什么是VLAN(Virtual Local Area Network) ?
虚拟局域网的意思。交换机的所有端口都属于同一个广播域。VLAN在逻辑上将一个物理网络划分为多个广播域。
为什么需要VLAN?
交换机的机制是会将收到的信息,广播到除了源端口的所有端口,这种情况下,此网络钟充斥着大量的广播消息,降低链路利用率,影响网络性能。通过在交换机上配置VLAN,可以实现同一个VLAN内的用户能直接相互通信,不同VLAN的用户不能直接相互通信。提高链路的利用率,增加网络的安全性,降低广播风暴。
VLAN的划分方法有哪些?
基于端口划分vlan
基于MAC地址划分vlan
基于IP子网划分vlan
基于协议划分vlan
基于策略划分vlan
配置基于端口划分VLAN
应用场景:适合主机位置不发生改变的大小型网络,手动配置交换机的端口类型,端口允许传输的vlan。此配置需要提前手动将交换机的端口与规划好的vlan作映射关系
SWA交换机的配置:
<Huawei>sys
[Huawei]undo info-center enable
[Huawei]vlan batch 10 20 30
[Huawei]interface Ethernet 0/0/2
[Huawei-Ethernet0/0/2]port link-type access
[Huawei-Ethernet0/0/2]port default vlan 10
[Huawei-Ethernet0/0/2]quit
[Huawei]interface Ethernet 0/0/3
[Huawei-Ethernet0/0/3]port link-type access
[Huawei-Ethernet0/0/3]port default vlan 20
[Huawei-Ethernet0/0/3]quit
[Huawei]interface Ethernet 0/0/4
[Huawei-Ethernet0/0/4]port link-type access
[Huawei-Ethernet0/0/4]port default vlan 30
[Huawei-Ethernet0/0/4]quit
[Huawei]interface Ethernet 0/0/1
[Huawei-Ethernet0/0/1]port link-type trunk
[Huawei-Ethernet0/0/1]port trunk allow-pass vlan all
[Huawei-Ethernet0/0/1]
SWB交换机的配置:
<Huawei>sys
[Huawei]undo info-center enable
[Huawei]vlan batch 10 20 30
[Huawei]interface Vlanif 10
[Huawei-Vlanif10]ip address 192.168.10.254 24
[Huawei-Vlanif10]quit
[Huawei]interface Vlanif 20
[Huawei-Vlanif20] ip a
[Huawei-Vlanif20] ip address 192.168.20.254 24
[Huawei-Vlanif20]quit
[Huawei]interface Vlanif 30
[Huawei-Vlanif30]ip address 192.168.30.254 24
[Huawei-Vlanif30]quit
[Huawei]interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type trunk
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[Huawei]
配置基于MAC地址划分VLAN
应用场景:适合主机位置经常发生变动,但是网卡不变的小型网络,将MAC地址与vlan进行绑定,即使主机位置发生变化,也能访问相应的服务。此配置需要提前手动将网络中主机MAC地址与VLAN作一一映射关系。
级联交换机的配置:
<Huawei>sys #进入系统视图
[Huawei]undo info-center enable #关闭信息中心
[Huawei]vlan batch 10 20 #批量配置vlan10 20
[Huawei]interface GigabitEthernet 0/0/1 #进入0/0/1接口
[Huawei-GigabitEthernet0/0/1]port link-type trunk #设置接口类型为trunk
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan all #设置接口允许传输的vlan数据,允许传输所有vlan数据
[Huawei-GigabitEthernet0/0/1]quit # 退出当前视图
[Huawei]interface GigabitEthernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type trunk
[Huawei-GigabitEthernet0/0/2]port trunk allow-pass vl
[Huawei-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/2]quit
[Huawei]interface GigabitEthernet 0/0/3
[Huawei-GigabitEthernet0/0/3]port link-type trunk
[Huawei-GigabitEthernet0/0/3]port trunk allow-pass vlan
[Huawei-GigabitEthernet0/0/3]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/3]quit
[Huawei]interface GigabitEthernet 0/0/4
[Huawei-GigabitEthernet0/0/4]port link-type trunk
[Huawei-GigabitEthernet0/0/4]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/4]quit
部门A的交换机的配置:
<Huawei>sys #进入系统视图
[Huawei]undo info-center enable #关闭信息中心功能
[Huawei]sysname part-A #设置交换机名称
[part-A]vlan batch 10 20 #批量配置vlan 10 20
[part-A]interface Ethernet 0/0/1 #进入接口0/0/1
[part-A-Ethernet0/0/1]port link-type trunk # 设置接口类型为trunk
[part-A-Ethernet0/0/1]port trunk allow-pass vlan all #允许接口传输苏哟有vlan的数据
[part-A]vlan 10 #进入vlan 10 的配置视图
[part-A-vlan10]mac-vlan mac-address 5489-980B-3043 将该MAC地址与vlan绑定
[part-A-vlan10]quit #退出当前视图
[part-A]vlan 20 #进入vlan 20 的配置视图
[part-A-vlan20]mac-vlan mac-address 5489-98A1-045F #将该MAC地址与vlan绑定
[part-A-vlan20]quit #退出当前视图
[part-A]interface Ethernet 0/0/2 #进入接口0/0/2
[part-A-Ethernet0/0/2]port link-type hybrid #设置接口类型为hybrid
[part-A-Ethernet0/0/2]port hybrid untagged vlan 10 20 #允许端口传输vlan10 、20 的数据,发送数据的时候去掉其tag标记
[part-A-Ethernet0/0/2]mac-vlan enable #启用接口的mac-vlan功能
[part-A-Ethernet0/0/2]quit
[part-A]display mac-vlan mac-address all # 查看所有mac地址与vlan的绑定情况
---------------------------------------------------
MAC Address MASK VLAN Priority
---------------------------------------------------
5489-98a1-045f ffff-ffff-ffff 20 0
5489-980b-3043 ffff-ffff-ffff 10 0
Total MAC VLAN address count: 2
部门B的交换机与部门A的交换机配置一样(只有主机名不一样)
配置基于IP子网划分VLAN
应用场景:根据数据帧中的源IP地址与子网掩码来划分VLAN,需要预先配置IP地址与VLAN的映射关系。
SWA交换机不做任何配置,当作傻瓜式交换机即可。
SWB交换机配置如下:
<Huawei>sys
[Huawei]undo info-center enable
[Huawei]vlan batch 100 110 120
[Huawei]vlan 100
[Huawei-vlan100]ip-subnet-vlan 1 ip 192.168.10.100 24
[Huawei-vlan100]quit
[Huawei]vlan 110
[Huawei-vlan110]ip-subnet-vlan 1 ip 192.168.20.100 24
[Huawei-vlan110]quit
[Huawei]vlan 120
[Huawei-vlan120]ip-subnet-vlan 1 ip 192.168.30.100 24
[Huawei-vlan120]quit
[Huawei]interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type hybrid
[Huawei-GigabitEthernet0/0/1]port hybrid untagged vlan 100 110 120
[Huawei-GigabitEthernet0/0/1]ip-subnet-vlan enable
[Huawei-GigabitEthernet0/0/1]quit
[Huawei]interface Vlanif 100
[Huawei-Vlanif100]ip address 192.168.10.254 24
[Huawei-Vlanif100]quit
[Huawei]interface Vlanif 110
[Huawei-Vlanif110]ip address 192.168.20.254 24
[Huawei-Vlanif110]quit
[Huawei]interface Vlanif 120
[Huawei-Vlanif120]ip address 192.168.30.254 24
[Huawei-Vlanif120]quit
[Huawei]
配置基于协议划分VLAN
应用场景:根据数据帧所属的协议类型及封装格式来划分vlan,需要预先配置协议域域VLAN的映射关系,适用于同时运行多协议的网络。经典的案列是internet业务与语音业务属于不同的业务,使用不同的协议类型,可以将两种业务划分到不同的vlan中。实际环境中语音业务与互联网业务可以同一个端口使用不同VLAN下发,也可以使用不同的端口进行下发,一般来说都是使用同一个端口,毕竟节约设备端口资源。
SWB交换机的配置:
<Huawei>sys
[Huawei]undo info-center enable
[Huawei]vlan batch 100 200
[Huawei]interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type trunk
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/1]quit
[Huawei]interface GigabitEthernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type trunk
[Huawei-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/2]quit
[Huawei]interface GigabitEthernet 0/0/3
[Huawei-GigabitEthernet0/0/3]port link-type trunk
[Huawei-GigabitEthernet0/0/3]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/3]quit
[Huawei]
SWA交换机的配置:
<Huawei>sys
[Huawei]undo info-center enable
[Huawei]vlan batch 100 200
[Huawei]vlan 100
[Huawei-vlan100]protocol-vlan 0 ipv4
[Huawei-vlan100]quit
[Huawei]vlan 200
[Huawei-vlan200]protocol-vlan 0 ipv6
[Huawei-vlan200]quit
[Huawei]interface Ethernet 0/0/3
[Huawei-Ethernet0/0/3]port link-type trunk
[Huawei-Ethernet0/0/3]port trunk allow-pass vlan all
[Huawei-Ethernet0/0/3]quit
[Huawei]interface Ethernet 0/0/1
[Huawei-Ethernet0/0/1]port link-type hybrid
[Huawei-Ethernet0/0/1]port hybrid untagged vlan 100
[Huawei-Ethernet0/0/1]protocol-vlan vlan 100 0
[Huawei-Ethernet0/0/1]quit
[Huawei-Ethernet0/0/2]port link-type hybrid
[Huawei-Ethernet0/0/2]port hybrid untagged vlan 200
[Huawei-Ethernet0/0/2]protocol-vlan vlan 200 0
[Huawei-Ethernet0/0/2]quit
[Huawei]
配置基于策略划分VLAN
应用场景:基于策略划分VLAN是指在交换机上指定终端的MAC地址、IP地址或接口,并与VLAN关联。只有符合条件的终端才能加入指定VLAN。符合策略的终端加入指定VLAN后,严禁修改IP地址或MAC地址,否则会导致终端从指定VLAN中退出。适用于安全要求比较高的场合。
SWC交换机的配置:
<Huawei>sys
[Huawei]undo info-center enable
[Huawei]vlan batch 10 20
[Huawei]interface Vlanif 10
[Huawei-Vlanif10]ip address 192.168.1.254 24
[Huawei-Vlanif10]quit
[Huawei]interface Vlanif 20
[Huawei-Vlanif20]ip address 192.168.2.254 24
[Huawei-Vlanif20]quit
[Huawei]interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type trunk
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/1]quit
[Huawei]interface GigabitEthernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type trunk
[Huawei-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/2]quit
[Huawei]
SWA交换机的配置:
<Huawei>sys
[Huawei]undo info-center enable
[Huawei]vlan 10
[Huawei-vlan10]quit
[Huawei]interface Ethernet 0/0/1
[Huawei-Ethernet0/0/1]port link-type hybrid
[Huawei-Ethernet0/0/1]port hybrid untagged vlan 10
[Huawei-Ethernet0/0/1]quit
[Huawei]vlan 10
[Huawei-vlan10]policy-vlan mac-address 5489-98B6-012E ip 192.168.1.1 interface Ethernet 0/0/1
[Huawei-vlan10]quit
[Huawei]interface Ethernet 0/0/2
[Huawei-Ethernet0/0/2]port link-type trunk
[Huawei-Ethernet0/0/2]port trunk allow-pass vlan all
[Huawei-Ethernet0/0/2]quit
[Huawei]
SWB交换机的配置:
<Huawei>sys
[Huawei]undo info-center enable
[Huawei]vlan 20
[Huawei-vlan20]quit
[Huawei]interface Ethernet 0/0/1
[Huawei-Ethernet0/0/1]port link-type hybrid
[Huawei-Ethernet0/0/1]port hybrid untagged vlan 20
[Huawei-Ethernet0/0/1]quit
[Huawei]vlan 20
[Huawei-vlan20]policy-vlan mac-address 5489-98CD-4131 ip 192.168.2.1 interface Ethernet 0/0/1
[Huawei-vlan20]quit
[Huawei]interface Ethernet 0/0/2
[Huawei-Ethernet0/0/2]port link-type trunk
[Huawei-Ethernet0/0/2]port trunk allow-pass vlan all
[Huawei-Ethernet0/0/2]quit
[Huawei]