思科private vlan.doc

思科private vlan 配置private VLAN 里有3种port isolated，community ，promiscuous。private VLAN 有3种 ：primary VLAN ， isolated VLAN ， community VLAN。配置命令分别是：vlan 901private-vlan isolatedvlan 902private-vlan communityvlan 900private-vlan primaryprimary VLAN和他所关联的isolated VLAN community VLAN都可以通信.isolated VLAN 和community VLAN都属于secondary VLAN，他们之间的区别是：同属于一个isolated VLAN的主机不可以互相通信，同属于一个community VLAN的主机可以互相通信。但他们都可以和和所关联的primary VLAN通信.配置primary VLAN和secondary VLAN关联的命令是：vlan 900private-vlan primaryprivate-vlan association 901,902注意一个primary VLAN只可以关联一个isolated VLAN + 多个community VLAN把端口放进isolated VLAN 或者community VLAN的命令是interface GigabitEthernet4/11switchportswitchport private-vlan host-association 900 901switchport mode private-vlan host/因为901是isolated VLAN,g4/11现在是一个isolated portinterface GigabitEthernet4/12switchportswitchport private-vlan host-association 900 902switchport mode private-vlan host/因为902是community VLAN,g4/12现在是一个community port注意在private vlan里 switchport access vlan xxx 这一句已经不起作用了。起作用的是 switchport private-vlan host-association 900 902这一句，这一句把端口放入primary vlan 900和secondary vlan 902。把端口放进primary VLAN 的命令是：interface GigabitEthernet4/14switchportswitchport private-vlan mapping 900 901,902switchport mode private-vlan promiscuous/g4/14现在是一个promiscuous port同样，switchport access vlan xxx 已经不起作用了，起作用的是 switchport private-vlan mapping 900 901,902，这一句把端口放入primary vlan 900和secondary vlan 901，902。注意这里promiscuous port可以属于多个secondary VLAN，但只可以属于一个primary VLAN，就好像普通的access port只能属于一个vlan是一样的。在配置vlan的3层地址的时候，只可以配置在primary VLAN上，从这里也可以看出，primary VLAN在某些地方是和普通vlan一样工作的，secondary VLAN则更特殊一些。下面看两种方法来实现让4/11和4/12可以和4/14通信，但4/11和4/12互相不可以通信方法一，用isolated VLAN：vlan 901private-vlan isolatedvlan 900private-vlan primaryprivate-vlan association 901interface GigabitEthernet4/11switchportswitchport private-vlan host-association 900 901switchport mode private-vlan hostinterface GigabitEthernet4/12switchportswitchport private-vlan host-association 900 901switchport mode private-vlan hostinterface GigabitEthernet4/14switchportswitchport private-vlan mapping 900 901switchport mode private-vlan promiscuous方法二，用community VLANvlan 901private-vlan communityvlan 902private-vlan communityvlan 900private-vlan primaryprivate-vlan association 901,902interface GigabitEthernet4/11switchportswitchport private-vlan host-association 900 901switchport mode private-vlan hostinterface GigabitEthernet4/12switchportswitchport private-vlan host-association 900 902switchport mode private-vlan hostinterface GigabitEthernet4/14switchportswitchport private-vlan mapping 900 901,902switchport mode private-vlan promiscuous现在实现了4/11和4/12的隔离，和4/11、4/12都能和4/13通信，我们可以1.把需要2层隔离的主机放到同一个isolated VLAN，或者不同的community VLAN。2.把需要2层通信的主机放到同一个community VLAN。3.公共的服务器或者上联端口放到primary VLAN，和本primaryVLAN和所有secondaryVLAN里的主机是2层连通的。4.在primary VLAN上来看，所有的主机在同一个primary VLAN里，在secondary VLAN里的主机互相访问的时候，才和private VLAN的配置有关。5.网关可以是primary VLAN上配一个3层地址或者在primary VLAN上连一个路由器。所有主机在3层都是在primary VLAN的这个网段里,所以