cisco vlan

基本概念

交換器下的所有port預設為vlan1的成員
switch設定後,就會產生一份config.text和vlan.dat的檔案
switch的startup-config存在FLASH裡的config.text檔,因為SWITCH沒有NVRAM,所以用FLASH去模擬
switch要還原成預設值,除了殺掉startup-config還要刪除vlan.dat,否則VLAN的資訊都還會存在
步驟如下
#delete vlan.dat
#erase startup-config
#reload

...

cisco vlan type
Static VLAN configuration:主要以port決定vlan
 設定較簡單
Dynamic VLAN assignment:可用mac address決定vlan
 cisco dynamic VLANs require a VMPS(VLAN Membership Policy Server)
 A network administrator must assign(static or dynamic) the user's MAC address to a VLAN in the database of a VMPS
ps:
For more information about VMPS, refer to the "Configuring VMPS" section in a Catalyst  

... 

vlan互連 
vlan互連需用到第三層設備,如router
方法有2種:
1使用一條線,也稱router on a stick(一根棒上的路由器)
 全部vlan用一條trunk連到router單一介面,有多少vlan就需在設定多少子界面
 ps:router介面最好要fastethernet以上,ex:2600系列以上的router
2使用多條線
 各vlan分別連到router的各介面

route on a strick缺點
The router becomes a single point of failure for the network.
There is a possibility of inadequate bandwidth for each VLAN.
Additional overhead on the router can occur.

 

...............................................................

static vlan設定 

 

新增vlan 

方法1(2950switch為主) 
1.
進入vlan設定模式 
#vlan database  //進入後提示符號為(vlan)  
2.
新增vlan 
(vlan)#[no] vlan < vlan-id> [ name < vlan-name>]  
使用no只會刪除vlan,但並不會把被刪除的vlan和port間的關聯移除
< vlan-id>可設範圍為為1-1005. 1,1002-1005是自動建立的的保留vlan,而1002-1005用於token-ring,fddi
ps:vlan-id可支援Extended-range,可將範圍擴展到4096,但需透過VTP3,且資料不存在vlan database 
[name < vlan-name>]若沒設name,則會自動建立預設名稱為vlan+id number
ex:vlan id為20,則預設名稱為vlan0020
ex:
新增vlan 2 且名稱為20vlan
(config)#vlan 2 name 20vlan
VLAN 2 added:
    Name:20vlan

方法2
(config)#vlan <1-1005> [vlan-name] 
ps:switch1900,2950,2960支援

... 

更改vlan名稱
(config)#vlan < vlan-id>
(config-vlan)#name < vlan-name> 

ps 
(vlan)#?
vlan                    Add, delete, or modify values associated with a single VLAN
vtp                     Perform VTP administrative functions.
exit                    Apply changes, bump revision number, and exit mode
help                    Description of the interactive help system
abort                   Exit mode without applying the changes
apply                   Apply current changes and bump revision number

...

指定port所屬VLAN

1.
將port mode設為access 
(config)#int < interface>
(config-if)#switchport mode access
 
ps:port預設是access mode 
ps:port mode是access才可將port指到某vlan 
ps:主機要以access port連接

2.
將port指定到某vlan 
(config-if)#switchport access vlan <1-1005>
 
ex:
將fastethernet0/1介面指定到vlan2 
(config)#int fa0/1 
(config-if)#switchport mode access 
(config-if)#switchport access vlan 2
 

ps:
1900switch的指令為
(config-if)#vlan-membership static <1-1005>
static若改為dynamic則由vmps動態配置 
ps:vmps(vlan membership policy server)主要功能是對應mac位置到vlan


ps:
2950(config-if)#switchport ?
nonegotiate             Set trunking to nonegotiate
trunk                   Set trunking characteristics of the interface
access                  Set access mode characteristics of the interface
mode                    Set trunking mode of the interface
port-security           Security related command

2950(config-if)#switchport mode ?
trunk                   Set trunking mode to TRUNK unconditionally
access                  Set trunking mode to ACCESS unconditionally
dynamic                 Set trunking mode to dynamically negotiate access or trunk mode

2950(config-if)#switchport mode dynamic ?
auto                    Set trunking mode dynamic negotiation parameter to AUTO
desirable               Set trunking mode dynamic negotiation parameter to DESIRABLE

 

................................................. 

vlan其他設定 

設定SVI
(config)#int vlan < vlan id>
(config-if)#ip addr < ip > < mask> 
可在vlan上設ip
若此vlan沒有任何port up,則SVI狀態會由UP變為DOWN
ps
可使用(config-if)#switchport autostate exclude 讓SVI狀態一直保持為up

在switch上設定ip 
(config)#int vlan 1
(config-if)#ip addr < ip> < mask> 

ps:由於catalyst switch系列預設的管理是vlan1,因此設定vlan1的ip,等同於設定這台switch的ip 
ps:cdp和vtp會用vlan1運作
ps:開啟瀏覽器輸入switch ip位置即可進入switch設定畫面
ps:執行no shutdown可啟動vlan1,預設己啟動

 

顯示vlan1的介面資訊
>show interfaces vlan1
畫面大致如下
Vlan 1 is up, line protocol is up
 Hardware is CPU Interface, address is 000C.2721.3927 (bia 000C.2721.3927)
 Internet address is 197.10.1.99 /24 //switch的ip位置
 MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
  reliability 255/255, txload 1/255, rxload 1/255
 Auto-duplex, Auto-speed
 Encapsulation ARPA, loopback not set //封裝型態為arpa
 ARP type: ARPA, ARP Timeout 04:00:00
 Last input 02:29:44, output never, output hang never
 Last clearing of "show interface" counters never
 Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
 Queueing strategy: fifo
 Output queue :0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
  269 packets input, 71059 bytes, 0 no buffer
  Received 6 broadcasts, 0 runts, 0 giants, 0 throttles
  0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
  7290 packets output, 429075 bytes, 0 underruns
  0 output errors, 3 interface resets
  0 output buffer failures, 0 output buffers swapped out 

 

............................................................................................................

了解vlan狀況 

cisco建議的troubleshooting process
1check實體指示燈
2從外界check單一switch設定
3check layer1連結狀態
4check layer2連結狀態
5check vlan中的其他switch

#show interface [interface] switchport
若不指定interface則列出全部介面的switchport狀態
畫面大致如下(以show int fa0/12 switchport為例)
Name: Fa0/12
Switchport:Enabled
Administrative mode: dynamic           //指定此port為dynamic
Operational mode: trunk               //正在作業的port mode為trunk
Administrative Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Protected: false
Voice vlan: none (Inactive)
Appliance trust: none

 

看VLAN狀態
#show vlan [id|brief]

brief:可把所有VLAN及其擁有的PORT簡單的顯示 
id:指定個別vlan
ps:
以show vlan brief為例
畫面大致如下
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/2, Fa0/3, Fa0/4
                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                                Fa0/9, Fa0/10, Fa0/11
20   2950vlan                       active    Fa0/1, Fa0/12    //vlan名為2950vlan,成員有fa0/1,fa0/2              
1002 fddi-default                     active
1003 token-ring-default               active
1004 fddinet-default                  active
1005 trnet-default                    active
VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    -        0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trnet 101005     1500  -      -      -        ibm  -        0      0
ps:
以show vlan id為例(show vlan 20)
畫面大致如下
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
20   2950vlan                         active    Fa0/1, Fa0/12
VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
20   enet  100020     1500  -      -      -        -    -        0      0
ps:在1900switch,要得知port在vlan的狀況,需使用show vlan-membership

 

2008-10-09 17:10:59發表 2012-10-30 21:40:49修改   

數據分析
程式開發
計算機組織與結構
資料結構與演算法
Database and MySql
manage tool
windows
unix-like
linux service
network
network layer3
network layer2
network WAN
network service
作業系統
數位鑑識
資訊安全解決方案
資訊安全威脅
Cisco security
Cisco network
Cisco layer3
Cisco layer2




  登入      [牛的大腦] | [單字我朋友] Powered by systw.net