps 400 kbyte conform-action transmit exceed-action drop interface FastEthernet6/11 service-policy input 4M service-policy output 4M,接口限速配置（35系列交换机）,class-map match-all IPclass match ip dscp 0 policy-map rate-4M class IPclass police 4200000 300000 exceed-action drop interface FastEthernet6/11 service-policy input rate-4M,EtherChannel Technology,Load sharing and redundancy provided Incremental way to scale link bandwidth Switches, routers, and servers,EtherChannel,100/1000 Ethernet 2,A,B,EtherChannel,Etherchannel - What supports it?,Catalyst 2900XL,Catalyst 3500XL,Catalyst 5000,Catalyst 6000,Catalyst 4000,Bandwidth Options,Ethernet/ Fast Ethernet,Fast EtherChannel,10,100 Mbps,200,400 Mbps,Gigabit EtherChannel,2, 4 Gbps,Gigabit Ethernet,1 Gbps,Smooth migration to higher bandwidths Gain resiliency at same time Considered as one link to STP, Routing Protocols Featured on Catalyst family and Cisco IOS,Catalyst 6000 Additional Options,Fast EtherChannel,200800 Mbps,Gigabit EtherChannel,28 Gbps,Bundle formed with 28 links Bundle members can exist on different cards Maximum bandwidth of 16 Gbps (FDX) possible Odd combinations also valid (3, 5, 6, 7),How does it work,Take the source and destination MAC address - convert to Binary,Take last 2 bits of both addresses and perform XOR,Results determine which link to use 00 - Link 1 01 - Link 2 02 - Link 3 03 - Link 4,Catalyst 6000 uses a polynomial equation in the Earl5 to calculate etherchannel path,Configuring Etherchannel on the 6000,Catalyst 6000 supports a maximum of 128 Etherchannel Groups,1. All ports must be in same VLAN 2. If channel is configured as trunk, then trunk mode must be same on all ports 3. All ports in channel must be same speed and duplex setting 4. Broadcast limit MUST be same on all ports in channel 5. Port security on ports stops the etherchannel group being created 6. If one of the ports has SPAN enabled, etherchannel group will not form 7. Protocol filtering must be same on all ports in channel group,Etherchannel Restrictions,端口聚合配置,interface Port-channel7 description to_liuxia4506 switchport switchport trunk encapsulation dot1q switchport trunk allowed vlan 17,18,105,184,326, 358,361,365-367 switchport trunk allowed vlan add 369-373,501-599,700,801 switchport mode trunk interface GigabitEthernet3/14 description to_liuxia4506 switchport switchport trunk encapsulation dot1q switchport trunk allowed vlan 17,18,105,184,326, 358,361,365-367 switchport trunk allowed vlan add 369-373,501-599,700,801 switchport mode trunk channel-group 7 mode desirable interface GigabitEthernet4/3 description to_liuxia4506-1/1 switchport switchport trunk encapsulation dot1q switchport trunk allowed vlan 17,18,105,184,326, 358,361,365-367 switchport trunk allowed vlan add 369-373,501-599,700,801 switchport mode trunk channel-group 7 mode desirable port-channel load-balance src-dst-port,查看命令,Show interface show ip interface brief show interface status show interface description show interface trunk show mac-address-table show spanning-tree,Standard Checks Source address Generally permits or denies entire protocol suite Extended Checks Source and Destination address Generally permits or denies specific protocols Inbound or Outbound,What Are Access Lists?,Outgoing Packet,E0,S0,Incoming Packet,Access List Processes,Permit?,Protocol,A List of Tests: Deny or Permit,Packets to Interface(s) in the Access Group,Packet Discard Bucket,Y,Interface(s),Destination,Deny,Y,Match First Test ?,Permit,N,Deny,Permit,Match Next Test(s) ?,Deny,Match Last Test ?,Y,Y,N,Y,Y,Permit,Implicit Deny,If no match deny all,Deny,N,0 means check corresponding address bit value 1 means ignore value of corresponding address bit,do not check address (ignore bits in octet),=,0,0,0,0,0,0,0,0,Octet bit position and address value for bit,ignore last 6 address bits,check all address bits (match all),ignore last 4 address bits,check last 2 address bits,Examples,Wildcard Bits: How to Check the Corresponding Address Bits,Example 172.30.16.29 0.0.0.0 checks all the address bits Abbreviate this wildcard mask using the IP address preceded by the keyword host (host 172.30.16.29),Test conditions: Check all the address bits (match all),172.30.16.29,0.0.0.0,(checks all bits),An IP host address, for example:,Wildcard mask:,Wildcard Bits to Match a Specific IP Host Address,Accept any address: 0.0.0.0 255.255.255.255 Abbreviate the expression using the keyword any,Test conditions: Ignore all the address bits (match any),0.0.0.0,255.255.255.255,(ignore all),Any IP address,Wildcard mask:,Wildcard Bits to Match Any IP Address,Check for IP subnets 172.30.16.0/24 to 172.30.31.0/24,Network .host 172.30.16.0,Wildcard mask: 0 0 0 0 1 1 1 1 | 0 0 0 1 0 0 0 0 = 16 0 0 0 1 0 0 0 1 = 17 0 0 0 1 0 0 1 0 = 18 : : 0 0 0 1 1 1 1 1 = 31,Address and wildcard mask: 172.30.16.0 0.0.15.255,Wildcard Bits to Match IP Subnets,ACL配置,标准ACL,扩展ACL,access-list 9 permit 218.0.5.32 0.0.0.31 access-list 9 permit 218.75.80.64 0.0.0.31 access-list 9 permit 218.75.80.32 0.0.0.31 access-list 9 deny any,access-list 101 deny tcp 172.16.4.0 0.0.0.255 172.16.3.0 0.0.0.255 eq 21 access-list 101 deny tcp 172.16.4.0 0.0.0.255 172.16.3.0 0.0.0.255 eq 20 access-list 101 permit ip any any,应用到接口,interface Vlan27 ip access-group 101 in,VACL介绍,传统的access list（RACL）只有当数据包经过三层端口，才能对数据包起过虑作用。有些数据包，它可能只是在某一个vlan内部，即不经过三层端口，也不夸过vlan，要对这些数据包做过虑的话，则可以用vlan access list（VACL）,VACL配置命令,定义一个VACL： vlan access-map map-name sequence-number match ip address acl-number | acl-name | ipx address acl-number | acl-name | mac address acl-name action drop | forward capture | redirect interface type mod/num 把VACL应用在vlan上： Switch(config)# vlan filter map-name vlan-list vlan-list,VACL EXAMPLE,ip access-list extended match_all permit ip any any ip access-list extended virus permit udp any any eq 135 permit tcp any any eq 135 permit tcp any any eq 139 permit tcp any any eq 4444 permit tcp any any eq 1434 permit udp any any eq 1434 permit tcp any any eq 445 vlan access-map vacl 10 match ip address virus action drop vlan access-map vacl 20 match ip address match_all action forward vlan filter vacl vlan-list 821,1105,1174,路由协议分类,距离向量：用于根据距离(distance)来判断最佳路径，当1 个数据包每经过1 个router 时，被称之为经过1 跳.经过跳数最少的则作为最佳路径.这类协议的例子有RIP 和IGRP，它们将整个路由表向与它们直接相连的相邻routers。 链路状态：也叫最短路径优先(shortest-path-first)协议.每个router 创建3 张单独的表，1 张用来跟踪与它直接相连的相邻router;1 张用来决定网络的整个拓扑结构;另外1 张作为路由表.所以这种协议对网络的了解程度要比距离向量高.这类协议例子有OSPF。 混合型：综合了前2 者的特征，这类协议的例子有EIGRP。,Ospf路由协议,OSPF能够把网络设计为层次化，这样就把1 个大的网络分割成几个小的网络，叫做区域(area).这是OSPF 最好的设计方法.把OSPF 设计成层次化的好处是： 1、减少路由成本(overhead) 2、加速汇聚 3、把大网络分割成小的区域,典型的OSPF 设计图，如下：,Area 0,Area 1,Area 2,Autonomous System,Configuring OSPF,Enabling OSPF 启用OSPF 在全局配置模式下使用router ospf 进程ID命令，进程ID 范围是1 到65535。可以在同1 个router 上使用不止1 个的OSPF 进程，但是这并不等于多域(multi-area)的OSPF.第二个进程保持完整的拓扑数据库的拷贝，而且独立于第一个进程进行管理通信。 Configuring OSPF Areas OSPF 使用wildmask 来进行