網(wǎng)絡(luò)拓?fù)浣Y(jié)構(gòu)為:中心交換機(jī)采用Cisco Catalyst 4006-S3，Supervisor Engine III G引擎位于第1插槽，用于實(shí)現(xiàn)三層交換;1塊24口1000Base-T模塊位于第2插槽，用于連接網(wǎng)絡(luò)服務(wù)器;1塊6端口1000Base-X模塊位于第3插槽，用于連接6臺(tái)骨干交換機(jī)。
所有服務(wù)器劃分為一個(gè)VLAN，即VLAN 50。四臺(tái)Catalyst 2950G-24-SMI交換機(jī)也只劃分為一個(gè)VLAN，分別為VLAN 60、VLAN 70、VLAN 80和VLAN 90。Catalyst 3550-24-EMI劃分為4個(gè)VLAN，分別為VLAN 10、VLAN 20、VLAN 30和VLAN 40。Catalyst 3550-24-SMI劃分2個(gè)VLAN，分別為VLAN 60和VLAN 80，與另外兩臺(tái)Catalyst 2950G-24-SMI交換機(jī)分別位于同一VLAN。
(2)實(shí)例分析
由于所有Catalyst 2950G交換機(jī)都是一個(gè)獨(dú)立的VLAN，因此，必須先在這些交換機(jī)上創(chuàng)建VLAN(VLAN 60~VLAN 90)，并將所有端口都指定至該VLAN。然后，再在Catalyst 4006交換機(jī)相應(yīng)端口上分別創(chuàng)建VLAN。Catalyst 4006的1000Base-X端口分別與各Catalyst 2950G的1000Base-X端口連接。其中，GigabitEthernet3/2端口連接至1號(hào)Catalyst 2950交換機(jī)(VLAN 60)，GigabitEthernet3/3端口連接至2號(hào)Catalyst 2950交換機(jī)(VLAN 70)，GigabitEthernet3/4端口連接至3號(hào)Catalyst 2950交換機(jī)(VLAN 80)，GigabitEthernet3/5端口連接至4號(hào)Catalyst 2950交換機(jī)(VLAN 90)，GigabitEthernet3/6端口連接至6號(hào)樓交換機(jī)(VLAN 80)。
由于在Catalyst 3550-24-EMI上劃分有4個(gè)VLAN(VLAN 10～VLAN 40)，而4個(gè)VLAN都需借助于一條1000Base-X鏈路實(shí)現(xiàn)與Catalyst 4006的GigabitEthernet3/1端口連接，因此，必須在Catalyst 4006與Catalyst 3550-24- EMI之間創(chuàng)建一個(gè)Trunk。
同樣，在Catalyst 3550-24-SMI上劃分有2個(gè)VLAN(VLAN 60和VLAN 80)，而4個(gè)VLAN都需借助于一條1000Base-X鏈路實(shí)現(xiàn)與Catalyst 4006的GigabitEthernet3/6端口連接，因此，必須在Catalyst 4006與Catalyst 3550-24- EMI之間創(chuàng)建一個(gè)Trunk。
另外，所有服務(wù)器均連接至Catalyst 4006的1000Base-T模塊，并單獨(dú)成為一個(gè)VLAN(VLAN 90)，因此，也必須為這些交換機(jī)創(chuàng)建一個(gè)VLAN，并將所有端口指定至該VLAN。需要注意的是，考慮到網(wǎng)絡(luò)管理的需要，也可以剩余幾個(gè)RJ-45端口(如21至24端口)不指定至任何VLAN，從而便于連接網(wǎng)絡(luò)管理設(shè)備。默認(rèn)狀態(tài)下，所有端口都屬于VLAN1，而且也只有在VLAN1中才能實(shí)現(xiàn)對(duì)網(wǎng)絡(luò)中所有設(shè)備的管理。
(3)配置清單
●Cisco Catalyst 4006交換機(jī)配置清單
Current configuration : 5594 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
service compress-config
!
hostname hsnc
!
boot system bootflash:cat4000-is-mz.121-8a.EW1.bin
no logging console
enable secret level 1 5 $1$rkQW$1HKyKdN5f.Ri5zxeoF8Yv/
!
ip subnet-zero
!
!
!
interface GigabitEthernet1/1
no snmp trap link-status
!--不為Supervisor Engine III G引擎中的1000Base-X插槽指定VLAN
interface GigabitEthernet1/2
no snmp trap link-status
!
!
interface GigabitEthernet2/1
switchport access vlan 50
no snmp trap link-status
!--將端口GigabitEthernet2/1指定至VLAN 50
!
interface GigabitEthernet2/2
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/3
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/4
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/5
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/6
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/7
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/8
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/9
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/10
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/11
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/12
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/13
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/14
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/15
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/16
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/17
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/18
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/19
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/20
switchport access vlan 50
no snmp trap link-status
!--不將GigabitEthernet2/20～24指定至任何VLAN
!
interface GigabitEthernet3/1
switchport trunk encapsulation dot1q
??！--啟用802.1Q Trunk封裝協(xié)議，即在該端口創(chuàng)建Trunk
switchport trunk allowed vlan 1-80
??！--允許vlan 1-90在該中繼線通訊
?。?-可以拒絕或允許某個(gè)VLAN訪問(wèn)該Trunk
??！--確保未被授權(quán)的VLAN通過(guò)該Trunk，實(shí)現(xiàn)VLAN的訪問(wèn)安全
switchport mode trunk
??！--將該端口設(shè)置為T(mén)runk
description netcenter
no snmp trap link-status
!
interface GigabitEthernet3/2
switchport access vlan 60
no snmp trap link-status
!--將端口GigabitEthernet3/2指定至VLAN 60
!
interface GigabitEthernet3/3
switchport access vlan 70
no snmp trap link-status
!--將端口GigabitEthernet3/3指定至VLAN 70
!
interface GigabitEthernet3/4
switchport access vlan 80
no snmp trap link-status
!--將端口GigabitEthernet3/4指定至VLAN 80
!
interface GigabitEthernet3/5
switchport access vlan 90
no snmp trap link-status
!--將端口GigabitEthernet3/5指定至VLAN 90
!
interface GigabitEthernet3/6
switchport trunk encapsulation dot1q
！--啟用802.1Q Trunk封裝協(xié)議，即在該端口創(chuàng)建Trunk
switchport trunk allowed vlan 1-80
！--允許vlan 1-90在該中繼線通訊
！--可以拒絕或允許某個(gè)VLAN訪問(wèn)該Trunk
！--從而確保未被授權(quán)的VLAN通過(guò)該Trunk，實(shí)現(xiàn)VLAN訪問(wèn)安全
switchport mode trunk
！--將該端口設(shè)置為T(mén)runk
description netcenter
no snmp trap link-status
!
interface Vlan1
description netmanger
no ip address
!
!--對(duì)VLAN1進(jìn)行描述
interface Vlan10
description network center
no ip address
!--對(duì)VLAN2進(jìn)行描述
!
interface Vlan20
description computer center
no ip address
!
interface Vlan30
description network lab
no ip address
!
interface Vlan40
description huaxuelou
no ip address
!
interface Vlan50
description wulilou
no ip address
!
interface Vlan60
description shengwulou
no ip address
!
interface Vlan70
description zhongwenxi
no ip address
!
interface Vlan80
description tushuguan
no ip address
!
!
line con 0
stopbits 1
line vty 0 4
password aaa
login
!
end
●Cisco Catalyst 3550-EMI配置清單
Building configuration...
Current configuration : 4055 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname office
!
enable secret 5 $1$p0fU$JeyPOM0RuL.Fqfe71efHF1
!
ip subnet-zero
!
!
spanning-tree extend system-id
!
!
!
interface FastEthernet0/1
switchport access vlan 10
!--將端口FastEthernet0/1指定至VLAN 10
no ip address
!
interface FastEthernet0/2
switchport access vlan 10
no ip address
!
interface FastEthernet0/3
switchport access vlan 10
no ip address
!
interface FastEthernet0/4
switchport access vlan 10
no ip address
!
interface FastEthernet0/5
switchport access vlan 10
no ip address
!
interface FastEthernet0/6
switchport access vlan 20
no ip address
!--將端口FastEthernet0/6指定至VLAN 20
!
interface FastEthernet0/7
switchport access vlan 20
no ip address
!
interface FastEthernet0/8
switchport access vlan 20
no ip address
!
interface FastEthernet0/9
switchport access vlan 20
no ip address
!
interface FastEthernet0/10
switchport access vlan 20
no ip address
!
interface FastEthernet0/11
switchport access vlan 30
no ip address
!--將端口FastEthernet0/6指定至VLAN 30
!
interface FastEthernet0/12
switchport access vlan 30
no ip address
!
interface FastEthernet0/13
switchport access vlan 30
no ip address
!
interface FastEthernet0/14
switchport access vlan 30
no ip address
!
interface FastEthernet0/15
switchport access vlan 30
no ip address
!
interface FastEthernet0/16
switchport access vlan 30
no ip address
!
interface FastEthernet0/17
switchport access vlan 30
no ip address
!
interface FastEthernet0/18
switchport access vlan 30
no ip address
!
interface FastEthernet0/19
switchport access vlan 40
no ip address
!--將端口FastEthernet0/6指定至VLAN 40
!
interface FastEthernet0/20
switchport access vlan 40
no ip address
!
interface FastEthernet0/21
switchport access vlan 40
no ip address
!
interface FastEthernet0/22
switchport access vlan 30
no ip address
!
interface FastEthernet0/23
switchport access vlan 40
no ip address
!
interface FastEthernet0/24
switchport access vlan 40
no ip address
!
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
??！--啟用802.1Q Trunk封裝協(xié)議，即在該端口創(chuàng)建Trunk
switchport trunk allowed vlan 1-80
！--允許vlan 1-80在該中繼線通訊
switchport mode trunk
！--將該端口設(shè)置為T(mén)runk
no ip address
!
interface GigabitEthernet0/2
no ip address
!
interface Vlan1
ip address 172.16.100.12 255.255.255.0
!--LAN1指定IP地址
no ip route-cache
no ip mroute-cache
!
ip classless
ip http server
!
!
!
!
line con 0
line vty 0 4
password aaa
login
line vty 5 15
login
!
end
●Cisco Catalyst 3550-SMI配置清單
Building configuration...
Current configuration : 4055 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname office
!
enable secret 5 $1$p0fU$JeyPOM0RuL.Fqfe71efHF1
!
ip subnet-zero
!
!
spanning-tree extend system-id
!
!
!
interface FastEthernet0/1
switchport access vlan 60
!--將端口FastEthernet0/1指定至VLAN 60
no ip address
!
interface FastEthernet0/2
switchport access vlan 60
no ip address
!
interface FastEthernet0/3
switchport access vlan 60
no ip address
!
interface FastEthernet0/4
switchport access vlan 60
no ip address
!
interface FastEthernet0/5
switchport access vlan 60
no ip address
!
interface FastEthernet0/6
switchport access vlan 20
no ip address
!--將端口FastEthernet0/6指定至VLAN 20
!
interface FastEthernet0/7
switchport access vlan 20
no ip address
!
interface FastEthernet0/8
switchport access vlan 20
no ip address
!
interface FastEthernet0/9
switchport access vlan 20
no ip address
!
interface FastEthernet0/10
switchport access vlan 20
no ip address
!
interface FastEthernet0/11
switchport access vlan 80
no ip address
!--將端口FastEthernet0/6指定至VLAN 80
!
interface FastEthernet0/12
switchport access vlan 80
no ip address
!
interface FastEthernet0/13
switchport access vlan 80
no ip address
!
interface FastEthernet0/14
switchport access vlan 80
no ip address
!
interface FastEthernet0/15
switchport access vlan 80
no ip address
!
interface FastEthernet0/16
switchport access vlan 80
no ip address
!
interface FastEthernet0/17
switchport access vlan 80
no ip address
!
interface FastEthernet0/18
switchport access vlan 80
no ip address
!
interface FastEthernet0/19
switchport access vlan 80
no ip address
!--將端口FastEthernet0/6指定至VLAN 80
!
interface FastEthernet0/20
switchport access vlan 80
no ip address
!
interface FastEthernet0/21
switchport access vlan 80
no ip address
!
interface FastEthernet0/22
switchport access vlan 80
no ip address
!
interface FastEthernet0/23
switchport access vlan 80
no ip address
!
interface FastEthernet0/24
switchport access vlan 80
no ip address
!
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
！--啟用802.1Q Trunk封裝協(xié)議，即在該端口創(chuàng)建Trunk
switchport trunk allowed vlan 1-80
??！--允許vlan 1-80在該中繼線通訊
switchport mode trunk
?。?-從將該端口設(shè)置為T(mén)runk
no ip address
!
interface GigabitEthernet0/2
no ip address
!
interface Vlan1
ip address 172.16.100.13 255.255.255.0
!--為L(zhǎng)AN1指定IP地址
no ip route-cache
no ip mroute-cache
!
ip classless
ip http server
!
!
!
!
line con 0
line vty 0 4
password aaa
login
line vty 5 15
login
!
end
●Cisco Catalyst 2950G配置清單
四臺(tái)Cisco Catalyst 2950G的配置基本相同，下面僅列出VLAN 60的配置情況。
Building configuration...
Current configuration : 2143 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname msl
!
enable password aaa
!
ip subnet-zero
!
!
spanning-tree extend system-id
!
!
interface FastEthernet0/1
switchport access vlan 60
no ip address
!
interface FastEthernet0/2
switchport access vlan 60
no ip address
!
interface FastEthernet0/3
switchport access vlan 60
no ip address
!
interface FastEthernet0/4
no ip address
!
interface FastEthernet0/5
switchport access vlan 60
no ip address
!
interface FastEthernet0/6
switchport access vlan 60
no ip address
!
interface FastEthernet0/7
switchport access vlan 60
no ip address
!
interface FastEthernet0/8
switchport access vlan 60
no ip address
!
interface FastEthernet0/9
switchport access vlan 60
no ip address
!
interface FastEthernet0/10
switchport access vlan 60
no ip address
!
interface FastEthernet0/11
switchport access vlan 60
no ip address
!
interface FastEthernet0/12
switchport access vlan 60
no ip address
!
interface FastEthernet0/13
switchport access vlan 60
no ip address
!
interface FastEthernet0/14
switchport access vlan 60
no ip address
!
interface FastEthernet0/15
switchport access vlan 60
no ip address
!
interface FastEthernet0/16
switchport access vlan 60
no ip address
!
interface FastEthernet0/17
switchport access vlan 60
no ip address
!
interface FastEthernet0/18
switchport access vlan 60
no ip address
!
interface FastEthernet0/19
switchport access vlan 60
no ip address
!
interface FastEthernet0/20
switchport access vlan 60
no ip address
!
interface FastEthernet0/21
switchport access vlan 60
no ip address
!
interface FastEthernet0/22
switchport access vlan 60
no ip address
!
interface FastEthernet0/23
switchport access vlan 60
no ip address
!
interface FastEthernet0/24
switchport access vlan 60
no ip address
!
interface GigabitEthernet0/1
no ip address
!
interface GigabitEthernet0/2
no ip address
!
interface Vlan1
ip address 172.16.100.10 255.255.255.0
!
ip classless
ip http server
!
!
!
!
line con 0
line vty 0 4
password aaa
login
line vty 5 15
login
!
end
