第11章交換基礎(chǔ)vlan04原理和配置

1、HUAWEI TECHNOLOGIES CO., LTD.VLAN原理和配置Copyright 2013 Huawei Technologies Co., Ltd. All rights reserved. Page 2前言 隨著網(wǎng)絡(luò)中計算機(jī)的數(shù)量越來越多，傳統(tǒng)的以太網(wǎng)絡(luò)開始面臨沖突嚴(yán)重、廣播泛濫以及安全性無法保障等各種問題。 VLAN（Virtual Local Area Network）即虛擬局域網(wǎng)，是將一個物理的局域網(wǎng)在邏輯上劃分成多個廣播域的技術(shù)。通過在交換機(jī)上配置VLAN，可以實現(xiàn)在同一個VLAN內(nèi)的用戶可以進(jìn)行二層互訪，而不同VLAN間的用戶被二層隔離。這樣既能夠隔離廣播域，又能夠

2、提升網(wǎng)絡(luò)的安全性。Copyright 2013 Huawei Technologies Co., Ltd. All rights reserved. Page 3學(xué)習(xí)目標(biāo)學(xué)完本課程后，您應(yīng)該能：理解VLAN的工作原理掌握VLAN的基本配置Copyright 2013 Huawei Technologies Co., Ltd. All rights reserved. 傳統(tǒng)以太網(wǎng)Page 4l隨著主機(jī)數(shù)量的增加，共享網(wǎng)絡(luò)中的沖突會越來越嚴(yán)重，交換網(wǎng)絡(luò)中的廣播也會越來越多。Copyright 2013 Huawei Technologies Co., Ltd. All rights reserve

3、d. VLAN技術(shù)Page 5lVLAN能夠隔離廣播域。VLAN 1VLAN 2Copyright 2013 Huawei Technologies Co., Ltd. All rights reserved. 鏈路類型Page 6TrunkAccessVLAN3VLAN2TrunkTrunkAccessAccessAccessAccessl用戶主機(jī)和交換機(jī)之間的鏈路為接入鏈路，交換機(jī)與交換機(jī)之間的鏈路為干道鏈路。Copyright 2013 Huawei Technologies Co., Ltd. All rights reserved. VLAN幀格式Page 7沒有攜帶Tag的幀攜帶T

4、ag的幀0 x8100PRICFIVLAN ID（12b）2 bytes2 bytesDMACDataSMACTypeFCS6 bytes6 bytes2 bytes46-1500 bytes4 bytesDMACDataSMACTypeFCS6 bytes6 bytes2 bytes46-1500 bytes4 bytesTagTPIDTCI4 bytesl通過Tag區(qū)分不同VLAN。Copyright 2013 Huawei Technologies Co., Ltd. All rights reserved. PVIDPage 8PVID1PVID2PVID2PVID3PVID3PVID

5、1lPVID表示端口在缺省情況下所屬的VLAN。l缺省情況下，X7系列交換機(jī)每個端口的PVID是1。SWASWB主機(jī)A主機(jī)C主機(jī)B主機(jī)DVLAN2VLAN2VLAN3VLAN3Copyright 2013 Huawei Technologies Co., Ltd. All rights reserved. 端口類型 AccessPage 9主機(jī)A主機(jī)C主機(jī)BUntaggedUntaggedPVID10PVID10PVID2Frame10lAccess端口在收到數(shù)據(jù)后會添加VLAN Tag，VLAN ID和端口的PVID相同。lAccess端口在轉(zhuǎn)發(fā)數(shù)據(jù)前會移除VLAN Tag。SWAG0/0/

6、1G0/0/2G0/0/3Copyright 2013 Huawei Technologies Co., Ltd. All rights reserved. 端口類型TrunkPage 10l當(dāng)Trunk端口收到幀時，如果該幀不包含Tag，將打上端口的PVID；如果該幀包含Tag，則不改變。l當(dāng)Trunk端口發(fā)送幀時，該幀的VLAN ID在Trunk的允許發(fā)送列表中：若與端口的PVID相同時，則剝離Tag發(fā)送；若與端口的PVID不同時，則直接發(fā)送。主機(jī)A主機(jī)C主機(jī)B主機(jī)DUntaggedUntaggedFrame20UntaggedSWASWBUntaggedUntaggedPVID1PVID

7、20PVID1PVID20PVID1PVID1Copyright 2013 Huawei Technologies Co., Ltd. All rights reserved. Page 11端口類型-HybridlHybrid端口既可以連接主機(jī)，又可以連接交換機(jī)。lHybrid端口可以以Tagged 或Untagged方式加入VLAN 。G0/0/1主機(jī)A主機(jī)B服務(wù)器UntaggedFrameG0/0/1Frame32UntaggedUntaggedSWASWBG0/0/2G0/0/2G0/0/3UntaggedCopyright 2013 Huawei Technologies Co.,

8、Ltd. All rights reserved. Page 12端口類型-HybridPVID1主機(jī)A主機(jī)B服務(wù)器UntaggedFramePVID1Frame32UntaggedUntaggedSWASWBPVID100PVID2PVID3UntaggedCopyright 2013 Huawei Technologies Co., Ltd. All rights reserved. Page13VLAN端口類型總結(jié)端口類型端口類型接收幀（接收幀（IN）發(fā)送幀（發(fā)送幀（OUT）不帶有不帶有TAG帶有帶有TAGACCESS打上本接口PVID后，接收檢查該幀所攜帶的VID是否與接口PVID相同

9、是：接收否：丟棄剝離TAG后，發(fā)送TRUNK打上接口PVID,并檢查該P(yáng)VID是否為接口允許的VLAN ID是：直接接收否：丟棄檢查該幀所攜帶的VID是否為接口允許的VLAN ID是：直接接收否：丟棄檢查該幀所攜帶的VID是否為接口允許的VLAN ID否：丟棄是：則檢查該幀所攜帶的VID是否與接口PVID相同是：剝離TAG后，發(fā)送否：直接發(fā)送HYBRID同TRUNK同TRUNK檢查該幀所攜帶的VID是否為接口允許的VLAN ID否：丟棄是：則檢查是否配置剝離TAG是：剝離TAG后，發(fā)送否：直接發(fā)送Copyright 2013 Huawei Technologies Co., Ltd. All

10、rights reserved. Page 14VLAN劃分方法VLAN 5VLAN 10基于端口G0/0/1, G0/0/7G0/0/2 G0/0/9基于MAC地址00-01-02-03-04-AA00-01-02-03-04-CC00-01-02-03-04-BB00-01-02-03-04-DD基于IP子網(wǎng)劃分10.0.1.*10.0.2.*基于協(xié)議劃分IPIPX基于策略10.0.1.* + G0/0/1+ 00-01-02-03-04-AA10.0.2.* + G0/0/2 + 00-01-02-03-04-BBG0/0/1主機(jī)A10.0.1.1主機(jī)D10.0.2.2主機(jī)B10.0.2

11、.1主機(jī)C10.0.1.2G0/0/2G0/0/7G0/0/9SWAl基于端口的VLAN劃分方法在實際中最為常見。Copyright 2013 Huawei Technologies Co., Ltd. All rights reserved. Page 15VLAN配置SWAvlan 10SWA-vlan10quitSWAvlan batch 2 to 3Info: This operation may take a few seconds. Please wait for a moment.done. 主機(jī)A主機(jī)D主機(jī)B主機(jī)CSWASWBCopyright 2013 Huawei Tech

12、nologies Co., Ltd. All rights reserved. 配置驗證Page 16SWAdisplay vlanThe total number of vlans is : 4-U:Up; D:Down; TG:Tagged; UT:Untagged; MP:Vlan-mapping; ST:Vlan-stacking; #: ProtocolTransparent-vlan; *:Management-vlan;-VID Type Ports -1 common UT:GE0/0/1(U) 2 common 3 common common Copyright 2013 H

13、uawei Technologies Co., Ltd. All rights reserved. Page 17配置Access端口SWAinterface GigabitEthernet 0/0/5SWA-GigabitEthernet0/0/5port link-type accessSWA-GigabitEthernet0/0/5interface GigabitEthernet 0/0/7SWA-GigabitEthernet0/0/7port link-type accessSWASWBG0/0/1G0/0/7G0/0/5主機(jī)A主機(jī)D主機(jī)B主機(jī)CCopyright 2013 Hua

14、wei Technologies Co., Ltd. All rights reserved. Page 18添加端口到VLANSWAvlan 2SWA-vlan2port GigabitEthernet 0/0/7SWA-vlan2quitSWAinterface GigabitEthernet0/0/5 SWA-GigabitEthernet0/0/5port default vlan 3SWASWBG0/0/1G0/0/7G0/0/5主機(jī)A主機(jī)D主機(jī)B主機(jī)CCopyright 2013 Huawei Technologies Co., Ltd. All rights reserved.

15、配置驗證Page 19SWAdisplay vlanThe total number of vlans is : 4-U:Up; D:Down; TG:Tagged; UT:Untagged; MP:Vlan-mapping; ST:Vlan-stacking; #: ProtocolTransparent-vlan; *:Management-vlan;-VID Type Ports -1 common UT:GE0/0/1(U) 2 common UT:GE0/0/7(U) common UT:GE0/0/5(U) 10 common Copyright 2013 Huawei Techn

16、ologies Co., Ltd. All rights reserved. Page 20配置Trunk端口SWA-GigabitEthernet0/0/1port link-type trunkSWA-GigabitEthernet0/0/1port trunk allow-pass vlan 2 3SWA-GigabitEthernet0/0/1port trunk pvid vlan 1SWASWBG0/0/1G0/0/1主機(jī)A主機(jī)D主機(jī)B主機(jī)CCopyright 2013 Huawei Technologies Co., Ltd. All rights reserved. 配置驗證P

17、age 21SWAdisplay vlanThe total number of vlans is : 4-U:Up; D:Down; TG:Tagged; UT:Untagged; MP:Vlan-mapping; ST:Vlan-stacking; #: ProtocolTransparent-vlan; *:Management-vlan;-VID Type Ports -1 common UT:GE0/0/1(U) 2 common UT:GE0/0/7(D) TG:GE0/0/1(U) common UT:GE0/0/5(U) TG:GE0/0/1(U)10 common Copyr

18、ight 2013 Huawei Technologies Co., Ltd. All rights reserved. 配置Hybrid端口Page 22SWA-GigabitEthernet0/0/1port link-type hybridSWA-GigabitEthernet0/0/1port hybrid tagged vlan 2 3 100SWA-GigabitEthernet0/0/2port hybrid pvid vlan 2SWA-GigabitEthernet0/0/2port hybrid untagged vlan 2 100SWA-GigabitEthernet0

19、/0/3port hybrid pvid vlan 3SWA-GigabitEthernet0/0/3port hybrid untagged vlan 3 100G0/0/1主機(jī)A主機(jī)B服務(wù)器G0/0/1SWASWBG0/0/2G0/0/2G0/0/3Copyright 2013 Huawei Technologies Co., Ltd. All rights reserved. 配置HybridPage 23SWB-GigabitEthernet0/0/1port link-type hybridSWB-GigabitEthernet0/0/1port hybrid tagged vlan 2 3 100SWB-GigabitEthernet0/0/2port hybrid pvid vlan 100SWB-GigabitEthernet0/0/2port hybrid untagged v