access vlan 10 Switch(config-if)#exit Switch(config)#interface FastEthernet0/2 Switch(config-if)#switchport )#no shutdown Switch(config)#interface FastEthernet0/2 Switch(config-if)#switchport trunk allowed vlan )#shutdown Switch(config)#interface FastEthernet0/4 Switch(config-if)#switchport trunk allowed vlan Switch(config-if)#exit Switch(config)#interface FastEthernet0/6 Switch(config-if)#switchport access Switch(config-if)#exit Switch(config)#interface FastEthernet0/4 Switch(config-if)#switchport trunk
interface FastEthernet0/1 switchport trunk allowed vlan 1 switchport mode trunk ! FastEthernet0/1 switchport trunk allowed vlan 1 switchport mode trunk ! interface FastEthernet0/1 switchport trunk allowed vlan 10,20 switchport mode trunk ! interface FastEthernet0/2 switchport trunk allowed vlan 10,20 switchport mode trunk ! interface FastEthernet0/2 switchport trunk allowed vlan 10,20 switchport mode trunk
access vlan 10----将vlan划分到接口 switchport mode trunk----将端口配置为trunk模式 switchport trunk allowed vlan remove 1-9,11-19,21-4094----将vlan10,20划分到接口 switchport trunk allowed vlan only 10,20----将vlan10,20划分到接口 switchport trunk allowed vlan remove 1-4094----拒绝vlan1-4094进入接口 switchport trunk allowed vlan add 将接口配置为保护口 switchport port-security----开启接口的端口安全功能 switchport port-security mac-address 0050.56c0.0008 ----配置绑定的mac地址 switchport port-security maximum 10----设置接口上安全地址的最大个数 switchport port-security violation
mode access 5.把端口分配进特定的VLAN里: Switch(config-if)#switchport access vlan {vlan-id} 6.配置中继端口,定义中继模式: Switch(config-if)#switchport trunk encapsulation {isl|dot1q|negotiate} 7.定义端口为层2的中继端口: Switch(config-if mode access Asuqa(config-if)#switchport access vlan 2 Asuqa(config-if)#no shutdown Asuqa(config-if)# interface f0/3 Asuqa(config-if)#switchport mode access Asuqa(config-if)#switchport access vlan 3 Asuqa f0/5 Aiko(config-if)#switchport mode access Aiko(config-if)#switchport access vlan 3 Aiko(config-if)
interface Port-channel1 switchport mode trunk ! interface FastEthernet0/1 switchport access vlan 10 switchport mode access ! interface FastEthernet0/2 switchport access vlan 20 switchport mode access ! interface FastEthernet0/1 switchport access vlan 20 switchport mode access ! interface FastEthernet0/2 switchport access vlan 10 switchport mode access !
interface FastEthernet0/2 switchport access vlan 20 switchport mode access interface FastEthernet0 /20 switchport trunk allowed vlan 10,20 switchport mode trunk Switch1 int vlan 10 exit int vlan 20 exit interface FastEthernet0/1 switchport access vlan 10 switchport mode access ! interface FastEthernet0/2 switchport access vlan 20 switchport mode access interface FastEthernet0 /20 switchport trunk allowed vlan 10,20 switchport mode trunk
/0/2switch1(config-if)# switchport mode accessswitch1(config-if)# switchport access vlan 20switch2(config )# interface gigabitethernet 1/0/1switch2(config-if)# switchport mode accessswitch2(config-if)# switchport )# switchport mode accessswitch3(config-if)# switchport access vlan 10switch3(config)# interface gigabitethernet 1/0/2switch3(config-if)# switchport mode accessswitch3(config-if)# switchport access vlan 20这个示例中,我们将计算机和服务器连接到交换机的端口配置为 (config-if)# switchport mode trunk这个示例中,我们将交换机之间的端口配置为 trunk 模式,并将它们分配到所有 VLAN。
interface f0/6 S1(config-if)#switchport access vlan 20 S1(config-if)#interface f0/7 S1(config-if)#switchport f0/10 S1(config-if)#switchport access vlan 30 S1(config-if)#interface f0/11 S1(config-if)#switchport mode access (config-if)#switchport access vlan 10 切换assess trunk (config-if)#switchport mode access (config-if)#switchport mode trunk 指定特定一个native vlan (config-if)#switchport trunk native vlan 10 配置网关: 模式下 Switch(config-if)#switchport mode access 该端口工作在trunk模式下 Switch(config-if)#switchport mode trunk Switch
mode access // 设置为通用模式 lyshark(config-if)# switchport mode multi // 该模式很少用 lyshark mode access switch0(config-if)# switchport access vlan 10 switch0(config-if)# exit switch0(config)# mode access switch1(config-if)# switchport access vlan 10 switch1(config-if)# exit switch1(config)# interface fa0/3 switch1(config-if)# switchport mode access switch1(config-if)# switchport access vlan mode trunk // 配置成trunk模式 Switch(config-if)# switchport trunk allowed vlan all Switch(config-if)
mode access/trunk Switch(config-if)#switchport port-security #注意:启用端口安全的接口不能是动态协商(dynamic)模式,必须配置接口为接入或干道模式 参数的范围是1~8192,在默认情况下为1 配置静态绑定的MAC地址 Switch(config-if)#switchport port-security mac-address { mac-addr mode access //设置接口模式为接入链路 Switch(config-if)#switchport port-security //启用端口安全 Switch(config-if)#switchport mode access switchport port-security switchport port-security violation restrict switchport port-security mac-address 00E0.8F34.5B4D switchport port-security aging time 1
10 name 10 vlan 20 name 20 exit congfigure terminal hostname s1 interface range fastethernet 0/1 – 3 switchport trunk encapsulation dot1q no shutdown exit interface fastethernet 0/2 switchport access vlan 10 exit interface fastethernet 0/3 switchport access vlan 20 exit interface fastethernet 0/3 switchport mode database vlan 10 name 10 vlan 20 name 20 exit configure terminal hostname s2 interface fastethernet 0/1 switchport mode trunk no shutdown exit interface fastethernet 0/2 no switchport ip address 192.168.3.1 255.255.255.0
interface Ethernet0/0 switchport trunk encapsulation dot1q switchport mode trunk ! interface Ethernet0/1 switchport trunk encapsulation dot1q switchport mode trunk ! interface Ethernet0/2 switchport access vlan 10 switchport mode access ! interface Ethernet0/3 switchport access vlan 20 switchport mode access ! interface Ethernet0/0 switchport trunk encapsulation dot1q switchport mode trunk !
mode access switchport access vlan <VLAN编号> (4)设置Trunk 端口允许通过VLAN: interface Ethernet 0/0/5 switchport mode trunk switchport trunk allowed vlan add <VLAN列表> Switch(Config-ethernet0/0/5)#switchport trunk mode access (3)划分VLAN: Switch(Config-ethernet0/0/5)#switchport access vlan 4 三、跨交换机VLAN划分(两台交换机作相同操作 五、端口安全配置 1、启用和禁用端口安全功能: 启用: Switch(config-if)# switchport port-security 禁用: Switch(config-if)# no switchport port-security 2、设置接口上安全地址的最大个数(1~128) Switch(config-if)#switchport port-security maximum 1 3、设置处理违例的方式
)#switchport port-security SW-A(config-if-range)#switchport port-security maximum 2 SW-A(config-if-range )#switchport port-security violation shutdown SW-A(config-if-range)#switchport port-security mac-address )#switchport port-security violation shutdown SW-B(config-if-range)#switchport port-security mac-address 开启access模式 switchport mode access ! 开启端口安全 switchport port-security ! 开启access模式 switchport mode access ! 开启端口安全 switchport port-security !
mode access //定义二层端口模式,默认为access端口,可省略 Switch(config-if)#switchport access vlan 2 //将端口添加到VLAN 2中 access vlan 10 switchport mode access ! interface FastEthernet0/2 switchport access vlan 20 switchport mode access ! interface FastEthernet0/3 switchport access vlan 10 switchport mode access ! interface FastEthernet0/4 switchport access vlan 20 switchport mode access //PC1、2、3、4 PC 上配置 IP 地址
no shut interface e 0/2 no switchport ip address 20.1.1.1 255.255.255.252 no shut interface e 0/3 no switchport ip address 20.1.1.5 255.255.255.252 no shut interface e 1/0 no switchport ip address 20.1.1.9 trunk encapsulation dot1q switchport mode trunk no shut interface rang e 0/2 , e 1/0 channel-group 1 mode active interface port-channel 1 switchport trunk encapsulation dot1q switchport mode trunk no shut trunk encapsulation dot1q switchport mode trunk no shut interface e 0/3 switchport mode access switchport
Switch(config)#int fa0/2 //进入端口0/2 Switch(config-if)#switchport access vlan 10 //把端口 0/ access vlan 10 Switch(config-if)#exit Switch(config)#int f0/3 Switch(config-if)#switchport access vlan 20 Switch(config-if)#exit Switch(config)#int f0/4 Switch(config-if)#switchport access vlan 30 Switch (config-if)#exit Switch(config)#int f0/1 Switch(config-if)#switchport mode trunk //端口模式为trunk 交换机 30 Switch(config-if)#exit Switch(config)#int fa0/1 Switch(config-if)#switchport mode trunk 交换机s2的配置如
取消某个vlan id的spanning-tree 1 no spanning-tree vlan 15 将某个端口加入vlan中 1 2 3 sh run init gi 0/39 config t switchport shutdown TEST3(config-if)#end TEST3# 例如 配置vlan15 和 trunk: 1 2 3 4 5 6 7 interface GigabitEthernet0/39 switchport access vlan 15 switchport mode access interface GigabitEthernet0/46 switchport trunk encapsulation dot1q switchport mode trunk 去掉 1 no switchport access vlan 15
触发端口安全违规(如关闭端口、限制流量) 直接丢弃不符合绑定关系的报文,端口状态不变 配置灵活性 需分步骤配置端口安全与ARP静态映射,联动性较弱 提供一体化命令,支持批量绑定和动态学习转换 典型应用命令 switchport mode access // 配置为接入端口 Switch(config-if)# switchport port-security // 启用端口安全 Switch(config-if) # switchport port-security mac-address sticky // 自动学习并固化端口MAC // 或手动指定MAC:switchport port-security mac-address 0001.0203.0405 Switch(config-if)# switchport port-security maximum 1 // 限制端口最大MAC数量为1 Switch(config-if )# switchport port-security violation shutdown // 违规时关闭端口 (2)静态ARP绑定IP与MAC Switch(config)# arp 192.168.1.10
Switch(config)#int f0/1 Switch(config-if)#switchport trunk encapsulation dot1q Switch(config-if)#switchport Switch(config)#int f0/1 Switch(config-if)#switchport trunk encapsulation dot1q Switch(config-if)#switchport Switch(config)#int f0/2 Switch(config-if)#switchport mode access Switch(config-if)#switchport access config-if)#exit Switch(config)#int f0/2 Switch(config-if)#exit Switch(config)#int f0/3 Switch(config-if)#switchport mode access Switch(config-if)#switchport access vlan 3 Switch(config-if)#end 结果两个不同vlan的两台PC互ping成功