网络基本情况
网络拓扑结构为:中心交换机采用Cisco Catalyst 4006-S3，
Supervisor Engine III G引擎位于第1插槽，用于实现三层交换;1块24口
1000Base-T模块位于第2插槽，用于连接网络服务器;1块6端口1000Base-X模块位
于第3插槽，用于连接6台骨干交换机。一台交换机采用Cisco Catalyst 3550-
24-EMI，并安装1块1000Base-X GBIC千兆模块。一台交换机采用Cisco
Catalyst 3550-24-SMI，也安装1块1000Base-X GBIC千兆模块。另外四台交换机
采用Cisco Catalyst 2950G-24-SMI，安装1块1000Base-T GBIC千兆模块。
所有服务器划分为一个VLAN，即VLAN 50。四台Catalyst 2950G-24-SMI交换机也只划分为一个VLAN，分别为VLAN 60、VLAN 70、VLAN 80和VLAN 90。
Catalyst 3550-24-EMI划分为4个VLAN，分别为VLAN 10、VLAN 20、VLAN 30和
VLAN 40。Catalyst 3550-24-SMI划分2个VLAN，分别为VLAN 60和VLAN 80，与另
外两台Catalyst 2950G-24-SMI交换机分别位于同一VLAN。
***************************实例分析****************************
由于所有Catalyst 2950G交换机都是一个独立的VLAN，因此，必须先在
这些交换机上创建VLAN(VLAN 60~VLAN 90)，并将所有端口都指定至该VLAN。然
后，再在Catalyst 4006交换机相应端口上分别创建VLAN。Catalyst 4006的
1000Base-X端口分别与各Catalyst 2950G的1000Base-X端口连接。其中，
GigabitEthernet3/2端口连接至1号Catalyst 2950交换机(VLAN 60)，GigabitEthernet3/3端口连接至2号Catalyst 2950交换机(VLAN 70)，GigabitEthernet3/4端口连接至3号Catalyst 2950交换机(VLAN 80)，GigabitEthernet3/5端口连接至4号Catalyst 2950交换机(VLAN 90)，GigabitEthernet3/6端口连接至6号楼交换机(VLAN 80)。
由于在Catalyst 3550-24-EMI上划分有4个VLAN(VLAN 10～VLAN 40)，而4个VLAN都需借助于一条1000Base-X链路实现与Catalyst 4006的GigabitEthernet3/1端口连接，因此，必须在Catalyst 4006与Catalyst 3550-24- EMI之间创建一个Trunk。
同样，在Catalyst 3550-24-SMI上划分有2个VLAN(VLAN 60和VLAN 80)，而4个VLAN都需借助于一条1000Base-X链路实现与Catalyst 4006的GigabitEthernet3/6端口连接，因此，必须在Catalyst 4006与Catalyst 3550-24- EMI之间创建一个Trunk。
另外，所有服务器均连接至Catalyst 4006的1000Base-T模块，并单独成为一个VLAN(VLAN 90)，因此，也必须为这些交换机创建一个VLAN，并将所有端口指定至该VLAN。需要注意的是，考虑到网络管理的需要，也可以剩余几个RJ-45端口(如21至24端口)不指定至任何VLAN，从而便于连接网络管理设备。默认状态下，所有端口都属于VLAN1，而且也只有在VLAN1中才能实现对网络中所有设备的管理。
***************************配置清单******************************
●Cisco Catalyst 4006交换机配置清单
Current configuration : 5594 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
service compress-config
!
hostname hsnc
!
boot system bootflash:cat4000-is-mz.121-8a.EW1.bin
no logging console
enable secret level 1 5 $1$rkQW$1HKyKdN5f.Ri5zxeoF8Yv/
!
ip subnet-zero
!
!
!
interface GigabitEthernet1/1
no snmp trap link-status
!--不为Supervisor Engine III G引擎中的1000Base-X插槽指定VLAN
interface GigabitEthernet1/2
no snmp trap link-status
!
!
interface GigabitEthernet2/1
switchport access vlan 50
no snmp trap link-status
!--将端口GigabitEthernet2/1指定至VLAN 50
!
interface GigabitEthernet2/2
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/3
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/4
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/5
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/6
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/7
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/8
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/9
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/10
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/11
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/12
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/13
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/14
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/15
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/16
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/17
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/18
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/19
switchport access vlan 50
no snmp trap link-status
!
interface GigabitEthernet2/20
switchport access vlan 50
no snmp trap link-status
!--不将GigabitEthernet2/20～24指定至任何VLAN
!
interface GigabitEthernet3/1
switchport trunk encapsulation dot1q
！--启用802.1Q Trunk封装协议，即在该端口创建Trunk
switchport trunk allowed vlan 1-80
！--允许vlan 1-90在该中继线通讯
！--可以拒绝或允许某个VLAN访问该Trunk
！--确保未被授权的VLAN通过该Trunk，实现VLAN的访问安全
switchport mode trunk
！--将该端口设置为Trunk
description netcenter
no snmp trap link-status
!
interface GigabitEthernet3/2
switchport access vlan 60
no snmp trap link-status
!--将端口GigabitEthernet3/2指定至VLAN 60
!
interface GigabitEthernet3/3
switchport access vlan 70
no snmp trap link-status
!--将端口GigabitEthernet3/3指定至VLAN 70
!
interface GigabitEthernet3/4
switchport access vlan 80
no snmp trap link-status
!--将端口GigabitEthernet3/4指定至VLAN 80
!
interface GigabitEthernet3/5
switchport access vlan 90
no snmp trap link-status
!--将端口GigabitEthernet3/5指定至VLAN 90
!
interface GigabitEthernet3/6
switchport trunk encapsulation dot1q
！--启用802.1Q Trunk封装协议，即在该端口创建Trunk
switchport trunk allowed vlan 1-80
！--允许vlan 1-90在该中继线通讯
！--可以拒绝或允许某个VLAN访问该Trunk
！--从而确保未被授权的VLAN通过该Trunk，实现VLAN访问安全
switchport mode trunk
！--将该端口设置为Trunk
description netcenter
no snmp trap link-status
!
interface Vlan1
description netmanger
no ip address
!
!--对VLAN1进行描述
interface Vlan10
description network center
no ip address
!--对VLAN2进行描述
!
interface Vlan20
description computer center
no ip address
!
interface Vlan30
description network lab
no ip address
!
interface Vlan40
description huaxuelou
no ip address
!
interface Vlan50
description wulilou
no ip address
!
interface Vlan60
description shengwulou
no ip address
!
interface Vlan70
description zhongwenxi
no ip address
!
interface Vlan80
description tushuguan
no ip address
!
!
line con 0
stopbits 1
line vty 0 4
password aaa
login
!
end
mazu 回复于：2004-06-07 23:23:30
●Cisco Catalyst 3550-EMI配置清单
Building configuration...
Current configuration : 4055 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname office
!
enable secret 5 $1$p0fU$JeyPOM0RuL.Fqfe71efHF1
!
ip subnet-zero
!
!
spanning-tree extend system-id
!
!
!
interface FastEthernet0/1
switchport access vlan 10
!--将端口FastEthernet0/1指定至VLAN 10
no ip address
!
interface FastEthernet0/2
switchport access vlan 10
no ip address
!
interface FastEthernet0/3
switchport access vlan 10
no ip address
!
interface FastEthernet0/4
switchport access vlan 10
no ip address
!
interface FastEthernet0/5
switchport access vlan 10
no ip address
!
interface FastEthernet0/6
switchport access vlan 20
no ip address
!--将端口FastEthernet0/6指定至VLAN 20
!
interface FastEthernet0/7
switchport access vlan 20
no ip address
!
interface FastEthernet0/8
switchport access vlan 20
no ip address
!
interface FastEthernet0/9
switchport access vlan 20
no ip address
!
interface FastEthernet0/10
switchport access vlan 20
no ip address
!
interface FastEthernet0/11
switchport access vlan 30
no ip address
!--将端口FastEthernet0/6指定至VLAN 30
!
interface FastEthernet0/12
switchport access vlan 30
no ip address
!
interface FastEthernet0/13
switchport access vlan 30
no ip address
!
interface FastEthernet0/14
switchport access vlan 30
no ip address
!
interface FastEthernet0/15
switchport access vlan 30
no ip address
!
interface FastEthernet0/16
switchport access vlan 30
no ip address
!
interface FastEthernet0/17
switchport access vlan 30
no ip address
!
interface FastEthernet0/18
switchport access vlan 30
no ip address
!
interface FastEthernet0/19
switchport access vlan 40
no ip address
!--将端口FastEthernet0/6指定至VLAN 40
!
interface FastEthernet0/20
switchport access vlan 40
no ip address
!
interface FastEthernet0/21
switchport access vlan 40
no ip address
!
interface FastEthernet0/22
switchport access vlan 30
no ip address
!
interface FastEthernet0/23
switchport access vlan 40
no ip address
!
interface FastEthernet0/24
switchport access vlan 40
no ip address
!
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
！--启用802.1Q Trunk封装协议，即在该端口创建Trunk
switchport trunk allowed vlan 1-80
！--允许vlan 1-80在该中继线通讯
switchport mode trunk
！--将该端口设置为Trunk
no ip address
!
interface GigabitEthernet0/2
no ip address
!
interface Vlan1
ip address 172.16.100.12 255.255.255.0
!--LAN1指定IP地址
no ip route-cache
no ip mroute-cache
!
ip classless
ip http server
!
!
!
!
line con 0
line vty 0 4
password aaa
login
line vty 5 15
login
!
end
mazu 回复于：2004-06-07 23:24:07
●Cisco Catalyst 3550-SMI配置清单
Building configuration...
Current configuration : 4055 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname office
!
enable secret 5 $1$p0fU$JeyPOM0RuL.Fqfe71efHF1
!
ip subnet-zero
!
!
spanning-tree extend system-id
!
!
!
interface FastEthernet0/1
switchport access vlan 60
!--将端口FastEthernet0/1指定至VLAN 60
no ip address
!
interface FastEthernet0/2
switchport access vlan 60
no ip address
!
interface FastEthernet0/3
switchport access vlan 60
no ip address
!
interface FastEthernet0/4
switchport access vlan 60
no ip address
!
interface FastEthernet0/5
switchport access vlan 60
no ip address
!
interface FastEthernet0/6
switchport access vlan 20
no ip address
!--将端口FastEthernet0/6指定至VLAN 20
!
interface FastEthernet0/7
switchport access vlan 20
no ip address
!
interface FastEthernet0/8
switchport access vlan 20
no ip address
!
interface FastEthernet0/9
switchport access vlan 20
no ip address
!
interface FastEthernet0/10
switchport access vlan 20
no ip address
!
interface FastEthernet0/11
switchport access vlan 80
no ip address
!--将端口FastEthernet0/6指定至VLAN 80
!
interface FastEthernet0/12
switchport access vlan 80
no ip address
!
interface FastEthernet0/13
switchport access vlan 80
no ip address
!
interface FastEthernet0/14
switchport access vlan 80
no ip address
!
interface FastEthernet0/15
switchport access vlan 80
no ip address
!
interface FastEthernet0/16
switchport access vlan 80
no ip address
!
interface FastEthernet0/17
switchport access vlan 80
no ip address
!
interface FastEthernet0/18
switchport access vlan 80
no ip address
!
interface FastEthernet0/19
switchport access vlan 80
no ip address
!--将端口FastEthernet0/6指定至VLAN 80
!
interface FastEthernet0/20
switchport access vlan 80
no ip address
!
interface FastEthernet0/21
switchport access vlan 80
no ip address
!
interface FastEthernet0/22
switchport access vlan 80
no ip address
!
interface FastEthernet0/23
switchport access vlan 80
no ip address
!
interface FastEthernet0/24
switchport access vlan 80
no ip address
!
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
！--启用802.1Q Trunk封装协议，即在该端口创建Trunk
switchport trunk allowed vlan 1-80
！--允许vlan 1-80在该中继线通讯
switchport mode trunk
！--从将该端口设置为Trunk
no ip address
!
interface GigabitEthernet0/2
no ip address
!
interface Vlan1
ip address 172.16.100.13 255.255.255.0
!--为LAN1指定IP地址
no ip route-cache
no ip mroute-cache
!
ip classless
ip http server
!
!
!
!
line con 0
line vty 0 4
password aaa
login
line vty 5 15
login
!
end
mazu 回复于：2004-06-07 23:24:39
●Cisco Catalyst 2950G配置清单
四台Cisco Catalyst 2950G的配置基本相同，下面仅列出VLAN 60的配置情况。
Building configuration...
Current configuration : 2143 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname msl
!
enable password aaa
!
ip subnet-zero
!
!
spanning-tree extend system-id
!
!
interface FastEthernet0/1
switchport access vlan 60
no ip address
!
interface FastEthernet0/2
switchport access vlan 60
no ip address
!
interface FastEthernet0/3
switchport access vlan 60
no ip address
!
interface FastEthernet0/4
switchport access vlan 60
no ip address
!
interface FastEthernet0/5
switchport access vlan 60
no ip address
!
interface FastEthernet0/6
switchport access vlan 60
no ip address
!
interface FastEthernet0/7
switchport access vlan 60
no ip address
!
interface FastEthernet0/8
switchport access vlan 60
no ip address
!
interface FastEthernet0/9
switchport access vlan 60
no ip address
!
interface FastEthernet0/10
switchport access vlan 60
no ip address
!
interface FastEthernet0/11
switchport access vlan 60
no ip address
!
interface FastEthernet0/12
switchport access vlan 60
no ip address
!
interface FastEthernet0/13
switchport access vlan 60
no ip address
!
interface FastEthernet0/14
switchport access vlan 60
no ip address
!
interface FastEthernet0/15
switchport access vlan 60
no ip address
!
interface FastEthernet0/16
switchport access vlan 60
no ip address
!
interface FastEthernet0/17
switchport access vlan 60
no ip address
!
interface FastEthernet0/18
switchport access vlan 60
no ip address
!
interface FastEthernet0/19
switchport access vlan 60
no ip address
!
interface FastEthernet0/20
switchport access vlan 60
no ip address
!
interface FastEthernet0/21
switchport access vlan 60
no ip address
!
interface FastEthernet0/22
switchport access vlan 60
no ip address
!
interface FastEthernet0/23
switchport access vlan 60
no ip address
!
interface FastEthernet0/24
switchport access vlan 60
no ip address
!
interface GigabitEthernet0/1
no ip address
!
interface GigabitEthernet0/2
no ip address
!
interface Vlan1
ip address 172.16.100.10 255.255.255.0
!
ip classless
ip http server
!
!
!
!
line con 0
line vty 0 4
password aaa
login
line vty 5 15
login
!
end
windstar 回复于：2004-06-08 15:58:09
没看出来是怎么实现三层交换的，所有的vlan都没配ip，又没起路由，vlan之间怎么通讯的？
这种范例误人子弟啊
mazu 回复于：2004-06-08 16:42:27
:em02: :em02: :em02: 说对了，这个范例确实没有配ip，这是缺陷之一
大家看看还有什么问题没有
chinaunix_li 回复于：2004-06-08 20:50:39
引用：原帖由 "mazu" 发表：
:em02: :em02: :em02: 说对了，这个范例确实没有配ip，这是缺陷之一
大家看看还有什么问题没有
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
no ip address
!
interface GigabitEthernet0/2
switchport trunk encapsulation dot1q
switchport mode trunk
no ip address
trunk 应该配置
lmhcn 回复于：2004-06-11 09:31:11
prom_cost_diff
geniiking 回复于：2004-06-11 11:15:27
这么简单的东东自己仔细一点做不就可以了，还需要贴这么多干嘛
mazu 回复于：2004-06-11 14:59:37
引用：原帖由 "geniiking"]这么简单的东东自己仔细一点做不就可以了，还需要贴这么多干嘛
发表：
这是个网上流传很广的三层交换的综合范例，但是作为范例又存在很多漏洞，为了不误导初学者，拿出来做个案例分析，顺便巩固一下概念有何不可 :em11:
sleeptiger 回复于：2004-06-26 08:01:00
伟大的版主说的对。我顶
asd2004 回复于：2004-07-01 17:48:31
请给出最后正确的确良配置啊
longlei 回复于：2004-08-21 18:16:53
对呀，能不能给个正确的配置呢！？我是菜鸟的说！
这是我现在的情况
现在公司的网络设备有CISCO2600一台，没有S口，CISCO2924交换两台，CISCO4006三层交换一台，公司有两条ISP的线路，一条是2M的，一条是4M的；公司的两条线路是的接入是2M的哪条通过2924接各种服务器（这个我估计是局 端上就有NAT，然后在各种服务器上直接用的真实的IP地址，与局端路由上的内网地址在同一个地址段，所以就可以发布出去了），4M的那条通过一个WIN2000的远程路由访问的NAT功能接到4006上然后接入局域网中。其它的CISCO2600和一台 2924没有用上。
现在公司具体的要求说：希望我在能够实现以下的目的：公司一部份人访问2M的线路，一部分人访问4M的线路，并且控制客户端不能改动IP地址，如果改动了IP地址就不可以访问INTERNET请问我能够怎么做呢！？
我现在考虑的思路有两点：
一、是在4006上做，可我没有调试过，哪位大大能够给个详细的配置我估计要在上面配置NAT，VLAN，HSPT，是吗！？而且两条线路同时接入到三层交换还需要做什么呢！？
二、考虑是否在代理上来做！
也就是说，用一台服务器在插上三块网卡后，其中两块网卡和外网连接，一块和内网，可这样做有个问题，就是现在要用代理软件，用什么代理软件来控制策略保证达到公司一部份人访问2M的线路，一部分人访问4M的线路，并且控制客户端不能改动IP地址，如果改动 了IP地址就不可以访问INTERNET！？
我还想问一下，CISCO4000系列中4003和4006是三层交换，为什么有人叫他路由呢！？真是奇怪了，4000也有专门的路由设备吗？
谢谢各位了！在线等待
|
