理论部分:
集线器工作在Layer1
集线器加多扩大冲突域(使其网络速度慢)
交换机(Bridge)的每一个端口都是独立的冲突域,冲突发生在本地
解决上面方案:交换型局域网
Bridge(网桥)逻辑判断转发能力
交换机转发模式:
Cut-through直接转发 转发效率高
Store-and-forward存储转发 整个数据帧存储再转发
Fragment-free 以64字节来判断发送,小于64个字节丢弃
选择交换机的重要条件:看背板带宽
交换机工作原理:学习源MAC地址,未知地址广播,更新时间300S
路由启动步骤
1.开机加电自检 (Power on Self test) 先执行ROM中的程序,对硬件检测的过程。----测试硬件。
2.读取ROM中的 Bootstrap程序进行初步引导。
3.寻找 Cisco IOS 软件.(可能位置包括Flash,TFTP或ROM中的Mini IOS),首先在Flash中查找IOS,如果找到,加载;如果找不到,进入Mini IOS(就相当于PC 的BIOS),使用X-Modem等其它方式上传IOS,加载IOS启动。
4.从NVRAM中寻找Startup-config文件并加载。
5.运行已配置的 Cisco IOS 软件进入
对设备配置的方式
1.Console配置
2.Telnet/Ssh配置
3.Aux借口配置(路由器有交换机没有)
4.TFTP加载配置信息
5.网页或网管工作站对设备调试
CISCO是CLI命令行模式配置和Setup模式
RS232串口
×××单模
橙色单模
DB9-RJ45 -- 转接头
Ctrl-P 调用上次使用的命令
Ctrl-A 最前
Ctrl-E 最后
Show history 查看历史命令
Router>用户模式 - 只能做基本的命令查找
Router#特权模式 - disable 退出到用户模式
详细的检查交换机或路由的配置
对设备进行配置和调试
可以进入其它配置模式
Router(config)#全局
对整个设备有效
Router(config-if)#接口
NVRAM 保存的配置文件,用于启动 Show start
RAM正在运行的配置文件 Show run
Starting-Switch 使用交换机
交换机启动:交换机可以接直流电(电池供电)
检查线缆和Console连接
检查电源线是否正确插好
bps 每秒钟比特率
PPS 每秒钟转发包的数量
LED灯说明
Green 绿色 1
Amber 琥珀色 2
System LED系统指示灯:1 正常工作 2 系统出现问题,自检出现问题
Rps 冗余电源指示 不亮 没安装 1 安装,正常工作 1 闪烁,在供电但是给别的电源供电 2 安装但不能操作 2 闪烁,外接电源失效,现在是备份电源供电
PortStatusLEDs 1 线路正常,没活动流量 2 闪烁, 有活动数据流量 1和蓝 来回闪 有错误数据 2 接口没在转发数据,可能管理接口断掉
MODE(跳过IOS) 密码解除 接电源的一刹那 按住MODE 等待1口灯不亮其它都亮
Router#erase startup-config 清除配置文件
reload 重新加载
使用SSH2版本连接
#hostname R1
#username Chen secret cisco
#ip domain name cisco.com
#crypto key genrate rsa - 512位长度
#ip ssh version 2 开启ssh的版本2
#line vty 0 4
login local
transport input ssh 应用到端口 添加支持的协议,只支持ssh连接
show ip ssh
测试:ssh2版本2连接
where 查看当前连接的用户
查看交换机的MAC地址表:
Switch#show mac-address-table
清除交换机的MAC地址表:
Switch#clear mac-address-table dynamic
配置交换机设备管理地址:
Switch(config)#interface vlan 1
Switch(config-if)#ip address 10.0.0.100 255.0.0.0
Switch(config-if)#no shutdown
配置交换机的网关:
Switch(config)#ip default-gateway 10.0.0.254
加密当前设备的明文密码:
Switch(config)#service password-encryption
配置本地用户信息:
Switch(config)#username 用户名 password 密码
开启使用本地用户数据库的验证:
Switch(config)#line console 0
Switch(config-line)#login local
Switch(config-line)#exit
声明当前接口是个接入型的接口,一般下面连的是路由器或者PC等服务器
Switch(config)#interface f0/1
Switch(config-if)#switchport mode access
打开当前接口的端口安全功能:
Switch(config-if)#switchport port-security
端口安全默认值:
Switch#show port-security interface f0/1
Port Security : Enabled 功能是打开的
Port Status : Secure-up 接口状态
Violation Mode : Shutdown 惩罚措施
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1 最大MAC地址学习数量
Total MAC Addresses : 0 已经学习到的MAC地址数量
Configured MAC Addresses : 0 手工配置的MAC数量
Sticky MAC Addresses : 0 粘连方式的MAC数量
Last Source Address:Vlan : 00E0.A3B2.D4E7:1 最后学习到的MAC地址
Security Violation Count : 0 违规计数
设定当前接口在端口安全的环境下可以学习到的MAC地址数量:
Switch(config-if)#switchport port-security maximum ?
<1-132> Maximum addresses
例:
Switch(config-if)#switchport port-security maximum 5
绑定当前接口下的可以接入设备的MAC地址
Switch(config-if)#switchport port-security mac-address ?
H.H.H 48 bit mac address
例:
Switch(config-if)#switchport port-security mac-address 00E0.A3B2.D4E7
配置端口安全粘连:
Switch(config-if)#switchport port-security mac-address sticky
例:
interface FastEthernet0/1
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security mac-address sticky 000A.41BB.47DA
同时关闭多个端口:
Switch(config)#interface range f0/6 - 24
Switch(config-if-range)#shutdown
Switch(config)#interface range f0/1 , f0/3 , f0/5 - 9 , f0/19 - 24
Switch(config-if-range)#shutdown
端口安全:
switchport mode access
switchport port-security
switchport port-security maxinum 1
switchport port-security mac-address MAC地址
switchport port-security violation protect拒绝违规放行其它 restrict发送网管消息报告 shutdown进入一个(err-disable)状态 执行违反操作
1.
恢复违规操作
shutdown
no shutdown
2.
errdisable revocery cause psecure-violation
errdisable recovery interval 300 从err-disable30S自动恢复
switchport port-security
switchport port-security mac-address stitcky 黏性记录地址
show port-security/address
不使用的接口shutdown
交换机的微分段功能// HUB 半双工 // SWITCH 全双工
interface fa0/0
duplex {auto | full | half} 双工
speed {10 | 100 | 100 | auto} 速率
层次化设计!!
核心层
汇聚层
接入层
2层出现环和广播风暴 没办法对数据处理 除非资源用完
冗余引起的环,STP(spanning-tree protocol)生成树解决
3层出现环可以看TTL值
F0/0 up,物理的问题 line protocol is up逻辑的问题
input errors错误信息记录总数 CRC错误 帧错误 过载 拒绝 丢弃等等
output errors超出数据承载能力
collisions 检测以太网冲突数据重传次数
restarts 因为过多错误硬件以太网控制器重启次数
CRC错误多代表干扰多,过多噪音
解决检查线缆是否有干扰,线缆质量
很多冲突
检查线缆问题,时域反射器(TDR)检测线缆的
设备或电路出现大量错误
已经出去的数据,才检测到冲突,就不重传
网络太多集线器造成,介质距离太远
双工问题:
一端全双工一端半双工
一端全双工一端auto
一端半双工一端auto OK
两头都设置auto
Gbit 失败全双工 10/100 失败半双工
speed速率:
一端设置一个速度另一端设置另一个速度
一端为高速度一端为auto, auto失败位低速度
两端为auto,失败位低速率
无线局域网:
无线用CSMA/CA 独立的信令
无线接入采用半双工
AP(Access points)无线接入点
无线标准
ITU国际电信联盟
IEEE电子电气工程师协会
Wi-Fi组织 无线认证的
无线802.11标准
802.11b 2.4GHz Date rates 1,2,5.5,11
802.11a 5GHz Date rates 6,9,12,18,24,36,48,54
801.11g 2.4GHz Date rates 1,2,5.5,11;6,9,12,18,24,36,48,54
数据保密性 完整性 不可否认性
安全加密手段:
WEP容易破解 97year
802.1x EAP认证 配合AAA服务器
WPA 2003
802.11i/WPA2 2004
无线部署模式:
IBSS 点点
BSS 单AP
ESS 多AP
无线漫游:二层多漫游相同SSID
无线配置实作:
Switch#conf t
Switch(config)#hostname CCNA
CCNA(config)#enable secret cisco
CCNA(config)#line console 0
CCNA(config-line)#password cisco
CCNA(config-line)#login
CCNA(config-line)#line vty 0 4
CCNA(config-line)#password cisco
CCNA(config-line)#login
CCNA(config-line)#exit
CCNA(config)#banner motd #
Enter TEXT message. End with the character '#'.
It's my first LAB
#
CCNA(config)#interface vlan 1
CCNA(config-if)#description Managment
CCNA(config-if)#ip add 172.16.1.1 255.255.255.0
CCNA(config-if)#no shut
实验部分:
enable
configure terminal
no ip domain lookup
line con 0
exec-timeout 0 0
logging synchronous
exit
hostname R1
setup 特权命令
检查配置情况的 特权模式的命令 show running-config
可以在全局模式调用特权模式的命令 在既有的命令前面加上do
show running-config 显示当前设备运行中的配置信息
show startup-config 显示我们保存在设备上的配置信息
保存配置的命令:
方法1:
R1#copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
方法2:
R1#write
Building configuration...
[OK]
给设备起名字:全局模式
hostname R1(设备名称)
配置用户登录时看的欢迎词:全局命令
banner motd /(中断字符)
例:
R1(config)#banner motd /
Enter TEXT message. End with the character '/'.
welcome!@$*()$)ERYUIOPDFHJKLCVBM<JKL
exit
quit
/
配置控制台登录密码:全局配置
R1(config)#line console 0
R1(config-line)#password cisco
R1(config-line)#login
配置虚拟控制台远程登录密码:全局配置
R1(config)#line vty 0 4
R1(config-line)#password cisco
R1(config-line)#login
注:使用telnet等远程管理方式登录设备时,必须配置enable密码,否则不能进入特权模式。
配置我们从用户模式进入特权模式时需要输入的特权密码:全局配置
明文方式:enable password cisco
密文方式:enable secret cisco123
2个同时配置,则密文的有效
使用用户名+密码的方式验证:全局配置模式
定义本地用户数据库
username ccna password cisco
启用验证:
Router(config)#line vty 0 4
Router(config-line)#login local
Router(config-line)#exit
连接空闲超时:默认10分钟
Router(config)#line vty 0 4
Router(config-line)#exec-timeout 0 30
查看当前设备接口:
R1#show ip interface brief
配置接口:全局配置
R1(config)#interface f0/0
R1(config-if)#description TO_beijing 注释
R1(config-if)#ip address 10.0.0.1 255.0.0.0 配置接口地址
R1(config-if)#no shutdown 启用接口
CDP、远程管理
关闭当前设备的CDP功能:
Switch(config)#no cdp run
Switch#show cdp
% CDP is not enabled
关闭某一个特定接口的CDP:
Switch(config)#interface f0/1
Switch(config-if)#no cdp enable
开启某台设备的CDP功能
Switch(config)#cdp run
查看命令:
Switch#show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
R5 Fas 0/5 126 R C2600 Fas 0/0
SW2 Fas 0/2 132 S 2960 Fas 0/1
R6 Fas 0/4 148 R C2800 Fas 0/0
R3 Fas 0/3 150 R C1841 Fas 0/0
R4 Fas 0/6 164 R C2600 Fas 0/0
Switch#show cdp entry SW2
Device ID: SW2
Entry address(es):
IP address : 10.0.0.2
Platform: cisco 2960, Capabilities: Switch
Interface: FastEthernet0/2, Port ID (outgoing port): FastEthernet0/1
Holdtime: 179
Version :
Cisco IOS Software, C2960 Software (C2960-LANBASE-M), Version 12.2(25)FX, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Wed 12-Oct-05 22:05 by pt_team
advertisement version: 2
Duplex: full
---------------------------
远程登录设备:
Telnet x.x.x.x (设备地址)
设备切换:
按住ctrl+shift+6 然后松开,再按x
查看已经登录的设备回话列表:
R3#show sessions
Conn Host Address Byte Idle Conn Name
* 1 10.0.0.5 10.0.0.5 0 2 10.0.0.5
重新进入已经登录过的回话:
使用show sessions命令中Conn项目里的连接号登陆
例:
R3#show sessions
Conn Host Address Byte Idle Conn Name
* 1 10.0.0.5 10.0.0.5 0 2 10.0.0.5
R3#1
[Resuming connection 1 to 10.0.0.5 ... ]
R5>
关闭连接到某台设备的管理会话:
disconnect命令+连接号
R3#show sessions
Conn Host Address Byte Idle Conn Name
* 1 10.0.0.5 10.0.0.5 0 2 10.0.0.5
R3#disconnect 1
Closing connection to 10.0.0.5 [confirm]
R3#sh sess
R3#sh sessions
% No connections open
查看有谁登陆到当前设备了:
cisco2821#sh users
Line User Host(s) Idle Location
* 0 con 0 idle 00:00:00
514 vty 0 idle 00:02:15 172.16.18.251
Interface User Mode Idle Peer Address
踢掉某一个用户:
cisco2821#clear line 514
[confirm]
[OK]
路由器维护
路由器操作系统的备份:
数据源路由器,数据目的远程服务器,确保他们之间的连通性
Router#copy flash: tftp:
Source filename []? c1841-advipservicesk9-mz.124-15.T1.bin
Address or name of remote host []? 10.0.0.2
Destination filename [c1841-advipservicesk9-mz.124-15.T1.bin]?
Writing n...!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK - 33591768 bytes]
33591768 bytes copied in 18.157 secs (1850000 bytes/sec)
路由器操作系统的升级:
数据源远程服务器,数据目的路由器,确保他们之间的连通性
Router#copy tftp: flash:
Address or name of remote host []? 10.0.0.2
Source filename []? c1841-ipbasek9-mz.124-12.bin
Destination filename [c1841-ipbasek9-mz.124-12.bin]?
Accessing tftp://10.0.0.2/c1841-ipbasek9-mz.124-12.bin...
Loading c1841-ipbasek9-mz.124-12.bin from 10.0.0.2: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK - 16599160 bytes]
16599160 bytes copied in 9.296 secs (399554 bytes/sec)
多操作系统的时候,定义使用哪个IOS:
Router(config)#boot system flash c1841-advipservicesk9-mz.124-15.T1.bin
R4(config)#boot system ?
WORD TFTP filename or URL
flash Boot from flash memory
ftp Boot from a server via ftp
mop Boot from a Decnet MOP server
rcp Boot from a server via rcp
rom Boot from rom
tftp Boot from a tftp server
使用FTP传输IOS:copy flash: ftp://用户名:密码@10.0.0.2
R4#copy flash: ftp://111:123456@10.0.0.2
Source filename []? c1841-adventerprisek9-mz.124-22.T.bin
Address or name of remote host [10.0.0.2]?
Destination filename [c1841-adventerprisek9-mz.124-22.T.bin]?
Writing c1841-adventerprisek9-mz.124-22.T.bin !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
39542540 bytes copied in 49.948 secs (791674 bytes/sec)
TFTP文件传输后的效验:
R4#verify /md5 flash:c1841-adventerprisek9-mz.124-22.T.bin
..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Done!
verify /md5 (flash:c1841-adventerprisek9-mz.124-22.T.bin) = 791abd1a5eebae55ef4a9e5034ad0b3a
IOS恢复:
rommon 3 > tftpdnld
Missing or illegal ip address for variable IP_ADDRESS
Illegal IP address.
usage: tftpdnld [-hr]
Use this command for disaster recovery only to recover an p_w_picpath via TFTP.
Monitor variables are used to set up parameters for the transfer.
(Syntax: "VARIABLE_NAME=value" and use "set" to show current variables.)
"ctrl-c" or "break" stops the transfer before flash erase begins.
The following variables are REQUIRED to be set for tftpdnld:
IP_ADDRESS: The IP address for this unit
IP_SUBNET_MASK: The subnet mask for this unit
DEFAULT_GATEWAY: The default gateway for this unit
TFTP_SERVER: The IP address of the server to fetch from
TFTP_FILE: The filename to fetch
The following variables are OPTIONAL:
TFTP_VERBOSE: Print setting. 0=quiet, 1=progress(default), 2=verbose
TFTP_RETRY_COUNT: Retry count for ARP and TFTP (default=18)
TFTP_TIMEOUT: Overall timeout of operation in seconds (default=7200)
TFTP_CHECKSUM: Perform checksum test on p_w_picpath, 0=no, 1=yes (default=1)
FE_PORT: 0= (default), 1
FE_SPEED_MODE: 0=10/hdx, 1=10/fdx, 2=100/hdx, 3=100/fdx,
4=Auto (default)
TFTP_DESTINATION: The flash destination device for the file
flash:(default), usbflash0:
Command line options:
-h: this help screen
-r: do not write flash, load to DRAM only and launch p_w_picpath
IP_ADDRESS=10.0.0.1 声明设备的IP地址
IP_SUBNET_MASK=255.255.255.0 声明设备的子网掩码
DEFAULT_GATEWAY=10.0.0.1 声明外部通信的网关
TFTP_SERVER=10.0.0.2 tftp服务器的地址
TFTP_FILE=c1841-adventerprisek9-mz.124-22.T.bin 文件名
rommon 37 > tftpdnld
IP_ADDRESS: 10.0.0.1
IP_SUBNET_MASK: 255.255.255.0
DEFAULT_GATEWAY: 10.0.0.1
TFTP_SERVER: 10.0.0.2
TFTP_FILE: c1841-adventerprisek9-mz.124-22.T.bin
TFTP_MACADDR: 00:1b:d5:80:d1:42
TFTP_VERBOSE: Progress
TFTP_RETRY_COUNT: 18
TFTP_TIMEOUT: 7200
TFTP_CHECKSUM: Yes
FE_PORT: 0
FE_SPEED_MODE: Auto Detect
Invoke this command for disaster recovery only.
WARNING: all existing data in all partitions on flash: will be lost!
Do you wish to continue? y/n: [n]: y
.
Receiving c1841-adventerprisek9-mz.124-22.T.bin from 10.0.0.2 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
File reception completed.
Validating checksum.
Copying file c1841-adventerprisek9-mz.124-22.T.bin to flash:.
program load complete, entry point: 0x8000f000, size: 0xcb80
Format: Drive communication & 1st Sector Write OK...
Writing Monlib sectors.
.......................................................................................................
Monlib write complete
Format: All system sectors written. OK...
Format: Operation completed successfully.
Format of flash: complete
program load complete, entry point: 0x8000f000, size: 0xcb80
备份当前设备的配置到远程服务器:
R1#copy running-config tftp:
Address or name of remote host []? 10.0.0.2
Destination filename [R1-confg]?
Writing running-config...!!
[OK - 456 bytes]
456 bytes copied in 0.062 secs (7000 bytes/sec)