映射trunk端口

i目录1VLAN映射·1-11.
1VLAN映射简介·1-11.
1.
1VLAN映射的应用1-11.
1.
2VLAN映射实现方式1-21.
2配置VLAN映射·1-41.
3VLAN映射显示和维护·1-61.
41:1和N:1VLAN映射配置举例·1-61-11VLAN映射1.
1VLAN映射简介VLAN映射(VLANMapping)也叫做VLAN转换(VLANTranslation),它可以修改报文携带的VLANTag,实现不同VLANID之间的相互转换.
目前设备提供下面两种映射关系:1:1VLAN映射:将来自某一特定VLAN的报文所携带的VLANTag替换为新的VLANTag.
N:1VLAN映射:将来自多个VLAN的报文所携带的不同VLANTag替换为相同的VLANTag.
1.
1.
1VLAN映射的应用1:1和N:1VLAN映射的应用环境如图1-1所示,小区实现宽带上网业务.
图1-11:1和N:1VLAN映射应用示意图VLAN101~102->VLAN501VLAN201~202->VLAN502VLAN301~302->VLAN503汇聚层网络DHCPclientDHCPserverVLAN1->VLAN101VLAN2->VLAN201VLAN3->VLAN301VLAN1->VLAN102VLAN2->VLAN202VLAN3->VLAN302PCVoDVoIPVLAN2VLAN1VLAN3PCVoDVoIPVLAN2VLAN1VLAN3VLAN1->VLAN199VLAN2->VLAN299VLAN3->VLAN399VLAN1->VLAN200VLAN2->VLAN300VLAN3->VLAN400PCVoDVoIPVLAN2VLAN1VLAN3PCVoDVoIPVLAN2VLAN1VLAN3VLAN199~200->VLAN501VLAN299~300->VLAN502VLAN399~400->VLAN5031-2在图1-1中,进行了如下网络规划:在家庭网关上,分别将电脑上网(PC)、视频点播(VoD)和语音电话(VoIP)业务依次划分到不同VLAN.
在楼道交换机上,为了隔离不同家庭的同类业务,需要将每个家庭的每种业务都划分到不同的VLAN,即进行1:1VLAN映射,这就要用到大量的VLAN.
在园区交换机上,因为汇聚层网络接入设备可提供的VLAN数量有限,为了节省VLAN资源,需要进行VLAN的汇聚,将所有家庭的同类业务都划分到相同的VLAN,即进行N:1VLAN映射.
1.
1.
2VLAN映射实现方式如图1-2所示,VLAN映射有如下相关概念:上行数据流:从用户网络发往汇聚层网络或SP网络的数据流.
下行数据流:从汇聚层网络或SP网络发往用户网络的数据流.
上行端口:发送上行数据流和接收下行数据流的端口.
下行端口:发送下行数据流和接收上行数据流的端口.
CVLAN:ClientVLAN.
SVLAN:ServerVLAN.
图1-2VLAN映射相关概念示意图1-31.
1:1VLAN映射实现方式图1-31:1VLAN映射实现方式示意图如图1-3所示,1:1VLAN映射的实现方式如下:对于上行数据流,通过在下行端口配置用户侧1:1VLAN映射,设备将上行数据流的CVLAN的VLANTag替换为SVLAN的VLANTag.
对于下行数据流,通过在上行端口上配置网络侧1:1VLAN映射,设备查找DHCPSnooping表项,将下行数据流的SVLAN的VLANTag替换为CVLAN的VLANTag.
有关DHCPSnooping的详细介绍,请参见"三层技术-IP业务配置指导"中的"DHCP".
2.
N:1VLAN映射实现方式图1-4N:1VLAN映射实现方式示意图如图1-4所示,N:1VLAN映射的实现方式如下:对于上行数据流,通过在下行端口上配置用户侧N:1VLAN映射,设备将来自多个CVLAN的报文所携带的不同VLANTag都替换为同一个SVLAN的VLANTag.
对于下行数据流,通过在上行端口上配置网络侧N:1VLAN映射,设备查找DHCPSnooping表项,将报文中SVLAN的VLANTag替换为CVLAN的VLANTag.
有关DHCPSnooping的详细介绍,请参见"三层技术-IP业务配置指导"中的"DHCP".
1-41.
2配置VLAN映射在图1-1所示的组网中,需要完成以下配置:在楼道交换机上配置1:1VLAN映射,以便将不同用户的不同业务用不同的VLAN进行隔离;在园区交换机上配置N:1VLAN映射,以便将不同用户的相同业务用同一个VLAN进行发送,从而节省VLAN资源.
1.
配置任务简介在配置VLAN映射前,需要先创建好原始VLAN和转换后VLAN.
配置VLAN映射时,需要注意:设备同一端口上,不能同时配置VLAN映射和QinQ.
有关QinQ的详细介绍,请参见"二层技术-以太网交换"中的"QinQ".
若用户同时通过配置VLAN映射和QoS策略来修改或添加报文的VLANTag,且配置冲突时,QoS策略的配置生效.
有关QoS策略的详细介绍,请参见"ACL和QoS配置指导"中的"QoS".
VLAN映射配置中,DHCPSnooping相关命令的详细介绍,请参见"三层技术-IP业务命令参考"中的"DHCP";ARPDetection相关命令的详细介绍,请参见"安全命令参考"中的"ARP攻击防御".
表1-1VLAN映射配置任务简介配置任务说明详细配置使能DHCPSnooping功能必选2.
使能ARPDetection功能必选3.
配置下行端口必选4.
配置上行端口必选5.
2.
使能DHCPSnooping功能表1-2使能DHCPSnooping功能操作命令说明进入系统视图system-view-使能DHCPSnooping功能dhcp-snooping缺省情况下,DHCPSnooping功能处于关闭状态3.
使能ARPDetection功能请在所有需要进行映射的VLAN(包括原始VLAN和转换后VLAN)上都使能ARPDetection功能.
表1-3使能ARPDetection功能操作命令说明进入系统视图system-view-进入VLAN视图vlanvlan-id-使能ARPDetection功能arpdetectionenable缺省情况下,ARPDetection功能处于关闭状态1-54.
配置下行端口表1-4配置下行端口操作命令说明进入系统视图system-view-进入二层以太网接口视图interfaceinterface-typeinterface-number-配置端口链路类型配置端口的链路类型为Trunk类型portlink-typetrunk二者必选其一缺省情况下,所有端口的链路类型均为Access类型配置端口的链路类型为Hybrid类型portlink-typehybrid配置允许原始VLAN及转换后VLAN通过当前端口porttrunkpermitvlanvlan-id-list二者必选其一缺省情况下,Trunk端口只允许VLAN1通过;Hybrid端口只允许VLAN1的报文以Untagged方式通过porthybridvlanvlan-id-listtagged配置用户侧1:1VLAN映射vlanmappingunisinglevlan-idtranslated-vlanvlan-id二者必选其一缺省情况下,接口上未配置VLAN映射配置用户侧N:1VLAN映射vlanmappingunirangevlan-range-listtranslated-vlanvlan-id5.
配置上行端口表1-5配置上行端口操作命令说明进入系统视图system-view-进入二层以太网接口视图interfaceinterface-typeinterface-number-配置端口链路类型配置端口的链路类型为Trunk类型portlink-typetrunk二者必选其一缺省情况下,所有端口的链路类型均为Access类型配置端口的链路类型为Hybrid类型portlink-typehybrid配置允许转换后VLAN通过当前端口porttrunkpermitvlanvlan-id-list二者必选其一缺省情况下,Trunk端口只允许VLAN1通过;Hybrid端口只允许VLAN1的报文以Untagged方式通过porthybridvlanvlan-id-listtagged配置端口为DHCP信任端口dhcp-snoopingtrust缺省情况下,在使能DHCPSnooping功能后,设备上所有支持DHCPSnooping功能的端口均为不信任端口配置端口为ARP信任端口arpdetectiontrust缺省情况下,接口为ARP非信任接口配置网络侧VLAN映射vlanmappingnni缺省情况下,接口上未配置VLAN映射1-61.
3VLAN映射显示和维护在完成上述配置后,在任意视图下执行display命令可以显示配置后VLAN映射的运行情况,通过查看显示信息验证配置的效果.
表1-6VLAN映射显示和维护操作命令显示VLAN映射信息displayvlanmapping[|{begin|exclude|include}regular-expression]1.
41:1和N:1VLAN映射配置举例1.
组网需求在某小区,服务提供商为每个家庭都提供了PC、VoD和VoIP这三种数据服务,每个家庭都通过各自的家庭网关接入楼道交换机,并通过DHCP方式自动获取IP地址.
服务提供商希望实现以下网络规划:在家庭网关上,分别将PC、VoD和VoIP业务依次划分到VLAN1~3;在楼道交换机上,为了隔离不同家庭的同类业务,将每个家庭的每种业务都划分到不同的VLAN;而在园区交换机上,为了节省VLAN资源,将所有家庭的同类业务都划分到相同的VLAN,即分别将PC、VoD和VoIP业务依次划分到VLAN501~503.
1-72.
组网图图1-51:1和N:1VLAN映射配置组网图3.
配置步骤(1)配置SwitchA#开启全局的DHCPSnooping功能.
system-view[SwitchA]dhcp-snooping#创建原始VLAN和转换后VLAN,并开启上行端口VLAN内ARP检测功能.
[SwitchA]vlan1to3Pleasewait.
.
.
Done.
[SwitchA]vlan101VLAN101~102->VLAN501VLAN201~202->VLAN502VLAN301~302->VLAN503汇聚层网络DHCPclientDHCPserverVLAN1->VLAN101VLAN2->VLAN201VLAN3->VLAN301VLAN1->VLAN102VLAN2->VLAN202VLAN3->VLAN302PCVoDVoIPVLAN2VLAN1VLAN3PCVoDVoIPVLAN2VLAN1VLAN3VLAN1->VLAN199VLAN2->VLAN299VLAN3->VLAN399VLAN1->VLAN200VLAN2->VLAN300VLAN3->VLAN400PCVoDVoIPVLAN2VLAN1VLAN3PCVoDVoIPVLAN2VLAN1VLAN3VLAN199~200->VLAN501VLAN299~300->VLAN502VLAN399~400->VLAN503SwitchASwitchBSwitchCGE1/0/1GE1/0/2GE1/0/1GE1/0/2GE1/0/1GE1/0/2GE1/0/3GE1/0/11-8[SwitchA-vlan101]arpdetectionenable[SwitchA-vlan101]vlan102[SwitchA-vlan102]arpdetectionenable[SwitchA-vlan102]vlan201[SwitchA-vlan201]arpdetectionenable[SwitchA-vlan201]vlan202[SwitchA-vlan202]arpdetectionenable[SwitchA-vlan202]vlan301[SwitchA-vlan301]arpdetectionenable[SwitchA-vlan301]vlan302[SwitchA-vlan302]arpdetectionenable[SwitchA-vlan302]quit#配置下行端口GigabitEthernet1/0/1和GigabitEthernet1/0/2为Trunk端口且允许原始VLAN及转换后VLAN通过,同时在端口上配置1:1VLAN映射.
system-view[SwitchA]interfaceGigabitEthernet1/0/1[SwitchA-GigabitEthernet1/0/1]portlink-typetrunk[SwitchA-GigabitEthernet1/0/1]porttrunkpermitvlan123101201301[SwitchA-GigabitEthernet1/0/1]vlanmappingunisingle1translated-vlan101[SwitchA-GigabitEthernet1/0/1]vlanmappingunisingle2translated-vlan201[SwitchA-GigabitEthernet1/0/1]vlanmappingunisingle3translated-vlan301[SwitchA-GigabitEthernet1/0/1]quit[SwitchA]interfaceGigabitEthernet1/0/2[SwitchA-GigabitEthernet1/0/2]portlink-typetrunk[SwitchA-GigabitEthernet1/0/2]porttrunkpermitvlan123102202302[SwitchA-GigabitEthernet1/0/2]vlanmappingunisingle1translated-vlan102[SwitchA-GigabitEthernet1/0/2]vlanmappingunisingle2translated-vlan202[SwitchA-GigabitEthernet1/0/2]vlanmappingunisingle3translated-vlan302[SwitchA-GigabitEthernet1/0/2]quit#配置上行端口GigabitEthernet1/0/3为Trunk端口,且允许转换后VLAN通过,并配置该端口为DHCPSnooping信任端口和ARP信任端口.
[SwitchA]interfaceGigabitEthernet1/0/3[SwitchA-GigabitEthernet1/0/3]portlink-typetrunk[SwitchA-GigabitEthernet1/0/3]porttrunkpermitvlan101201301102202302[SwitchA-GigabitEthernet1/0/3]dhcp-snoopingtrust[SwitchA-GigabitEthernet1/0/3]arpdetectiontrust#在上行端口GigabitEthernet1/0/3上配置网络侧VLAN映射.
[SwitchA-GigabitEthernet1/0/3]vlanmappingnni[SwitchA-GigabitEthernet1/0/3]quit(2)配置SwitchBSwitchB的配置与SwitchA相似,配置过程略.
(3)配置SwitchC#开启全局的DHCPSnooping功能.
[SwitchC]dhcp-snooping#创建原始VLAN和转换后VLAN,并开启上行端口VLAN内ARP检测功能.
[SwitchC]vlan101to1021-9Pleasewait.
.
.
Done.
[SwitchC]vlan201to202Pleasewait.
.
.
Done.
[SwitchC]vlan301to302Pleasewait.
.
.
Done.
[SwitchC]vlan199to200Pleasewait.
.
.
Done.
[SwitchC]vlan299to300Pleasewait.
.
.
Done.
[SwitchC]vlan399to400Pleasewait.
.
.
Done.
[SwitchC]vlan501[SwitchC-vlan501]arpdetectionenable[SwitchC-vlan501]vlan502[SwitchC-vlan502]arpdetectionenable[SwitchC-vlan502]vlan503[SwitchC-vlan503]arpdetectionenable[SwitchC-vlan503]quit#配置下行端口GigabitEthernet1/0/1和GigabitEthernet1/0/2为Trunk端口且允许原始VLAN及转换后VLAN通过,同时在端口上配置N:1VLAN映射.
[SwitchC]interfaceGigabitEthernet1/0/1[SwitchC-GigabitEthernet1/0/1]portlink-typetrunk[SwitchC-GigabitEthernet1/0/1]porttrunkpermitvlan101102201202301302501to503[SwitchC-GigabitEthernet1/0/1]vlanmappingunirange101to102translated-vlan501[SwitchC-GigabitEthernet1/0/1]vlanmappingunirange201to202translated-vlan502[SwitchC-GigabitEthernet1/0/1]vlanmappingunirange301to302translated-vlan503[SwitchC-GigabitEthernet1/0/1]quit[SwitchC]interfaceGigabitEthernet1/0/2[SwitchC-GigabitEthernet1/0/2]portlink-typetrunk[SwitchC-GigabitEthernet1/0/2]porttrunkpermitvlan199200299300399400501to503[SwitchC-GigabitEthernet1/0/2]vlanmappingunirange199to200translated-vlan501[SwitchC-GigabitEthernet1/0/2]vlanmappingunirange299to300translated-vlan502[SwitchC-GigabitEthernet1/0/2]vlanmappingunirange399to400translated-vlan503[SwitchC-GigabitEthernet1/0/2]quit#配置端口GigabitEthernet1/0/3为Trunk端口且允许转换后VLAN通过,并配置该端口为DHCPSnooping信任端口和ARP信任端口.
[SwitchC-GigabitEthernet1/0/3]portlink-typetrunk[SwitchC-GigabitEthernet1/0/3]porttrunkpermitvlan501to503[SwitchC-GigabitEthernet1/0/3]dhcp-snoopingtrust[SwitchC-GigabitEthernet1/0/3]arpdetectiontrust#在上行端口GigabitEthernet1/0/3上配置网络侧N:1VLAN映射.
[SwitchC-GigabitEthernet1/0/3]vlanmappingnni[SwitchC-GigabitEthernet1/0/3]quit(4)配置SwitchD#配置端口GigabitEthernet1/0/1为Trunk端口且允许转换后VLAN通过.
system-view[SwitchD]vlan501to5031-10Pleasewait.
.
.
Done.
[SwitchD]interfaceGigabitEthernet1/0/1[SwitchD-GigabitEthernet1/0/1]portlink-typetrunk[SwitchD-GigabitEthernet1/0/1]porttrunkpermitvlan501to503[SwitchD-GigabitEthernet1/0/1]quit4.
验证配置(1)查看SwitchA上的VLAN映射配置信息[SwitchA]displayvlanmappingInterfaceGigabitEthernet1/0/1:OuterVLANInnerVLANTranslatedOuterVLANTranslatedInnerVLANN/A1N/A101N/A2N/A201N/A3N/A301InterfaceGigabitEthernet1/0/2:OuterVLANInnerVLANTranslatedOuterVLANTranslatedInnerVLANN/A1N/A102N/A2N/A202N/A3N/A302(2)查看SwitchB上的VLAN映射配置信息SwitchB上的VLAN映射配置信息与SwitchA相似,显示信息略.
(3)查看SwitchC上的VLAN映射配置信息[SwitchC]displayvlanmappingInterfaceGigabitEthernet1/0/1:OuterVLANInnerVLANTranslatedOuterVLANTranslatedInnerVLANN/A101-102N/A501N/A201-202N/A502N/A301-302N/A503InterfaceGigabitEthernet1/0/2:OuterVLANInnerVLANTranslatedOuterVLANTranslatedInnerVLANN/A199-200N/A501N/A299-300N/A502N/A399-400N/A503以上信息表明,SwitchA和SwitchB上的1:1VLAN映射,以及SwitchC上的N:1VLAN映射配置成功.