同VLAN通信01-不同网段同VLAN间通信二层交换机1.根据拓扑图图形化配置好PC的IP和掩码2.配置VLAN接口类型在二层交换机SW1上vlan batch 10 20 //同时创建VLAN 10与20 # interface GigabitEthernet0/0/1 port link-type access //配置通往PC1方向的接口类型为access port default vlan 10 //修改access接口PVID为10 # interface GigabitEthernet0/0/2 port link-type access //配置通往PC2方向的接口类型为access port default vlan 20 //修改access接口PVID为20 # interface GigabitEthernet0/0/3 port link-type trunk //配置g0/0/3接口类型为trunk port trunk allow-pass vlan 10 20 //在trunk上允许放行vlan 10和20在二层交换机SW2上vlan batch 10 20 //同时创建VLAN 10与20 # interface GigabitEthernet0/0/1 port link-type access //配置通往PC3方向的接口类型为access port default vlan 10 //修改access接口PVID为10 # interface GigabitEthernet0/0/2 port link-type access //配置通往PC4方向的接口类型为access port default vlan 20 //修改access接口PVID为20 # interface GigabitEthernet0/0/3 port link-type trunk //配置g0/0/3接口类型为trunk port trunk allow-pass vlan 10 20 //在trunk上允许放行vlan 10和203.测试在PC1上pingPC3在PC2上pingPC4跨VLAN通信利用二层交换机机制02-同网段跨VLAN通信二层交换机1.根据拓扑图图形化配置好PC的IP地址和掩码2.配置VLAN接口类型在二层交换机SW1上vlan 10 20 30 //同时创建vlan 10 20 30 interface GigabitEthernet0/0/1 port link-type access //配置g0/0/1接口类型为access port default vlan 10 //修改access接口PVID为10 # interface GigabitEthernet0/0/2 port link-type trunk port trunk pvid vlan 10 //修改trunk接口PVID为10 port trunk allow-pass vlan 10 30 //trunk放行vlan 10和20 # interface GigabitEthernet0/0/3 port link-type access port default vlan 30在二层交换机SW2上vlan 10 20 30 interface GigabitEthernet0/0/1 port link-type access port default vlan 20 # interface GigabitEthernet0/0/2 port link-type trunk port trunk pvid vlan 20 ////修改trunk接口PVID为20 port trunk allow-pass vlan 20 30 //trunk放行vlan 20和30 # interface GigabitEthernet0/0/3 port link-type access port default vlan 303.测试Vlan 10与Vlan 20互通Vlan 30之间互通Vlan 10 20与Vlan 30都不能互通需要三层交换机VLAN间互访配置思路利用了Trunk接口放行与自身PVID相同的VLAN时会剥离Tag成为untagged的数据帧由于 Trunk 端口的 PVID 配置、VLAN 标签的剥离或交换机的默认行为流量实际上是在同一个 VLAN 内传输而不是真正意义上的跨 VLAN 通信不需要三层功能 PC1 和 PC2 位于同一网段ARP 广播可能会通过 Trunk 端口传播到不同的 VLAN。如果交换机没有严格隔离广播域PC1 和 PC2 可能会通过 ARP 广播发现彼此并直接通信。03-VLAN-Hybrid接口的应用1.根据拓扑图图形化配置好IP地址和掩码2.配置Hybrid接口在AR1上配置网关interface g0/0/0 ip add 1.1.1.3 24在二层交换机SW1上vlan batch 10 20 30 //同时创建vlan 10 20 30 interface GigabitEthernet0/0/1 port link-type hybrid //修改接口类型为hybrid(默认就是) port hybrid pvid vlan 10 //修改hybrid接口PVID为10 port hybrid untagged vlan 10 30 //配置hybrid接口以untagged的方式放行vlan 10 30 # interface GigabitEthernet0/0/2 port link-type hybrid port hybrid pvid vlan 20 port hybrid untagged vlan 20 30 # interface GigabitEthernet0/0/3 port link-type hybrid port hybrid pvid vlan 30 port hybrid untagged vlan 10 20 303.测试分别在PC1和PC2上ping网关1.1.1.3查看能否互通vlan 10与20都能与vlan 30互通PC1与PC2不互通vlan 10与20隔离使用物理接口04-不同网段跨VLAN通信1.根据拓扑图图形化配置好PC的IP地址和掩码2.配置在AR1上配置网关int g0/0/0 ip add 10.1.1.254 24 //路由器一个接口作10.0网段的网关 int g0/0/1 ip add 20.1.1.254 24 //路由器另一个接口作20.0网段的网关在二层交换机SW1上vlan batch 10 20 //同时创建VLAN 10与20 # interface GigabitEthernet0/0/1 port link-type access //配置通往PC1方向的接口类型为access port default vlan 10 //修改access接口PVID为10 # interface GigabitEthernet0/0/2 port link-type access //配置通往PC2方向的接口类型为access port default vlan 20 //修改access接口PVID为20 # interface GigabitEthernet0/0/3 port link-type access //配置PC1通往AR1方向的接口类型为access port default vlan 10 //修改access接口PVID为**10** # interface GigabitEthernet0/0/4 port link-type access //配置PC2通往AR1方向的接口类型为access port default vlan 20 //修改access接口PVID为203.测试在PC1上ping通PC2即vlan 10与vlan 20互通4.配置思路使用子接口05-单臂路由1.根据拓扑图图形化配置好PC的IP地址和掩码2.配置在二层交换机上SW1vlan batch 10 20 //同时创建VLAN 10与20 # interface GigabitEthernet0/0/1 port link-type access //配置通往PC1方向的接口类型为access port default vlan 10 //修改access接口PVID为10 # interface GigabitEthernet0/0/2 port link-type access //配置通往PC2方向的接口类型为access port default vlan 20 //修改access接口PVID为20 # interface GigabitEthernet0/0/3 port link-type trunk //配置SW1通往AR1方向的接口类型为trunk port trunk allow-pass vlan 10 20 //trunnk口放行vlan 10和20在路由器AR1上vlan batch 10 20 //同时创建VLAN 10与20interface GigabitEthernet0/0/0.10 //创建10号子接口ip add 10.1.1.254 24 //配置此子接口作为PC1的网关dot1q termination vid 10 //子接口绑定VLAN ID//启用 VLAN 标签的终结功能并指定子接口终结的 VLAN ID 为 10工作原理接收流量当物理接口收到带有 VLAN 10 标签的帧时子接口会剥离 VLAN 标签并根据 IP 地址进行路由。发送流量当子接口需要发送流量时会为数据包添加 VLAN 10 的标签然后通过物理接口发送出去。arp broadcast enable //开启子接口发送arp广播功能 使路由器子接口能主动解析下行的MAC地址//默认情况下子接口不会发送 ARP 广播。老命令模拟器需要。真机不需要interface GigabitEthernet0/0/0.20 //创建20号子接口ip add 20.1.1.254 24 //配置此子接口作为PC2的网关dot1q termination vid 20 //子接口绑定VLAN IDarp broadcast enable3.测试在PC1上pingPC2的ip地址ping通vlan 10与vlan 20互通4.思路在SW1右侧加入一台PC在AR1上interface g0/0/0 ip add 100.1.1.254 24 //配置物理接口作为网关 物理接口无法绑定VLAN ID无法处理tag数据帧只能为所有untagged数据帧不打Tag的VLAN提供网关功能PC3访问网关原理SW1上g0/0/4 Hybrid接口默认在vlan 1中PC3发送数据帧经过SW1的g0/0/4号口为其打上Tag 1标签进入交换机内部SW1的g0/0/3接口为trunk接口默认放行vlan 1剥去Tag 1的标签成为untagged数据帧发送到AR1的g0/0/0口PC3访问PC1和PC2原理vlan隔离广播域SW1上g0/0/4 Hybrid接口默认在vlan 1中PC3发送数据帧经过SW1的g0/0/4号口为其打上Tag 1标签进入交换机内部SW1的g0/0/3接口为trunk接口默认放行vlan 1剥去Tag 1的标签成为untagged数据帧发送到AR1的g0/0/0口PC3与PC1和2都不在同一网段将ping包发给网关网关根据路由表将untagged数据帧丢给对应子接口并打上相应的Tag标签发往SW1的G0/0/3接口trunk口放行打上了10和20 Tag标签的数据帧带有10或20 Tag的数据帧进入交换机内部再发往与SW1自身PVID相同的access接口剥离Tag成为untagged帧发给PC1或PC2物理接口在本实验中为所有untagged数据帧提供网关功能使用三层交换机06-三层交换下不同网段跨VLAN通信1.根据拓扑图图形化配置好PC2.具体配置在三层交换机SW1上vlan batch 10 20 interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 10 20 //trunk接口放行vlan 10和20 # interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 10 20 # interface vlanif 10 //进入vlanif逻辑接口ID与VLAN ID一致支持VLAN Tag的剥离和添加 ip add 10.1.1.254 24 //vlanif接口作网关 # interface vlanif 20 ip add 20.1.1.254 24在二层交换机SW2和SW3上vlan batch 10 20 interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 10 20 # interface GigabitEthernet0/0/2 port link-type access port default vlan 10 # interface GigabitEthernet0/0/3 port link-type access port default vlan 203.测试PC1能与同VLAN的PC3通信PC1能与不同VLAN的PC2和PC4通信4.配置思路三层交换机vlanif接口为虚拟接口为当前vlan下的所有设备提供网关功能vlanif接口号要与vlan ID一致支持VLAN Tag的剥离和添加07-三层交换机之间用vlanif接口实现三层互联1.根据拓扑图图形化配置好PC的IP地址和网关掩码默认都为255.255.255.02.配置VLAN在三层交换机SW1上vlan batch 10 20 100 interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 10 20 //trunk接口放行vlan 10和20 # interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 10 20 # interface GigabitEthernet0/0/3 port link-type trunk port trunk allow-pass vlan 100 # interface vlanif 10 //进入vlanif逻辑接口ID与VLAN ID一致支持VLAN Tag的剥离和添加 ip add 10.1.1.254 24 //vlanif接口作网关 # interface vlanif 20 ip add 20.1.1.254 24 # interface vlanif 100 ip add 100.1.1.1 24在三层交换机SW4上vlan 5 100 interface g0/0/1 port link-type access port default vlan 5 interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 100 # interface vlanif 5 ip add 5.1.1.254 24 # interface vlanif 100 ip add 100.1.1.2 24在二层交换机SW2和SW3上vlan batch 10 20 interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 10 20 # interface GigabitEthernet0/0/2 port link-type access port default vlan 10 # interface GigabitEthernet0/0/3 port link-type access port default vlan 203.配置OSPF在三层交换机SW1上ospf 1 router-id 1.1.1.1 area 0.0.0.0 network 10.1.1.254 0,0.0.0 network 20.1.1.254 0.0:0.0 network 100.1.1.1 0.0.0.0在三层交换机SW2上ospf 1 router-id 4.4.4.4 area 0.0.0.0 network 5.1.1.254 0,0.0.0 network 100.1.1.2 0.0.0.04.测试在三层交换机上dis ip routing-table p ospf //发现路由表中添加了来自OSPF的非直连路由PC1与PC3与PC5互通5.配置思路三层交换机之间用vlanif接口实现三层互联三层交换机通过vlan的广播域实现像路由器一样三层互联VLAN应用案例实验要求VLAN10 20 50 100互通并能够连通外网1.根据拓扑图图形化配置好PC的IP地址和网关掩码默认都为255.255.255.02.配置VLAN在三层交换机SW1上vlan batch 10 20 50 100 200 interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 10 20 50 //trunk接口放行vlan 10 20 50 # interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 10 20 # interface GigabitEthernet0/0/3 port link-type trunk port trunk allow-pass vlan 50 100 # interface GigabitEthernet0/0/4 port link-type access port default vlan 200 # interface vlanif 10 //进入vlanif逻辑接口ID与VLAN ID一致支持VLAN Tag的剥离和添加 ip add 10.1.1.254 24 //vlanif接口作网关 # interface vlanif 20 ip add 20.1.1.254 24 # interface vlanif 50 ip add 50.1.1.254 24 # interface vlanif 100 ip add 100.1.1.1 24 # interface vlanif 200 ip add 200.1.1.254 24在三层交换机SW4上vlan 5 50 100 interface g0/0/1 port link-type access port default vlan 5 # interface g0/0/3 port link-type access port default vlan 50 # interface g0/0/2 port link-type trunk port trunk allow-pass vlan 50 100 # interface vlanif 5 ip add 5.1.1.254 24 # interface vlanif 100 ip add 100.1.1.2 24在二层交换机SW2上vlan batch 10 20 50 interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 10 20 50 # interface GigabitEthernet0/0/2 port link-type access port default vlan 10 # interface GigabitEthernet0/0/3 port link-type access port default vlan 20 # interface GigabitEthernet0/0/4 port link-type access port default vlan 50在二层交换机SW3上vlan batch 10 20 interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 10 20 interface GigabitEthernet0/0/2 port link-type access port default vlan 10 # interface GigabitEthernet0/0/3 port link-type access port default vlan 203.配置OSPF在三层交换机SW1上ospf 1 router-id 1.1.1.1 area 0.0.0.0 network 10.1.1.254 0,0.0.0 network 20.1.1.254 0.0:0.0 network 50.1.1.254 0.0.0.0 network 100.1.1.1 0.0.0.0在三层交换机SW2上ospf 1 router-id 4.4.4.4 area 0.0.0.0 network 5.1.1.254 0,0.0.0 network 50.1.1.2 0.0.0.0 network 100.1.1.2 0.0.0.04.配置缺省路由指向出口和回路在三层交换机SW1上ip route-static 0.0.0.0 0 200.1.1.1在三层交换机SW4上ip route-static 0.0.0.0 0 100.1.1.1在AR1上配置回路int g0/0/0 ip add 200.1.1.1 //作为下一跳接口 int loopback 0 ip add 8.8.8.8 //配置环回口作为测试用 # ip route-static 5.1.1.0 24 200.1.1.254 ip route-static 10.1.1.0 24 200.1.1.254 ip route-static 20.1.1.0 24 200.1.1.254 ip route-static 50.1.1.0 24 200.1.1.2544.测试在三层交换机上dis ip routing-table p ospf //发现路由表中添加了来自OSPF的非直连路由用PC1 2 3 4 5 6 7ping通AR1环回地址8.8.8.8