CISCO三层交换机VLAN配置说明.docx
10页
CISCO三层交换机VLAN配置说明 CISCO三层交换机VLAN配置说明 实验目标： (1) 第一步实现划分4个vlan，将相应port置入到vlan号中 (2) 第二步实现4个vlan间可以相互ping (3) 第三步实现sales,tech,manage不可以相互通讯，但允许和server通讯实现过程： 第 一步划分vlan如下： Switch#vlan data Switch(vlan)#vlan 10 name sales VLAN 10 added: Name: sales Switch(vlan)#vlan 20 name tech VLAN 20 added: Name: tech Switch(vlan)#vlan 30 name manage VLAN 30 added: Name: manage Switch(vlan)#vlan 40 name server VLAN 40 added: Name: server Switch(vlan)# Switch(config)#int range fa 0/0 - 3 Switch(config-if-range)#switchport access vlan 10 Switch(config-if-range)#exit Switch(config)#int range fa 0/4 - 6 Switch(config-if-range)#switchport access vlan 20 Switch(config-if-range)#exit Switch(config)#int range fa 0/7 - 8 Switch(config-if-range)#switchport access vlan 30 Switch(config-if-range)#exit Switch(config)#int fa 0/9 Switch(config-if)#swit Switch(config-if)#switchport acce Switch(config-if)#switchport access vlan 40 Switch(config-if)#exit 查看 Switch#sh vlan-switch VLAN Name Status Ports ---- -------------------------------- --------- -------------------------------1 default active Fa0/10, Fa0/11, Fa0/12, Fa0/13 Fa0/14, Fa0/15 10 sales active Fa0/1, Fa0/2, Fa0/3 20 tech active Fa0/4, Fa0/5, Fa0/6 30 manage active Fa0/7, Fa0/8 40 server active Fa0/9 1002 fddi-default active 第二步实现4个vlan内 的服务器互相ping Switch(config)#int fa 0/0 Switch(config-if)#switchport mode trunk Router(config-if)#exit Router(config)#int fa 0/0 Router(config-if)#no shut Router(config-if)#no ip address Router(config-if)#exit Router(config)#int fa0/0.1 Router(config-subif)#encapsulation dot1Q 10 Router(config-subif)#ip addre Router(config-subif)#ip address 192.168.33.1 255.255.255.0 Router(config-subif)#exit Router(config)#int fa0/0.2 Router(config-subif)#encapsulation dot1Q 20 Router(config-subif)#ip address 192.168.34.1 255.255.255.0 Router(config-subif)#exit Router(config)#int fa0/0.3 Router(config-subif)#encapsulation dot1Q 30 Router(config-subif)#ip address 192.168.35.1 255.255.255.0 Router(config-subif)#exit Router(config)#int fa0/0.4 Router(config-subif)#encapsulation dot1Q 40 Router(config-subif)#ip address 192.168.36.1 255.255.255.0 Router(config-subif)# 查看 路由器： interface FastEthernet0/0 no ip address duplex auto speed auto ! interface FastEthernet0/0.1 encapsulation dot1Q 10 ip address 192.168.33.1 255.255.255.0 ! interface FastEthernet0/0.2 encapsulation dot1Q 20 ip address 192.168.34.1 255.255.255.0 ! interface FastEthernet0/0.3 encapsulation dot1Q 30 ip address 192.168.35.1 255.255.255.0 ! interface FastEthernet0/0.4 encapsulation dot1Q 40 ip address 192.168.36.1 255.255.255.0 ! 测试： VPCS 1 >sh NAME IP/CIDR GATEWAY LPORT RPORT PC1 192.168.33.2/24 192.168.33.1 10001 21001 PC2 0.0.0.0/0 0.0.0.0 10002 21002 PC3 0.0.0.0/0 0.0.0.0 10003 21003 PC4 192.168.34.2/24 192.168.34.1 10004 21004 PC5 0.0.0.0/0 0.0.0.0 10005 21005 PC6 0.0.0.0/0 0.0.0.0 10006 21006 PC7 192.168.35.2/24 192.168.35.1 10007 21007 PC8 0.0.0.0/0 0.0.0.0 10008 21008 PC9 192.168.36.2/24 192.168.36.1 10009 21009 VPCS 1 >ping 192.168.34.2 192.168.34.2 icmp_seq=1 timeout 192.168.34.2 icmp_seq=2 time=45.000 ms 192.168.34.2 icmp_seq=3 time=47.000 ms 192.168.34.2 icmp_seq=4 time=43.000 ms 192.168.34.2 icmp_seq=5 time=8.000 ms VPCS 1 >ping 192.168.35.2 192.168.35.2 icmp_seq=1 time=43.000 ms 192.168.35.2 icmp_seq=2 time=14.000 ms 192.168.35.2 icmp_seq=3 time=8.000 ms 192.168.35.2 icmp_seq=4 time=10.000 ms 192.168.35.2 icmp_seq=5 time=12.000 ms VPCS 1 >ping 192.168.36.2 192.168.36.2 icmp_seq=1 timeout 192.168.36.2 icmp_seq=2 time=47.000 ms 192.168.36.2 icmp_seq=3 time=6.000 ms 192.168.36.2 icmp_seq=4 time=10.000 ms 192.168.36.2 icmp_seq=5 time=43.000 ms OK,这一步也成功了。
第三步，实现我们 的限制功能了 Router(config)# access-list 111 deny ip 192.168.33.0 0.0.0.255 192.168.34.0 0.0.0.255 Router(config)# access-list 111 deny ip 192.168.33.0 0.0.0.255 192.168.35.0 0.0.0.255 Router(config)# access-list 111 permit ip any any Router(config)# Router(config)# access-list 112 deny ip 192.168.34.0 0.0.0.255 192.168.33.0 0.0.0.255 Router(config)# access-list 112 deny ip 192.168.34.0 0.0.0.255 192.168.35.0 0.0.0.255 Router(config)# access-list 112 permit ip any any Router(config)# Router(config)# access-list 113 deny ip 192.168.35.0 0.0.0.255 192.168.33.0 0.0.0.255 Router(config)# access-list 113 deny ip 192.168.35.0 0.0.0.255 192.168.3。
