设备调试之PVLAN技术实践

private vlan

1.项目背景

在二层设备上隔离用户或隔离广播，可以将一组设备加入到一个vlan中，但vlan的最大数是4094，所以当需要隔离大量的广播域时会受到vlan个数的限制。通常在服务提供商（SP）网络中，为了隔离不同客户之间的通信而将一个客户作为一个vlan，但是如果客户的数量增大到vlan的最大个数时，服务提供商提供的服务也将受到限制。这种一个客户作为一个vlan的解决方案，服务提供商需要为每一个客户分配一个子网地址，会导致IP地址的浪费。

2.实验原理

PVLAN实验，实现了混杂端口与任意端口的通信，即混杂端口与隔离端口和团体端口的通；隔离端口只能与混杂端口通信，同vlan中不同PC之间的隔离；团体vlan与混杂端口通信，同vlan之间通信，不同vlan之间不能通信。

3.实验拓扑

VLAN 10 Primary vlan | VLAN 20 Community vlan | VLAN 30 Isolated vlan
以下实验采用锐捷设备调试

4.地址规划

5.详细配置

S2-1基本配置

Ruijie>ena
Ruijie#con
Enter configuration commands, one per line.  End with CNTL/Z.
s2-1(config)#vlan 10
s2-1(config-vlan)#private-vlan primary 
s2-1(config-vlan)#exit
s2-1(config)#vlan 30
s2-1(config-vlan)#private-vlan isolated 
s2-1(config-vlan)#exit
s2-1(config)#vlan 20
s2-1(config-vlan)#private-vlan community 
s2-1(config-vlan)#exit
s2-1(config)#vlan 10
s2-1(config-vlan)#private-vlan association add 20,30
s2-1(config-vlan)#exit
s2-1(config)#interface range fastEthernet 0/1,0/3
s2-1(config-if-range)#switchport mode private-vlan host
s2-1(config-if-range)#switchport private-vlan host-association 10 30
s2-1(config-if-range)#exit
s2-1(config)#interface aggregateport 1
s2-1(config-if-AggregatePort 1)#switchport mode trunk
s2-1(config-if-AggregatePort 1)#exit
s2-1(config)#interface range fastEthernet 0/23-24
s2-1(config-if-range)#port-group 1
s2-1(config-if-range)#exit   
s2-1(config)#interface fastEthernet 0/5
s2-1(config-if-FastEthernet 0/5)#switchport mode private-vlan promiscuous 
                                                                        
s2-1(config-if-FastEthernet 0/5)#switchport private-vlan mapping 10 add 30   
s2-1(config-if-FastEthernet 0/5)#exit
s2-1(config)#interface vlan 10
2-1(config-if-VLAN 10)#ip address 192.168.10.1 255.255.255.0
s2-1(config-if-VLAN 10)#private-vlan mapping add 30
s2-1(config-if-VLAN 10)#exit

S2-2基本配置

Ruijie>ena
Ruijie#con
Enter configuration commands, one per line.  End with CNTL/Z.
Ruijie(config)#host s2-2
s2-2(config)#vlan 10
s2-2(config-vlan)#private-vlan primary 
s2-2(config-vlan)#exit
s2-2(config)#vlan 20
s2-2(config-vlan)#private-vlan community 
s2-2(config-vlan)#exit
s2-2(config)#vlan 30
s2-2(config-vlan)#private-vlan isolated 
s2-2(config-vlan)#exit
s2-2(config)#vlan 10
s2-2(config-vlan)#private-vlan association add 20,30
s2-2(config-vlan)#exit
s2-2(config)#interface fastEthernet 0/1
s2-2(config-if-FastEthernet 0/1)#switchport mode private-vlan host
s2-2(config-if-FastEthernet 0/1)#switchport private-vlan host-association 10 20            
s2-2(config-if-FastEthernet 0/1)#exit
s2-2(config)#interface aggregateport 1
s2-2(config-if-AggregatePort 1)#switchport mode trunk
s2-2(config-if-AggregatePort 1)#exit
s2-2(config)#interface range fastEthernet 0/23-24
s2-2(config-if-range)#port-group 1
s2-2(config-if-range)#exit        
s2-2(config)#interface fastEthernet 0/3
s2-2(config-if-FastEthernet 0/3)#switchport mode trunk
s2-2(config-if-FastEthernet 0/3)#exit
s2-2(config)#interface vlan 10
s2-2(config-if-VLAN 10)#ip address 192.168.10.1 255.255.255.0
s2-2(config-if-VLAN 10)#exit
s2-2(config)#interface fastEthernet 0/3                                             
s2-2(config-if-FastEthernet 0/3)#switchport mode private-vlan promiscuous
s2-2(config-if-FastEthernet 0/3)#switchport private-vlan mapping 10 add 20
s2-2(config-if-FastEthernet 0/3)#exit
s2-2(config)#exit

6.测试结果

S2-1测试结果
s2-1#ping 192.168.10.1
Sending 5, 100-byte ICMP Echoes to 192.168.10.1, timeout is 2 seconds:
  < press Ctrl+C to break >
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
s2-1#ping 192.168.10.12
Sending 5, 100-byte ICMP Echoes to 192.168.10.12, timeout is 2 seconds:
  < press Ctrl+C to break >
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
s2-1#ping 192.168.10.11
Sending 5, 100-byte ICMP Echoes to 192.168.10.14, timeout is 2 seconds:
  < press Ctrl+C to break >
.
Success rate is 0 percent (0/1)

s2-1#ping 192.168.10.14
Sending 5, 100-byte ICMP Echoes to 192.168.10.14, timeout is 2 seconds:
  < press Ctrl+C to break >
.
Success rate is 0 percent (0/1)
s2-1#

S2-1测试结果

s2-2#ping 192.168.10.1
Sending 5, 100-byte ICMP Echoes to 192.168.10.1, timeout is 2 seconds:
  < press Ctrl+C to break >
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
s2-2#ping 192.168.10.14
Sending 5, 100-byte ICMP Echoes to 192.168.10.14, timeout is 2 seconds:
  < press Ctrl+C to break >
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
s2-2#ping 192.168.10.11
Sending 5, 100-byte ICMP Echoes to 192.168.10.11, timeout is 2 seconds:
  < press Ctrl+C to break >
.
Success rate is 0 percent (0/1)
s2-2#ping 192.168.10.12
Sending 5, 100-byte ICMP Echoes to 192.168.10.12, timeout is 2 seconds:
  < press Ctrl+C to break >
.
Success rate is 0 percent (0/1)

s2-2#