项目一
简介:
isolate-user-vlan是华为公司系列以太网交换机的一个特性,通过该特性可实
现网络中 VLAN资源的节约。isolate-user-vlan采用二层 VLAN结构,在一台
以太网交换机上设置 isolate-user-vlan和 Secondary VLAN两类 VLAN。一个
isolate-user-vlan和多个 Secondary VLAN对应,isolate-user-vlan包含所对
应的所有 Secondary VLAN 中包含的端口和上行端口,这样对上层交换机来
说,只须识别下层交换机中的 isolate-user-vlan,而不必关心 isolate-user-vlan
中包含的 Secondary VLAN,简化了网络配置,节省了 VLAN 资源。同时,
用户可以采用 isolate-user-vlan实现二层报文的隔离,即为每个用户分配一个
Secondary VLAN,每个 Secondary VLAN中只包含该用户连接的端口和上行
端口;如果希望实现用户之间二层报文的互通,只要将这些用户连接的端口
划入同一个 Secondary VLAN中即可。
![isolate-user-vlan的配置_isolate-user-vlan](https://s2.51cto.com/attachment/201212/115137741.png?x-oss-process=image/resize,m_fixed,w_1184)
设备:华为三层交换机2台,2台pc
要求:
1. 在sw1上架设Dhcp服务器
2. 在sw2上实现Dhcp中继
3. 在sw2上应用隔离vlan技术
主要代码
Sw1交换机配置
架设服务器
[dhcp-server]dhcp enable
[dhcp-server]dhcp server ip-pool xxx
[dhcp-server-dhcp-xxx]network 192.168.10.0
[dhcp-server-dhcp-xxx]gateway-list 192.168.10.254
[dhcp-server-dhcp-xxx]dns-list 222.88.88.88
[dhcp-server]inter vlan 1
[dhcp-server-Vlan-interface1]ip add 192.168.10.254 255.255.255.0
Sw2交换机的配置
Vlan的隔离配置
[sw2]vlan 100
[sw2-vlan100]isolate-user-vlan enable
[sw2-vlan100]q
[sw2-vlan100]inter e0/1
[sw2-Ethernet0/1]port access vlan 100
[sw2]vlan 10
[sw2-vlan10]q
[sw2]vlan 20
[sw2-vlan20]q
[sw2]inter e0/10
[sw2-Ethernet0/10]port access vlan 10
[sw2]inter e0/20
[sw2-Ethernet0/20]port access vlan 20
[sw2-Ethernet0/1]q
[sw2]isolate-user-vlan 100 secondary 10 20
查看隔离结果
![isolate-user-vlan的配置_isolate-user-vlan_02](https://s2.51cto.com/attachment/201212/114444323.png?x-oss-process=image/resize,m_fixed,w_1184)
为使主机得到ip地址,实现Dhcp中继
[sw2]dhcp select relay all
[sw2]inter vlan 10
[sw2-Vlan-interface10]ip relay address 192.168.10.254
[sw2-Vlan-interface10]inter vlan 20
[sw2-Vlan-interface20]ip relay address 192.168.10.254
使用pc1和pc2自动获得地址
![isolate-user-vlan的配置_华为_03](https://s2.51cto.com/attachment/201212/114606379.png?x-oss-process=image/resize,m_fixed,w_1184)
![isolate-user-vlan的配置_isolate-user-vlan_04](https://s2.51cto.com/attachment/201212/114553137.png?x-oss-process=image/resize,m_fixed,w_1184)
pc1 ping pc2
![isolate-user-vlan的配置_isolate-user-vlan_05](https://s2.51cto.com/attachment/201212/114521912.png?x-oss-process=image/resize,m_fixed,w_1184)
以上两图证明自动获得地址DHCP中继成功及isolate-user-vlan实现成功。