三層交換機(jī)vlan配置范例

1、這個(gè)配置沒有任何問題。只要你能看明白,記住關(guān)鍵的命令,相信你已經(jīng)對(duì)三層有更深的認(rèn)識(shí)。*網(wǎng)絡(luò)基本情況網(wǎng)絡(luò)拓?fù)浣Y(jié)構(gòu)為:中心交換機(jī)采用Cisco Catalyst 4006-S3,Supervisor Engine III G引擎位于第1插槽,用于實(shí)現(xiàn)三層交換;1塊24口1000Base-T模塊位于第2插槽,用于連接網(wǎng)絡(luò)服務(wù)器;1塊6端口1000Base-X模塊位于第3插槽,用于連接6臺(tái)骨干交換機(jī)。一臺(tái)交換機(jī)采用Cisco Catalyst 3550-24-EMI,并安裝1塊1000Base-X GBIC千兆模塊。一臺(tái)交換機(jī)采用CiscoCatalyst 3550-24-SMI,也安裝1塊1000B

2、ase-X GBIC千兆模塊。另外四臺(tái)交換機(jī)采用Cisco Catalyst 2950G-24-SMI,安裝1塊1000Base-T GBIC千兆模塊。所有服務(wù)器劃分為一個(gè)VLAN,即VLAN 50。四臺(tái)Catalyst 2950G-24-SMI交換機(jī)也只劃分為一個(gè)VLAN,分別為VLAN 60、VLAN 70、VLAN 80和VLAN 90。Catalyst 3550-24-EMI劃分為4個(gè)VLAN,分別為VLAN 10、VLAN 20、VLAN 30和VLAN 40。Catalyst 3550-24-SMI劃分2個(gè)VLAN,分別為VLAN 60和VLAN 80,與另外兩臺(tái)Catalyst

3、2950G-24-SMI交換機(jī)分別位于同一VLAN。*實(shí)例分析*由于所有Catalyst 2950G交換機(jī)都是一個(gè)獨(dú)立的VLAN,因此,必須先在這些交換機(jī)上創(chuàng)建VLAN(VLAN 60VLAN 90,并將所有端口都指定至該VLAN。然后,再在Catalyst 4006交換機(jī)相應(yīng)端口上分別創(chuàng)建VLAN。Catalyst 4006的1000Base-X端口分別與各Catalyst 2950G的1000Base-X端口連接。其中,GigabitEthernet3/2端口連接至1號(hào)Catalyst 2950交換機(jī)(VLAN 60,GigabitEthernet3/3端口連接至2號(hào)Catalyst 29

4、50交換機(jī)(VLAN 70,GigabitEthernet3/4端口連接至3號(hào)Catalyst 2950交換機(jī)(VLAN 80,GigabitEthernet3/5端口連接至4號(hào)Catalyst 2950交換機(jī)(VLAN 90, GigabitEthernet3/6端口連接至6號(hào)樓交換機(jī)(VLAN 80。由于在Catalyst 3550-24-EMI上劃分有4個(gè)VLAN(VLAN 10VLAN 40,而4個(gè)VLAN都需借助于一條1000Base-X鏈路實(shí)現(xiàn)與Catalyst 4006的GigabitEthernet3/1端口連接,因此,必須在Catalyst 4006與Catalyst 355

5、0-24- EMI之間創(chuàng)建一個(gè)Trunk。同樣,在Catalyst 3550-24-SMI上劃分有2個(gè)VLAN(VLAN 60和VLAN 80,而4個(gè)VLAN都需借助于一條1000Base-X鏈路實(shí)現(xiàn)與Catalyst 4006的GigabitEthernet3/6端口連接,因此,必須在Catalyst 4006與Catalyst 3550-24- EMI之間創(chuàng)建一個(gè)Trunk。另外,所有服務(wù)器均連接至Catalyst 4006的1000Base-T模塊,并單獨(dú)成為一個(gè)VLAN(VLAN 90,因此,也必須為這些交換機(jī)創(chuàng)建一個(gè)VLAN,并將所有端口指定至該VLAN。需要注意的是,考慮到網(wǎng)絡(luò)管理

6、的需要,也可以剩余幾個(gè)RJ-45端口(如21至24端口不指定至任何VLAN,從而便于連接網(wǎng)絡(luò)管理設(shè)備。默認(rèn)狀態(tài)下,所有端口都屬于VLAN1,而且也只有在VLAN1中才能實(shí)現(xiàn)對(duì)網(wǎng)絡(luò)中所有設(shè)備的管理。*配置清單*Cisco Catalyst 4006交換機(jī)配置清單Current configuration : 5594 bytes!version 12.1no service padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryptionservice compress-co

7、nfig!hostname hsnc!no logging consoleenable secret level 1 5 $1$rkQW$1HKyKdN5f.Ri5zxeoF8Yv/!ip subnet-zero!interface GigabitEthernet1/1no snmp trap link-status!-不為Supervisor Engine III G引擎中的1000Base-X插槽指定VLAN interface GigabitEthernet1/2no snmp trap link-status!interface GigabitEthernet2/1switchport

8、 access vlan 50no snmp trap link-status!-將端口GigabitEthernet2/1指定至VLAN 50!interface GigabitEthernet2/2switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/3switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/4switchport access vlan 50no snmp trap link-

9、status!interface GigabitEthernet2/5switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/6switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/7switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/8switchport access vlan 50!inter

10、face GigabitEthernet2/9 switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/10 switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/11 switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/12 switchport access vlan 50no snmp tra

11、p link-status!interface GigabitEthernet2/13 switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/14 switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/15 switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/16 switchport acces

12、s vlan 50no snmp trap link-status!interface GigabitEthernet2/17 switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/18 switchport access vlan 50no snmp trap link-status!interface GigabitEthernet2/19 switchport access vlan 50!interface GigabitEthernet2/20switchport access vla

13、n 50no snmp trap link-status!-不將GigabitEthernet2/2024指定至任何VLAN!interface GigabitEthernet3/1switchport trunk encapsulation dot1q!-啟用802.1Q Trunk封裝協(xié)議,即在該端口創(chuàng)建Trunk switchport trunk allowed vlan 1-80!-允許vlan 1-90在該中繼線通訊!-可以拒絕或允許某個(gè)VLAN訪問該Trunk!-確保未被授權(quán)的VLAN通過該Trunk,實(shí)現(xiàn)VLAN的訪問安全switchport mode trunk!-將該端口設(shè)置

14、為Trunkdescription netcenterno snmp trap link-status!interface GigabitEthernet3/2switchport access vlan 60no snmp trap link-status!-將端口GigabitEthernet3/2指定至VLAN 60!interface GigabitEthernet3/3switchport access vlan 70no snmp trap link-status!-將端口GigabitEthernet3/3指定至VLAN 70!interface GigabitEthernet3

15、/4switchport access vlan 80no snmp trap link-status!-將端口GigabitEthernet3/4指定至VLAN 80!interface GigabitEthernet3/5switchport access vlan 90no snmp trap link-status!-將端口GigabitEthernet3/5指定至VLAN 90!interface GigabitEthernet3/6switchport trunk encapsulation dot1q!-啟用802.1Q Trunk封裝協(xié)議,即在該端口創(chuàng)建Trunk switch

16、port trunk allowed vlan 1-80!-允許vlan 1-90在該中繼線通訊!-可以拒絕或允許某個(gè)VLAN訪問該Trunk!-從而確保未被授權(quán)的VLAN通過該Trunk,實(shí)現(xiàn)VLAN訪問安全switchport mode trunk!-將該端口設(shè)置為Trunkdescription netcenterno snmp trap link-status!interface Vlan1description netmangerno ip address!-對(duì)VLAN1進(jìn)行描述interface Vlan10description network centerno ip addre

17、ss!-對(duì)VLAN2進(jìn)行描述!interface Vlan20description computer centerno ip address!interface Vlan30description network labno ip address!interface Vlan40description huaxuelouno ip address!interface Vlan50description wulilouno ip address!interface Vlan60description shengwulouno ip address!interface Vlan70descrip

18、tion zhongwenxino ip address!interface Vlan80description tushuguanno ip address!line con 0stopbits 1line vty 0 4password aaalogin!endCisco Catalyst 3550-EMI配置清單Building configuration.Current configuration : 4055 bytes!version 12.1no service padservice timestamps debug uptimeservice timestamps log up

19、timeno service password-encryption!hostname office!enable secret 5 $1$p0fU$J eyPOM0RuL.Fqfe71efHF1 !ip subnet-zero!spanning-tree extend system-id!interface FastEthernet0/1switchport access vlan 10!-將端口FastEthernet0/1指定至VLAN 10no ip address!interface FastEthernet0/2switchport access vlan 10no ip addr

20、ess!interface FastEthernet0/3switchport access vlan 10no ip addressinterface FastEthernet0/4switchport access vlan 10no ip address!interface FastEthernet0/5switchport access vlan 10no ip address!interface FastEthernet0/6switchport access vlan 20no ip address!-將端口FastEthernet0/6指定至VLAN 20 !interface

21、FastEthernet0/7switchport access vlan 20no ip address!interface FastEthernet0/8switchport access vlan 20no ip address!interface FastEthernet0/9switchport access vlan 20no ip address!interface FastEthernet0/10switchport access vlan 20no ip address!interface FastEthernet0/11switchport access vlan 30no

22、 ip address!-將端口FastEthernet0/6指定至VLAN 30 !interface FastEthernet0/12switchport access vlan 30no ip address!interface FastEthernet0/13switchport access vlan 30no ip address!interface FastEthernet0/14switchport access vlan 30no ip address!interface FastEthernet0/15switchport access vlan 30no ip addre

23、ss!interface FastEthernet0/16switchport access vlan 30no ip address!interface FastEthernet0/17switchport access vlan 30no ip address!interface FastEthernet0/18switchport access vlan 30no ip address!interface FastEthernet0/19switchport access vlan 40no ip address!-將端口FastEthernet0/6指定至VLAN 40 !interf

24、ace FastEthernet0/20switchport access vlan 40no ip address!interface FastEthernet0/21switchport access vlan 40no ip address!interface FastEthernet0/22switchport access vlan 30no ip address!interface FastEthernet0/23switchport access vlan 40no ip address!interface FastEthernet0/24switchport access vl

25、an 40no ip address!interface GigabitEthernet0/1switchport trunk encapsulation dot1q!-啟用802.1Q Trunk封裝協(xié)議,即在該端口創(chuàng)建Trunk switchport trunk allowed vlan 1-80!-允許vlan 1-80在該中繼線通訊switchport mode trunk!-將該端口設(shè)置為Trunkno ip address!interface GigabitEthernet0/2no ip address!interface Vlan1!-LAN1指定IP地址no ip route

26、-cacheno ip mroute-cache!ip classlessip http server!line con 0line vty 0 4password aaaloginline vty 5 15login!endCisco Catalyst 3550-SMI配置清單Building configuration.Current configuration : 4055 bytes!version 12.1no service padservice timestamps debug uptimeservice timestamps log uptimeno service passw

27、ord-encryption!hostname office! enable secret 5 $1$p0fU$JeyPOM0RuL.Fqfe71efHF1 ! ip subnet-zero ! ! spanning-tree extend system-id ! ! ! interface FastEthernet0/1 switchport access vlan 60 !-將端口 FastEthernet0/1 指定至 VLAN 60 no ip address ! interface FastEthernet0/2 switchport access vlan 60 no ip add

28、ress ! interface FastEthernet0/3 switchport access vlan 60 no ip address ! interface FastEthernet0/4 switchport access vlan 60 no ip address ! interface FastEthernet0/5 switchport access vlan 60 no ip address ! interface FastEthernet0/6 switchport access vlan 20 no ip address !-將端口 FastEthernet0/6 指定至 VLAN 20 ! interface FastEthernet0/7 switchport access vlan 20 no ip