一台华为S5700交换机上有4个Vlan，如何设置Vlan间互通和隔离？ “华为5700”如何设置VLAN间的互访？
\u534e\u4e3a5700\u600e\u4e48\u8bbe\u7f6eVLAN\u95f4\u7684\u4e92\u8bbf\u65b0\u624b\u8bf7\u7ed9\u51fa\u8be6\u7ec6\u914d\u7f6e\u3002VLAN\u95f4\u4e92\u8bbf\u4e00\u822c\u6709\u4e24\u79cd\u65b9\u5f0f\uff0c\u5355\u81c2\u8def\u7531\u548c\u521b\u5efaVLAN\u4e09\u5c42\u63a5\u53e3\u3002
\u5355\u81c2\u8def\u7531\u4e00\u822c\u7528\u5728\u5b9e\u73b0\u4e8c\u5c42\u4ea4\u6362\u673aVLAN\u95f4\u4e92\u8bbf\uff0c\u9700\u8981\u4e00\u53f0\u8def\u7531\u5668\u652f\u6301\uff1a
\u5047\u8bbe\u6211\u4eec\u9700\u8981\u5b9e\u73b0VLAN100\u548cVLAN200\u95f4\u4e92\u8bbf
\u4e00\u3001\u5355\u81c2\u8def\u7531
\u62d3\u6251 sw1 g0/0/1 ------g0/0/0 R1
\u914d\u7f6e\uff1a
SW1\uff1ainterface g0/0/1
port link-type trunk
port trunk allow-pass vlan 100 200
R1: interface G 0/0/0.1 //\u8def\u7531\u5668\u4e0a\u521b\u5efa\u4e24\u4e2a\u5b50\u63a5\u53e3\uff0c\u5206\u522b\u7ec8\u7ed3VLAN100\u548c200\uff0c\u5b50\u63a5\u53e3\u53f7\u81ea\u5df1\u968f\u610f\u5b9a\u4e49\uff0c\u4e24\u4e2aIP\u5730\u5740\u5206\u522b\u4f5c\u4e3aVLAN100 200\u4e3b\u673a\u7684\u7f51\u5173\u5730\u5740
vlan dot1q vid 100
ip address 192.168.10.1 255.255.255.0
interface G0/0/0.2
vlan dot1q vid 200
ip address 192.168.20.1 255.255.255.0
\u4e8c\u3001\u521b\u5efa\u4e09\u5c42\u63a5\u53e3
interface vlanif 100 //\u521b\u5efa\u4e24\u4e2aVLAN\u5bf9\u5e94\u7684VLAN(SVI)\u63a5\u53e3\u4f5c\u4e3a\u7f51\u5173
ip add192.168.10.1 255.255.255.0
interface vlanif 200
ip add192.168.20.1 255.255.255.0
\u8fd9\u6837\u4ea4\u6362\u673a\u4e0a\u4f1a\u4e3a\u8fd9\u4e24\u4e2a\u7f51\u6bb5\u4ea7\u751f\u4e24\u6761\u76f4\u8fde\u8def\u7531\uff0c\u5b9e\u73b0\u7f51\u6bb5\u95f4\u4e92\u8bbf\u3002
\u7531\u4e8eS5700\u4e3a\u4e09\u5c42\u4ea4\u6362\u673a\uff0c\u672c\u8eab\u652f\u6301\u4e09\u5c42\u529f\u80fd\uff0c\u63a8\u8350\u4f7f\u7528\u7b2c\u4e8c\u79cd\u65b9\u6cd5\uff0c\u6bd4\u8f83\u7b80\u5355\u3002
VLAN\u95f4\u4e92\u8bbf\u4e00\u822c\u6709\u4e24\u79cd\u65b9\u5f0f\uff0c\u5355\u81c2\u8def\u7531\u548c\u521b\u5efaVLAN\u4e09\u5c42\u63a5\u53e3\u3002
\u5355\u81c2\u8def\u7531\u4e00\u822c\u7528\u5728\u5b9e\u73b0\u4e8c\u5c42\u4ea4\u6362\u673aVLAN\u95f4\u4e92\u8bbf\uff0c\u9700\u8981\u4e00\u53f0\u8def\u7531\u5668\u652f\u6301\uff1a
\u5047\u8bbe\u6211\u4eec\u9700\u8981\u5b9e\u73b0VLAN100\u548cVLAN200\u95f4\u4e92\u8bbf
\u4e00\u3001\u5355\u81c2\u8def\u7531
\u62d3\u6251 sw1 g0/0/1 ------g0/0/0 R1
\u914d\u7f6e\uff1a
SW1\uff1ainterface g0/0/1
port link-type trunk
port trunk allow-pass vlan 100 200
R1: interface G 0/0/0.1 //\u8def\u7531\u5668\u4e0a\u521b\u5efa\u4e24\u4e2a\u5b50\u63a5\u53e3\uff0c\u5206\u522b\u7ec8\u7ed3VLAN100\u548c200\uff0c\u5b50\u63a5\u53e3\u53f7\u81ea\u5df1\u968f\u610f\u5b9a\u4e49\uff0c\u4e24\u4e2aIP\u5730\u5740\u5206\u522b\u4f5c\u4e3aVLAN100 200\u4e3b\u673a\u7684\u7f51\u5173\u5730\u5740
vlan dot1q vid 100
ip address 192.168.10.1 255.255.255.0
interface G0/0/0.2
vlan dot1q vid 200
ip address 192.168.20.1 255.255.255.0
\u4e8c\u3001\u521b\u5efa\u4e09\u5c42\u63a5\u53e3
interface vlanif 100 //\u521b\u5efa\u4e24\u4e2aVLAN\u5bf9\u5e94\u7684VLAN(SVI)\u63a5\u53e3\u4f5c\u4e3a\u7f51\u5173
ip add192.168.10.1 255.255.255.0
interface vlanif 200
ip add192.168.20.1 255.255.255.0
\u8fd9\u6837\u4ea4\u6362\u673a\u4e0a\u4f1a\u4e3a\u8fd9\u4e24\u4e2a\u7f51\u6bb5\u4ea7\u751f\u4e24\u6761\u76f4\u8fde\u8def\u7531\uff0c\u5b9e\u73b0\u7f51\u6bb5\u95f4\u4e92\u8bbf\u3002
\u7531\u4e8eS5700\u4e3a\u4e09\u5c42\u4ea4\u6362\u673a\uff0c\u672c\u8eab\u652f\u6301\u4e09\u5c42\u529f\u80fd\uff0c\u63a8\u8350\u4f7f\u7528\u7b2c\u4e8c\u79cd\u65b9\u6cd5\uff0c\u6bd4\u8f83\u7b80\u5355\u3002
例如vlanif 10 ip 192.168.1.1/24
vlanif20 ip 192.168.2.1/24
acl可以这样写
acl 3000
rule 5 deny ip source 192.168.1.0 0.0.0.255
destination 192.168.2.0 0.0.0.255
然后再在vlan对应的接口下挂接acl
,例int g0/0/1
traffic-filter inbound acl 3000
这样即可实现此功能。
绛旓細鍗庝负S5700浜ゆ崲鏈鐨勯厤缃楠ゅ涓嬶細1銆佸厑璁竧elnet杩滅▼鐧婚檰锛屽厑璁稿崕涓轰氦鎹㈡満鑳絫elnet锛岃缃瘑鐮侊紱2銆佸崕涓篠5720S浜ゆ崲鏈鸿繙绋嬬櫥褰曪紱3銆 鍒涘缓VLAN锛屾壒閲忓皢澶氫釜绔彛娣诲姞鍒癆ccess锛4銆佸皢澶氫釜绔彛娣诲姞鍒癟runk锛屾壒閲忓皢1鍒16绔彛娣诲姞鍒癟runk锛5銆佸垱寤洪摼璺仛鍚堢鍙ｏ紝灏47銆48鍒涘缓閾捐矾鑱氬悎2锛屼娇鐢ㄥ厜绾わ紱6銆乂LAN绔彛閲嶆柊...
绛旓細1.[swtich 1]interface GigabitEthernet 0/0/8 [swtich 1-GigabitEthernet0/0/8]port link-type trunk [swtich 1-GigabitEthernet0/0/8]port trunk allow-pass vlan all Display VLAN鏌ョ湅涓涓 鏄剧ずTG灏辫鏄巘runk妯″紡宸插缓鎴 瀵逛簬涓婃枃鎴戣鍒浜ゆ崲鏈绔彛涓嶅鐢ㄧ殑鎯呭喌锛屽彧闇瑕佸湪鍙﹀涓鍙璺熷湪杩欏彴浜ゆ崲鏈...
绛旓細閰嶇疆娌℃樉绀哄畬锛岀粓绔厤缃涔堬紝鏈夋病鏈塧cl銆 port-isolate涔嬬被鐨勶紱鎶奺nsp鍙﹀瓨浜嗕笂浼犵湅鐪嬪惂
绛旓細鏍规嵁鍗庝负鐩掑紡浜ゆ崲鏈鐨勫懡浠よ鍒 s5700s-52p-li绗竴涓猄浠ｈ〃浜ゆ崲鏈5浠ｈ〃涓嬭鎺ュ彛鍗冨厗7浠ｈ〃浜у搧绯诲垪00浠ｈ〃瀛愮郴鍒楋紝涔熷彲浠ヤ唬琛ㄦ帴鍙ｏ紝渚嬪52鍙ｇ殑浜ゆ崲鏈哄彨鍋5752绗簩涓猄浠ｈ〃鍒嗛攢鍨嬪彿52P浠ｈ〃鏈52涓帴鍙ｏ紝鍏朵腑P浠ｈ〃鏈4涓浐瀹氫笂琛屽厜鍙I鏄畝鏄撶増鏈殑绯荤粺 鍙﹀闄勪笂LI鐗堟湰鐨勬敮鎸佺壒鎬 缁堜笂鎵杩帮紝s5700s-52p-li杩欏彴...
绛旓細1銆佷互鍗庝负s5700涓轰緥锛屽湪杩涘叆鐢ㄦ埛妯″紡涓嬶紝杈撳叆system-view 杩涘叆閰嶇疆妯″紡銆2銆佽繘鍏ュ瓙鎺ュ彛瑙嗗浘锛屽鍥捐緭鍏nterface GigabitEthernet 0/0/1锛屽叿浣撶鍙ｆ牴鎹疄闄呬慨鏀广3銆佸湪瀛愭帴鍙ｈ鍥句笅锛岃緭鍏ュ懡浠isplay this锛屾煡鐪嬪綋鍓嶇鍙ｉ厤缃紝濡傚浘鎵绀哄叾绔彛妯″紡涓篴ccess銆4銆佽緭鍏ュ懡浠ndo port default vlan锛屾妸绔彛浠庡綋鍓峷lan...
绛旓細鍗庝负S5700涓夊眰浜ゆ崲鏈鍩烘湰閰嶇疆鎸囧崡 涓銆佺綉缁滃熀鏈厤缃 浠婃棩锛屾湁鐢ㄦ埛鍙嶉鍏跺叕鍙告湁涓ゅ彴鏈嶅姟鍣紝鍒嗗埆涓簑eb锛坰erver1锛夊拰ftp锛坰erver2锛夈傚眬鍩熺綉涓瓨鍦ㄤ袱涓綉娈碉紝瑕佹眰杩欎袱涓綉娈甸棿涓嶅彲浜掕锛屼絾閮介渶瑕佽闂畐eb鏈嶅姟鍣紝鍚屾椂涓嶅彲璁块棶ftp鏈嶅姟鍣ㄣ備负瑙ｅ喅姝ら棶棰橈紝鎺ㄨ崘浣跨敤ACL涓夊眰闅旂VLAN鐨勬柟娉曘備互涓嬫槸璇︾粏閰嶇疆姝ラ锛1...
绛旓細S5700 鐨勭鍙ｅ埄鐢ㄧ巼鏈夌偣楂橈紝濡傛灉inbound杈惧埌90% 浠ヤ笂锛宱utbound涔熻揪鍒90%浠ヤ笂锛屽啀鍔犱竴涓鍙ｅ仛涓礋杞戒笉涔呭彲浠ヤ簡涔堬紵
绛旓細鎬庝箞璁剧疆鎵嶈兘涓婄綉骞朵笌10.0.0.0浜掗?闂琛ュ厖:鍗庝负瀹㈡湇缁愮殑鍛戒护锛屼竴鏍锋病鏃㈢劧鏄笁灞浜ゆ崲鏈鐨勮瘽锛屼綘灏辨病蹇呰鍦╲lanif1璁剧疆涓や釜鍦板潃浜嗭紝浣犳妸vlanif1鐨
绛旓細鍗庝负S5700浜ゆ崲鏈閰嶇疆鐨勬柟娉 宸ュ叿/鍘熸枡 浜ゆ崲鏈哄瀷鍙稴5700-48TP-SI Console绾 鏂规硶/姝ラ 閫氳繃Console绾匡紝杩炴帴浜ゆ崲鏈猴紝杩涘叆绯荤粺瑙嗗浘妯″紡 鍦ㄥ懡浠ゆā寮忎笅锛氳緭鍏ワ細systerm-view 杩涘叆绯荤粺瑙嗗浘妯″紡 璁剧疆璁よ瘉妯″紡涓篈AA璁よ瘉妯″紡 鍦ㄧ郴缁熻鍥炬ā寮忓懡浠よ涓嬶細杈撳叆锛 aaa 杩涘叆AAA璁よ瘉妯″紡 娣诲姞杩滅▼鐧婚檰鐢ㄦ埛锛屽苟璁剧疆鐢ㄦ埛瀵嗙爜...
绛旓細鍗庝负浜ゆ崲鏈鍨嬪彿鏈夐偅浜涗竴锛鍗庝负S5700-24TP-SI(AC)浜у搧绫诲瀷锛氬崈鍏嗕互澶綉浜ゆ崲鏈哄簲鐢ㄥ眰绾э細涓夊眰浼犺緭閫熺巼锛10/100/1000Mbps绔彛鏁伴噺锛28涓儗鏉垮甫瀹斤細256GbpsVLAN锛氭敮鎸4K涓猇LAN鏀寔缃戠粶绠＄悊锛氭敮鎸佸爢鍙犳敮鎸丮FF鍖呰浆鍙戠巼锛36MppsMAC鍦板潃琛細16K缃戠粶鏍囧噯锛欼EEE802.3涓嶪EEE8绔彛缁撴瀯锛氶潪妯″潡鍖栦氦鎹㈡柟寮忥細瀛樺偍涓庤浆鍙...
