2018年7月31日ccna ccnav3.0修改版課件15-0實現vlan和trunk

1、Implementing VLANs and Trunks實現VLAN和TrunkBuilding a Medium-Sized Network erconnecting Cisco Networking Devi, Part 1 (ICND1) v3.0204426777IThese ies in a Poorly Designed Networkes are often found in poorly desidnetworks:s一個超大的廣播域，極其浪費帶寬Large broadcastManagement and support challenges帶來管理和支持上的sible se

2、curity vulnerabilities安全性幾乎為0204426777VLANroductionA VLAN is a virtual LAN.VLAN = broadcastVLAN = logical network (subnet)VLANs address these needs:SegmenSecurityionNetwork flexibility靈活性204426777Trunking with 802.1QRunning many VLANs betn switches would require thesamber oferconnecting links.204426

3、777Trunking with 802.1Q (Cont.)Combining many VLANs on the same port is called trunking-trunk允許多個vlan流量在同一鏈路轉發(fā)A trunk allows the transporion of frames from different VLANs.t specifies the VLANt it belongs to通過幀中的tag指定vlan流量的歸屬Each frame has a tagFrames are forwarded to the corresponding VLAN based o

4、n the tag information.基于幀把相應vlan的信息轉發(fā)到端口204CCNAv3.0課程Trunking with 802.1Q (Cont.)204426777Trunking with 802.1Q (Cont.)204426777Trunking with 802.1Q (Cont.)204426777Creating a VLANAdds VLAN 2 and names it Sales204426777SwitchX#configure terminal SwitchX(config)#vlan 2 SwitchX(config-vlan)SalesCreatin

5、g a VLAN (Cont.)Verifies VLAN2204426777SwitchX# show vlan id 2VLAN NameSusPorts2SalesactiveFa0/2, Fa0/12VLAN Type SAIDMTUParent RingNo BridgeNo StpBrdgMode Trans1 Trans22enet 100002 1500 -00Assigning a Port to a VLANAssigns port FastEthernet0/3 to VLAN 2204426777SwitchX#configure terminal SwitchX(co

6、nfig)#erface FastEthernet 0/3 SwitchX(config-iswitchport acs vlan 2Assigning a Port to a VLAN (Cont.)Verifiest port FastEthernet0/3 was assigned to VLAN 2204426777SwitchX#show vlan briefVLAN NameSusPortsdefaultactiveFa0/1SalesactiveFa0/3vlan3activevlan4activeAssigning a Port to a VLAN (Cont.)Verifie

7、s VLAN membership on the Fa0/3erface204426777SwitchX#showerface FastEthernet0/3 switchportName: Fa0/3 Switchport: EnabledAdministrative Mode: dynamic auto Operational Mode: sic acs Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: native Negotiation of Trunking: OnAcs

8、Mode VLAN: 2 (Sales)Configuring an 802.1Q TrunkEnter theerface configuration mode.Configure the Fa0/11erface as a VLAN trunk.Change the native VLAN from 1 to 99.SwitchX#configure SwitchX(config)# SwitchX(config-iterminalerface FastEthernet 0/11#switchport mode trunkSwitchX(config-if)#switchport trun

9、k native vlan99Native VLAN 的幀在Trunk鏈不帶標記交換機收到不打標記的幀將會轉發(fā)到Native vlan。vlan d204426777Configuring an 802.1Q Trunk (Cont.)o Verifies a trunk on the Fa0/11erface204426777SwitchX#showerfaFastEthernet0/11 trunkPortModeEncapsulation SusNative vlan Fa0/11 on802.1qtrunking99PortVlans allowed on trunk Fa0/111-

10、4094PortVlans allowed and activeanagementFa0/111-13SwitchX#showerfaFastEthernet0/11 switchportName: Fa0/11 Switchport: EnabledAdministrative Mode: trunkOperational Mode: trunkAdministrative Trunking Encapsulation: dot1q Negotiation of Trunking: OnAcs Mode VLAN: 99 Trunking Native Mode VLAN: 99VLAN D

11、esign Considerationsum number of VLANs is switch-dependent考慮VLAN數目以及The交換機可以承載的vlanVLAN 1 is the factory-default Ethernet VLAN.A use-dedicated VLAN is for the Cisco swit一個專門的vlan進行交換機的管理Keep management traffic in a separate VLAN.Change the native VLAN to something other native vlan更改到一個不用的vlananagem

12、ent IP address.用n VLAN 1為了安全期間把204426777VLAN Design Considerations (Cont.)When configuring a trunk link, consider the following:Make suret the native VLAN for an 802.1Q trunk is the same on bothends of the trunk link.確保native vlan在trunk的兩端相同n Cisco switches.用DTP協(xié)議管DTP manages trunk negotiations bet理

13、思科設備trunk的協(xié)商204426777Physical Redundancy in a LANLoops may occurhe network as part of a design strategy forredundancy.物理環(huán)路在有冗余的同時也會造成環(huán)路的產生204426777Physical Redundancy in a LAN (Cont.)通過Spanning-tree避免環(huán)路的產生204426777實施DTP協(xié)議204426777Trunking ConfigurationdsTrunks can be configured s或者DTP默認配置trunkically

14、 or via DTP.可以通過靜態(tài)DTP provides the ability to negotiate the trunkingConmfigeutrhinogda.DTrTuPnk協(xié)議提供協(xié)商trunk的方式switchport trunkswitchport modeswitchport nonegotiate204426777DTPDTP - Dynamic Trunking protocol它的前身是DISL - Dynamic ISL它們都是思科私有的協(xié)議，用于協(xié)商Trunk鏈路（類型為0X2004的組播MAC：01-00-讓回顧0C-CC-CC-CC,每間隔一秒發(fā)送一次，形

15、成干道之后間隔30秒發(fā)送）TrunkON 默認發(fā)送DTP（ switchport mode trunk ）OFF 用命令“switchport nonegotiate”關掉DTPDynamic一下青蔥歲月的“戀愛故事”Auto 默認不發(fā)送DTP，但是收到DTP后可以回復，協(xié)商switchport mode dynamic autoDesirable 默認主動發(fā)送DTP，主動協(xié)商switchport mode dynamic desirable-IOU不支持該命令Acs 不發(fā)送DTP,不協(xié)商Trunk204426777Trunk工作模式204426777鏈路trunk模式描述開啟將端口強制設定為

16、Trunk即使對端不成為Trunk，本端也成為Trunk關閉將端口強制設定為非Trunk期望（desirable）端口主動與鄰接端口協(xié)商為Trunk自動（Auto）如果鄰接端口嘗試協(xié)商為Trunk，則成為Trunk非協(xié)商將端口強制設定為Trunk，并且不在發(fā)送DTP報文Switchport 模式交互Note: Table ashow dtpmes DTP is enabled at both ends.erface 看當前配置Debug dtp event-驗證DTP事件204426777Dynamic AutoDynamicDesirableTrunkAcsDynamic AutoAcsTr

17、unkTrunkAcsDynamic DesirableTrunkTrunkTrunkAcsTrunkTrunkTrunkTrunkNotmendedAcsAcsAcsNotmendedAcs實施VTP協(xié)議204426777VTP-VLAN Trunking ProtocolVTP is a Layer 2 messaging protocolt maains VLAN configuration consistencyby managing the addition, deletion, and renaming of VLANs on a network-wide basisVTP是一種為

18、了保持VLAN配置的連續(xù)性，方便管理增加、刪除、重命名VLAN等行為設計的二層協(xié)議VTP 應用場景，在交換網絡中減少配置量，在一臺VTP server上配置vlan，該信息會分發(fā)到該域內的所有設備。VTP是思科私有協(xié)議，在絕大多數交換機上都支持目前存在三個版本V1、V2和V3（版本兼容性存在一些問題）VTP Ver1 and VTPVer2 are noteroperable on switcheshe same VTP. Every switchhe VTPmust use the same VTP ver.204426777VTP 協(xié)議公告 VLAN 配置信息在整個公共管理域內保持VLAN

19、配置一致只在Trunk端口發(fā)送公告/空時接收域信息并同步不同設備不同版本的IOS默認的VTP版本號不一204426777VTP 域交換 VLAN 信息的一組交換機交換機上管理VLANs在204426777VTP 模式Server (服務器模式，默認的模式)創(chuàng)建、修改和刪除 VLANs發(fā)送和轉發(fā)公告同步 VLAN 配置VLAN 配置信息保存在 Flash 的 vlan.dat 里面Cnt（客戶模式）不能創(chuàng)建、修改和刪除 VLANs發(fā)送、續(xù)傳公告同步 VLAN 配置VLAN 配置信息保存在 Flash 的vlan.dat里面Transparent（透明模式）創(chuàng)建、修改和刪除 VLANs不發(fā)送公告，轉發(fā)公告不同步 VLAN 配置VLAN 配置信息保存在 Config 里面204426777nt同步ServerVTP C現在VTP Cnt配置版本號為5（已經被同步過）服務器端vtp為0NULL（會清空配置版本號），此時服務器端配置版本號QYT（修改，與客戶端相同），那么此時客戶端會同步服務vtp器端