HC110115002 VLAN原理和配置介绍

VLAN原理和配置Page2前言随着网络中计算机的数量越来越多，传统的以太网络开始面临冲突严重、广播泛滥以及安全性无法保障等各种问题。VLAN（VirtualLocalAreaNetwork）即虚拟局域网，是将一个物理的局域网在逻辑上划分成多个广播域的技术。通过在交换机上配置VLAN，可以实现在同一个VLAN内的用户可以进行二层互访，而不同VLAN间的用户被二层隔离。这样既能够隔离广播域，又能够提升网络的安全性。Page3学习目标

学完本课程后，您应该能：理解VLAN的工作原理掌握VLAN的基本配置传统以太网Page4随着主机数量的增加，共享网络中的冲突会越来越严重，交换网络中的广播也会越来越多。VLAN技术Page5VLAN能够隔离广播域。VLAN1VLAN2VLAN帧格式Page6没有携带Tag的帧携带Tag的帧0x8100PRICFIVLANID（12b）2bytes2bytesDMACDataSMACTypeFCS6bytes6bytes2bytes46-1500bytes4bytesDMACDataSMACTypeFCS6bytes6bytes2bytes46-1500bytes4bytesTagTPIDTCI4bytes通过Tag区分不同VLAN。链路类型Page7TrunkAccessVLAN3VLAN2TrunkTrunkAccessAccessAccessAccess用户主机和交换机之间的链路为接入链路，交换机与交换机之间的链路为干道链路。PVIDPage8PVID1PVID2PVID2PVID3PVID3PVID1PVID表示端口在缺省情况下所属的VLAN。缺省情况下，X7系列交换机每个端口的PVID是1。SWASWB主机A主机C主机B主机DVLAN2VLAN2VLAN3VLAN3端口类型–AccessPage9主机A主机C主机BUntaggedUntaggedPVID10PVID10PVID2Frame10Access端口在收到数据后会添加VLANTag，VLANID和端口的PVID相同。Access端口在转发数据前会移除VLANTag。SWAG0/0/1G0/0/2G0/0/3端口类型–TrunkPage10当Trunk端口收到帧时，如果该帧不包含Tag，将打上端口的PVID；如果该帧包含Tag，则不改变。当Trunk端口发送帧时，该帧的VLANID在Trunk的允许发送列表中：若与端口的PVID相同时，则剥离Tag发送；若与端口的PVID不同时，则直接发送。主机A主机C主机B主机DUntaggedUntaggedFrame20UntaggedSWASWBUntaggedUntaggedPVID1PVID20PVID1PVID20PVID1PVID1Page11端口类型-HybridHybrid端口既可以连接主机，又可以连接交换机。Hybrid端口可以以Tagged或Untagged方式加入VLAN。G0/0/1主机A主机B服务器UntaggedFrameG0/0/1Frame32UntaggedUntaggedSWASWBG0/0/2G0/0/2G0/0/3UntaggedPage12端口类型-HybridPVID1主机A主机B服务器UntaggedFramePVID1Frame32UntaggedUntaggedSWASWBPVID100PVID2PVID3UntaggedPage13VLAN划分方法VLAN5VLAN10基于端口G0/0/1,G0/0/7G0/0/2G0/0/9基于MAC地址00-01-02-03-04-AA00-01-02-03-04-CC00-01-02-03-04-BB00-01-02-03-04-DD基于IP子网划分10.0.1.*10.0.2.*基于协议划分IPIPX基于策略10.0.1.*+G0/0/1+00-01-02-03-04-AA10.0.2.*+G0/0/2+00-01-02-03-04-BBG0/0/1主机A10.0.1.1主机D10.0.2.2主机B10.0.2.1主机C10.0.1.2G0/0/2G0/0/7G0/0/9SWA基于端口的VLAN划分方法在实际中最为常见。Page14VLAN配置[SWA]vlan10[SWA-vlan10]quit[SWA]vlanbatch2to3Info:Thisoperationmaytakeafewseconds.Pleasewaitforamoment...done.主机A主机D主机B主机CSWASWB配置验证Page15[SWA]displayvlanThetotalnumberofvlansis:4U:Up;D:Down;TG:Tagged;UT:Untagged;MP:Vlan-mapping;ST:Vlan-stacking;#:ProtocolTransparent-vlan;*:Management-vlan;VIDTypePorts1commonUT:GE0/0/1(U)……2common3commoncommon……Page16配置Access端口[SWA]interfaceGigabitEthernet0/0/5[SWA-GigabitEthernet0/0/5]portlink-typeaccess[SWA-GigabitEthernet0/0/5]interfaceGigabitEthernet0/0/7[SWA-GigabitEthernet0/0/7]portlink-typeaccessSWASWBG0/0/1G0/0/7G0/0/5主机A主机D主机B主机CPage17添加端口到VLAN[SWA]vlan2[SWA-vlan2]portGigabitEthernet0/0/7[SWA-vlan2]quit[SWA]interfaceGigabitEthernet0/0/5[SWA-GigabitEthernet0/0/5]portdefaultvlan3SWASWBG0/0/1G0/0/7G0/0/5主机A主机D主机B主机C配置验证Page18[SWA]displayvlanThetotalnumberofvlansis:4U:Up;D:Down;TG:Tagged;UT:Untagged;MP:Vlan-mapping;ST:Vlan-stacking;#:ProtocolTransparent-vlan;*:Management-vlan;VIDTypePorts1commonUT:GE0/0/1(U)……2commonUT:GE0/0/7(U)commonUT:GE0/0/5(U)10common……Page19配置Trunk端口[SWA-GigabitEthernet0/0/1]portlink-typetrunk[SWA-GigabitEthernet0/0/1]porttrunkallow-passvlan23SWASWBG0/0/1G0/0/1主机A主机D主机B主机C配置验证Page20[SWA]displayvlanThetotalnumberofvlansis:4U:Up;D:Down;TG:Tagged;UT:Untagged;MP:Vlan-mapping;ST:Vlan-stacking;#:ProtocolTransparent-vlan;*:Management-vlan;VIDTypePorts1commonUT:GE0/0/1(U)……2commonUT:GE0/0/7(D)TG:GE0/0/1(U)

commonUT:GE0/0/5(U)TG:GE0/0/1(U)10common……配置Hybrid端口Page21[SWA-GigabitEthernet0/0/1]portlink-typehybrid[SWA-GigabitEthernet0/0/1]porthybridtaggedvlan23100[SWA-GigabitEthernet0/0/2]porthybridpvidvlan2[SWA-GigabitEthernet0/0/2]porthybriduntaggedvlan2100[SWA-GigabitEthernet0/0/3]porthybridpvidvlan3[SWA-GigabitEthernet0/0/3]porthybriduntaggedvlan3100G0/0/1主机A主机B服务器G0/0/1SWASWBG0/0/2G0/0/2G0/0/3配置HybridPage22[SWB-GigabitEthernet0/0/1]portlink-typehybrid[SWB-GigabitEthernet0/0/1]porthybridtaggedvlan23100[SWB-GigabitEthernet0/0/2]porthybridpvidvlan100[SWB-GigabitEthernet0/0/2]porthybriduntaggedvlan23100G0/0/1主机A主机B服务器G0/0/1SWASWBG0/0/2G0/0/2G0/0/3配置验证Page23[SWA]displayvlanThetotalnumberofvlansis:4U:Up;D:Down;TG:Tagged;UT:Untagged;MP:Vlan-mapping;ST:Vlan-stacking;#:ProtocolTransparent-vlan;*:Management-vlan;1commonUT:GE0/0/1(U)……2commonUT:GE0/0/2(U)

TG:GE0/0/1(U)3commonUT:GE0/0/3(U)

TG:GE0/0/1(U)100commonUT:GE0/0/2(U)GE0/0/3(U)

TG:GE0/0/1(U)Page24VoiceVLAN应用通过配置VoiceVLAN可以区分语音流量和业务流量，使语音流量优于业务流量，从而为语音流量提供服务保证。SWB主机ASWAVoIPIPTVG0/0/1MAC:0011-2200-0001MAC:0011-2200-0002Page25配置VoiceVLAN[SWB]vlan2[SWB-GigabitEthernet0/0/1]voice-vlan2enable[SWB-GigabitEthernet0/0/1]voice-vlanmodeauto[SWB-GigabitEthernet0/0/1]quit[SWB]voice-vlanmac-address0