跳到主要內容

使用Cisco L3 Switch做VLAN的Routing



目標:

讓VLAN100與VLAN200的電腦透過L3 Swtich做VLAN的Routing，並且可以互相存取資源與上網，另外再使用Windows Server 2012配發VLAN100,VLAN200的IP




Firewall:

使用ASUS AP當Firewall，並設兩條Static Route



Switch:

Core Switch為Cisco 3750切VLAN 10,VLAN100,VLAN200，VLAN10為預設的VLAN，VLAN100為Sales，VLAN200為RD

Edge Switch為Cisco 3750與2950，其中2950為VLAN100，3750為VLAN200，如果要By Port切VLAN也可以，這裡只是為了方便說明，所以Edge Switch都直接設為單一VLAN


Core Switch的設定

原本我只想Show Running-config其中比較重要的設定，後來想想還是全部列出，用紅色標記重要的設定

Gi 1/0/1接2950
Gi 1/0/2接3750
Gi 1/0/24接Router


Core-3750#show running-config
Building configuration...

Current configuration : 2436 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Core-3750
!
boot-start-marker
boot-end-marker
!
!
!
!
no aaa new-model
switch 1 provision ws-c3750g-24t
system mtu routing 1546
ip routing
no ip domain-lookup
!
!
!
!
!
!
!
!
spanning-tree mode pvst
spanning-tree portfast default
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
!
interface GigabitEthernet1/0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet1/0/2
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet1/0/3
 switchport access vlan 10
!
interface GigabitEthernet1/0/4
 switchport access vlan 10
!
interface GigabitEthernet1/0/5
 switchport access vlan 10
!
interface GigabitEthernet1/0/6
 switchport access vlan 10
!
interface GigabitEthernet1/0/7
 switchport access vlan 10
!
interface GigabitEthernet1/0/8
 switchport access vlan 10
!
interface GigabitEthernet1/0/9
 switchport access vlan 10
!
interface GigabitEthernet1/0/10
 switchport access vlan 10
!
interface GigabitEthernet1/0/11
 switchport access vlan 10
!
interface GigabitEthernet1/0/12
 switchport access vlan 10
!
interface GigabitEthernet1/0/13
 switchport access vlan 10
!
interface GigabitEthernet1/0/14
 switchport access vlan 10
!
interface GigabitEthernet1/0/15
 switchport access vlan 10
!
interface GigabitEthernet1/0/16
 switchport access vlan 10
!
interface GigabitEthernet1/0/17
 switchport access vlan 10
!
interface GigabitEthernet1/0/18
 switchport access vlan 10
!
interface GigabitEthernet1/0/19
 switchport access vlan 10
!
interface GigabitEthernet1/0/20
 switchport access vlan 10
!
interface GigabitEthernet1/0/21
 switchport access vlan 10
!
interface GigabitEthernet1/0/22
 switchport access vlan 10
!
interface GigabitEthernet1/0/23
 switchport access vlan 10
!
interface GigabitEthernet1/0/24
 switchport access vlan 10
!
interface Vlan1
 no ip address
!
interface Vlan10
 ip address 172.16.1.254 255.255.255.0
!
interface Vlan100
 ip address 172.16.2.254 255.255.255.0
 ip helper-address 172.16.1.200  (DHCP Server的IP)
!
interface Vlan200
 ip address 192.168.1.254 255.255.255.0
 ip helper-address 172.16.1.200
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.1.253
ip http server
ip http secure-server
!
!
!
!
!
line con 0
 logging synchronous
line vty 0 4
 login
line vty 5 15
 login
!
end


Edge 2950的設定

Edge的設定比較簡單，只有把Port改到相對應的VLAN

Edge-2950#show running-config
Building configuration...

Current configuration : 1801 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Edge-2950
!
!
ip subnet-zero
!
ip ssh time-out 120
ip ssh authentication-retries 3
!
spanning-tree mode pvst
spanning-tree portfast default
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
!
interface FastEthernet0/1
 switchport access vlan 100
!
interface FastEthernet0/2
 switchport access vlan 100
!
interface FastEthernet0/3
 switchport access vlan 100
!
interface FastEthernet0/4
 switchport access vlan 100
!
interface FastEthernet0/5
 switchport access vlan 100
!
interface FastEthernet0/6
 switchport access vlan 100
!
interface FastEthernet0/7
 switchport access vlan 100
!
interface FastEthernet0/8
 switchport access vlan 100
!
interface FastEthernet0/9
 switchport access vlan 100
!
interface FastEthernet0/10
 switchport access vlan 100
!
interface FastEthernet0/11
 switchport access vlan 100
!
interface FastEthernet0/12
 switchport access vlan 100
!
interface FastEthernet0/13
 switchport access vlan 100
!
interface FastEthernet0/14
 switchport access vlan 100
!
interface FastEthernet0/15
 switchport access vlan 100
!
interface FastEthernet0/16
 switchport access vlan 100
!
interface FastEthernet0/17
 switchport access vlan 100
!
interface FastEthernet0/18
 switchport access vlan 100
!
interface FastEthernet0/19
 switchport access vlan 100
!
interface FastEthernet0/20
 switchport access vlan 100
!
interface FastEthernet0/21
 switchport access vlan 100
!
interface FastEthernet0/22
 switchport access vlan 100
!
interface FastEthernet0/23
 switchport access vlan 100
!
interface FastEthernet0/24
!
interface Vlan1
 no ip address
 no ip route-cache
 shutdown
!
ip http server
!
line con 0
line vty 5 15
!
!
end


Edge 3750的設定

Edge-3750#show running-config
Building configuration...

Current configuration : 1912 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Edge-3750
!
!
switch 1 provision ws-c3750-24ts
ip subnet-zero
!
!
spanning-tree mode pvst
spanning-tree portfast default
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
!
!
interface FastEthernet1/0/1
 switchport access vlan 200
!
interface FastEthernet1/0/2
 switchport access vlan 200
!
interface FastEthernet1/0/3
 switchport access vlan 200
!
interface FastEthernet1/0/4
 switchport access vlan 200
!
interface FastEthernet1/0/5
 switchport access vlan 200
!
interface FastEthernet1/0/6
 switchport access vlan 200
!
interface FastEthernet1/0/7
 switchport access vlan 200
!
interface FastEthernet1/0/8
 switchport access vlan 200
!
interface FastEthernet1/0/9
 switchport access vlan 200
!
interface FastEthernet1/0/10
 switchport access vlan 200
!
interface FastEthernet1/0/11
 switchport access vlan 200
!
interface FastEthernet1/0/12
 switchport access vlan 200
!
interface FastEthernet1/0/13
 switchport access vlan 200
!
interface FastEthernet1/0/14
 switchport access vlan 200
!
interface FastEthernet1/0/15
 switchport access vlan 200
!
interface FastEthernet1/0/16
 switchport access vlan 200
!
interface FastEthernet1/0/17
 switchport access vlan 200
!
interface FastEthernet1/0/18
 switchport access vlan 200
!
interface FastEthernet1/0/19
 switchport access vlan 200
!
interface FastEthernet1/0/20
 switchport access vlan 200
!
interface FastEthernet1/0/21
 switchport access vlan 200
!
interface FastEthernet1/0/22
 switchport access vlan 200
!
interface FastEthernet1/0/23
 switchport access vlan 200
!
interface FastEthernet1/0/24
!
interface GigabitEthernet1/0/1
!
interface GigabitEthernet1/0/2
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
ip http server
!
!
!
control-plane
!
!
line con 0
line vty 5 15
!
end


Windows Server 2012架DHCP

Server的IP為172.16.1.200


若不使用Windows配發IP，使用Switch內建的也可以，說明如下:

先移掉ip helper-address
Core-3750(config)#interface vlan 100
Core-3750(config-if)#no ip helper-address
Core-3750(config-if)#exit
Core-3750(config)#interface vlan 200
Core-3750(config-if)#no ip helper-address

DHCP設定
Core-3750(config)#ip dhcp pool vlan100
Core-3750(dhcp-config)#network 172.16.2.0 255.255.255.0
Core-3750(dhcp-config)#default-router 172.16.2.254
Core-3750(dhcp-config)#dns-server 8.8.8.8 168.95.1.1
Core-3750(dhcp-config)#exit
Core-3750(config)#ip dhcp pool vlan200
Core-3750(dhcp-config)#network 192.168.1.0 255.255.255.0
Core-3750(dhcp-config)#default-router 192.168.1.254
Core-3750(dhcp-config)#dns-server 8.8.8.8 168.95.1.1
Core-3750(dhcp-config)#exit
Core-3750(config)#ip dhcp excluded-address 172.16.2.254
Core-3750(config)#ip dhcp excluded-address 192.168.1.254

Core-3750#show ip dhcp binding
Bindings from all pools not associated with VRF:
IP address          Client-ID/              Lease expiration        Type
                    Hardware address/
                    User name
172.16.2.1          0100.262d.xxxx.1a       Mar 02 1993 01:07 AM    Automatic
192.168.1.1         0100.262d.xxxx.1a       Mar 02 1993 01:06 AM    Automatic
192.168.1.2         0100.1018.xxxx.ec       Mar 02 1993 01:07 AM    Automatic





標籤：

留言

張貼留言

這個網誌中的熱門文章

Cisco Switch 發生Loopback

User告知網路無法使用，看了Switch的狀況後，發現那個Port的狀態是Error Disable，接著又看了Switch的log Feb  8 12:14:14 TW: %DHCP_SNOOPING-5-DHCP_SNOOPING_UNTRUSTED_PORT: DHCP_SNOOPING drop message on untrusted port, message type: DHCPNAK, MAC sa: 2c56.dc86.xxxx Feb  8 12:15:49 TW: %DHCP_SNOOPING-5-DHCP_SNOOPING_UNTRUSTED_PORT: DHCP_SNOOPING drop message on untrusted port, message type: DHCPNAK, MAC sa: 2c56.dc86.xxxx Feb  8 12:18:00 TW: %ETHCNTR-3-LOOP_BACK_DETECTED: Keepalive packet loop-back detected on FastEthernet0/10. Feb  8 12:18:00 TW: %PM-4-ERR_DISABLE: loopback error detected on Fa0/10, putting Fa0/10 in err-disable state Feb  8 12:18:01 TW: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/10, changed state to down Feb  8 12:18:02 TW: %LINK-3-UPDOWN: Interface FastEthernet0/10, changed state to down 應該是User私接設備，除了造成Loopback之外，又在隨便發放IP....... 不過因為那個User比較特殊，先教育了一下之後，再把那個Port shutdown , no shutdown，接著把Recovery設了上去，下次如果再遇到相同狀況，10分鐘後會自動恢復 xxxxx# show errdisable detect
張貼留言
閱讀完整內容

2台 Vigor 2920建立 LAN To LAN VPN (IPsec)

我有兩台Vigor 2920,環境如下: Vigor B 撥出 LAN:192.168.1.0/24 Vigor A 撥入 LAN:172.16.1.0/24 設定如下: Vigor B設定 Vigor A設定 詳細設定請參考官網 http://www.draytek.com/index.php?option=com_k2&view=item&id=2666&Itemid=264&lang=tw
張貼留言
閱讀完整內容