网络部分教案6-交换

数据交换微软认证讲师：韩立刚

hanligang@

MSN:onesthan@目标通过本章的学习，你将能够完成下列任务:描述2层交换操作配置交换机使用show命令查看交换机的配置和操作MAC地址学习转发/避免冲突避免环路交换机的三个作用

交换机如何学习主机位置初始MAC地址表是空的MACaddresstable0260.8c01.11110260.8c01.22220260.8c01.33330260.8c01.4444E0E1E2E3ABCD交换机如何学习计算机位置计算机A发送一个数据frame到计算机C通过查看fame的源地址，交换机缓存计算机A的MAC地址到端口来自计算机A要到达计算机Cframe被传到所有的端口除了E0MACaddresstable0260.8c01.11110260.8c01.22220260.8c01.33330260.8c01.4444E0:0260.8c01.1111E0E1E2E3DCBA交换机如何过滤Frames计算机A传输一个frame到计算机C知道该目标地址,Frame被转发到指定端口E0:0260.8c01.1111E2:0260.8c01.2222E1:0260.8c01.3333E3:0260.8c01.44440260.8c01.11110260.8c01.22220260.8c01.33330260.8c01.4444E0E1E2E3XXDCABMACaddresstable广播和多播Frames计算机D发送一个多播或广播frame多播或广播

frames被转发到所有端口除了E30260.8c01.11110260.8c01.22220260.8c01.33330260.8c01.4444E0E1E2E3DCABE0:0260.8c01.1111E2:0260.8c01.2222E1:0260.8c01.3333E3:0260.8c01.4444MACaddresstable冗余拓扑

冗余拓扑避免单点失败冗余拓扑产生广播风暴冗余拓扑产生MAC地址表混乱Segment1Segment2Server/hostXRouterY广播风暴Segment1Segment2Server/hostXRouterYBroadcastSwitchASwitchBHostXsendsaBroadcast广播风暴Segment1Segment2Server/hostXRouterYBroadcastSwitchASwitchBHostXsendsaBroadcast解决办法:Spanning-TreeProtocol通过将一些端口设置成阻断状态避免环路Blockx生成树协议STPSTP协议工作方式：通过在交换机之间传递BPDU（bridgeprotocoldataunit,桥接协议数据单元）来互相告知诸如交换机的链路性质，根桥信息等，以便确定根桥，决定哪些端口处于转发状态，哪些端口处于阻止状态，以免引起网络环路。生成树协议STP功能:允许在网络中存在容错的交换路径,并且不产生回路;即在之中有多个链路,但是只有一条是激活的,其他的备份线路都于备用状态以防止主链路出现故障.也可避免在两台已有的交换机中偶然地连接了一条链路,生成树是一项优秀的保护措施,它能确保产生上述错误时,网络也不至于….配置生成树C1900:spantree1或nospantree1(全局模式)Showspantree1C2900/3500:Spanning-tree(启动);Showspanning-treeC5000:Setspantreedisable1-1005 关闭生成树Setspantreeenable1-1005启动生成树Showspantree思科建议在交换机上启动生成树,特别是在可能出现回环的链路上.确认生成树wg_sw_a#showspantree{vlannumber}15Spanning-Tree操作每个网段选择一个根交换机每个非跟交换机选择一个根端口每个网线的两个端选择一个指定端口SwitchXDefaultpriority32768

(8000hex)MAC0c0011111111SwitchYDefaultpriority32768

(8000hex)MAC0c0022222222xxxRootBridge根端口根端口根端口根端口根端口BPDU指定端口指定端口指定端口指定端口阻断端口选择根网桥

BPDU=Bridgeprotocoldataunit

(default=sentevery2seconds)Rootbridge=具有最低bridgeIDBridgeID=网桥优先级+网桥MAC地址BPDUSwitchXDefaultpriority32768

(8000hex)MAC0c0011111111

SwitchYDefaultpriority32768

(8000hex)MAC0c0022222222根交换机选择根端口每个交换机到达跟交换机具有最低COST的端口成为这个交换机的根端口根交换机BPDUSwitchXDefaultpriority32768

(8000hex)MAC0c0011111111SwitchYDefaultpriority32768

(8000hex)MAC0c0022222222根端口根端口根端口根端口根端口LinkSpeed Cost(reratifyIEEEspec)Cost(previousIEEEspec)----------------------------------------------------------------------------------------------------10Gbps 2 1 1Gbps 4 1100Mbps 19 1010Mbps 100 100 100BaseT选择指定端口BPDUSwitchXDefaultpriority32768

(8000hex)MAC0c0011111111SwitchYDefaultpriority32768

(8000hex)MAC0c0022222222根交换机根端口根端口根端口根端口根端口指定端口指定端口指定端口指定端口AB每个网线的两个头，要选一个指定端口，比如A点比B点到根交换机的Cost低，那么A点就是指定端口。根端口和指定端口都处于转发状态，其他端口处于阻断状态XXXBlockingListeningLearningForwarding生成树端口状态生成树端口状态:收敛时间:所有的端口都处于转发或阻断状态时所用的时间称为收敛时间，大约30秒。当网络拓扑发生改变，所有的交换机都将重新计算生成树协议，这将中断用户的数据通信。LAN交换类型

存储转发交换机将所有frame全部受到后，检查没有错误后转发Frame快速转发交换机检查目标MAC地址，迅速转发frameFrameFrameFrame改进的存储转发交换机检查Frame前64个字节，检查没有错误后转发FrameDuplexOverview半双工(CSMA/CD)单项的数据流更多的冲突可能集线器连接SwitchHub全双工点到点连接直接连接到交换机的端口需要两端连接都是全双工不必链路上的冲突检测配置交换机Catalyst1900MenudriveninterfaceWeb-basedVSM

(VisualSwitchManager)IOSCLI

(command-lineinterface)Catalyst1900默认配置IPaddress:CDP:EnabledSwitchingmode:fragmentfree100baseTport:Auto-negotiateduplexmode10baseTport:HalfduplexSpanningTree:EnabledConsolepassword:nonePortsontheCatalyst1900Cat1912Cat192410baseTportsAUIport100baseTuplinkportse0/1toe0/12e0/1toe0/24e0/25e0/25fa0/26(portA)fa0/27(portB)fa0/26(portA)fa0/27(portB)PortsontheCatalyst1900wg_sw_d#shrunBuildingconfiguration...Currentconfiguration:!!interfaceEthernet0/1!interfaceEthernet0/2

wg_sw_d#shspanPortEthernet0/1ofVLAN1isForwardingPortpathcost100,Portpriority128Designatedroothaspriority32768,address0090.8673.3340Designatedbridgehaspriority32768,address0090.8673.3340DesignatedportisEthernet0/1,pathcost0Timers:messageage20,forwarddelay15,hold1wg_sw_a#showvlan-membershipPortVLANMembershipType PortVLANMembershipType------------------------------------------------------------------1

5Static 131 Static21Static 141 Static31Static 151 Static

ConfiguringtheSwitchConfigurationModesGlobalconfigurationmodewg_sw_a#conftermwg_sw_a(config)#Interfaceconfigurationmodewg_sw_a(config)#interfacee0/1wg_sw_a(config-if)#wg_sw_a(config)#ipaddress1配置交换机的IP地址和默认网关wg_sw_a(config)#

ipaddress{ipaddress}{mask}wg_sw_a(config)#ipdefault-gatewaywg_sw_a(config)#

ipdefault-gateway{ipaddress}查看交换机的IP地址wg_sw_a#showipIPaddress:1Subnetmask:Defaultgateway:ManagementVLAN:1Domainname:Nameserver1:Nameserver2:HTTPserver:EnabledHTTPport:80RIP:Enabledwg_sw_a#设置双工模式wg_sw_a(config-if)#duplexhalfwg_sw_a(config)#interfacee0/1wg_sw_a(config-if)#duplex{auto|full|full-flow-control|half}查看双工模式双工模式不匹配人工设置连接两端的双工模式交换机端口双工模式默认自动协商，如果连接的端口设置不一致将导致通信失败管理Mac地址表wg_sw_a#shmac-address-tableNumberofpermanentaddresses:0Numberofrestrictedstaticaddresses:0Numberofdynamicaddresses:6Address DestInterface TypeSourceInterfaceList-------------------------------------------------------------------------------------------------00E0.1E5D.AE2FEthernet0/2 DynamicAll00D0.588F.B604FastEthernet0/26 DynamicAll00E0.1E5D.AE2BFastEthernet0/26 DynamicAll0090.273B.87A4FastEthernet0/26 DynamicAll00D0.588F.B600FastEthernet0/26 DynamicAll00D0.5892.38C4FastEthernet0/27 DynamicAllwg_sw_a#showmac-address-table设置永久的MAC地址wg_sw_a#shmac-address-tableNumberofpermanentaddresses:1Numberofrestrictedstaticaddresses:0Numberofdynamicaddresses:4Address DestInterface Type SourceInterfaceList--------------------------------------------------------------------------------------------------------------00E0.1E5D.AE2F Ethernet0/2 Dynamic All2222.2222.2222 Ethernet0/3 Permanent All00D0.588F.B604 FastEthernet0/26 Dynamic All00E0.1E5D.AE2B FastEthernet0/26 Dynamic All00D0.5892.38C4 FastEthernet0/27 Dynamic Allwg_sw_a(config)#wg_sw_a(config)#mac-address-tablepermanent2222.2222.2222ethernet0/3mac-address-tablepermanent{mac-addresstypemodule/port}设置限制的MAC地址wg_sw_a#shmac-address-tableNumberofpermanentaddresses:1Numberofrestrictedstaticaddresses:1Numberofdynamicaddresses:4Address DestInterface Type SourceInterfaceList-----------------------------------------------------------------------------------------------1111.1111.1111 Ethernet0/4 Static Et0/100E0.1E5D.AE2F Ethernet0/2 Dynamic All2222.2222.2222 Ethernet0/3 Permanent All00D0.588F.B604 FastEthernet0/26 Dynamic All00E0.1E5D.AE2B FastEthernet0/26 Dynamic All00D0.5892.38C4 FastEthernet0/27 Dynamic Allwg_sw_a(config)#mac-address-tablerestrictedstatic1111.1111.1111e0/4e0/1wg_sw_a(config)#

mac-address-tablerestrictedstatic{mac-addresstypemodule/portsrc-if-list}下面的设置允许来自Et0/1访问E0/4，并且只能在Ethernet0/4接MAC地址1111.1111.1111的网卡配置端口安全wg_sw_a(config-if)#ConfiguresaninterfacetobeasecuredportDefineamaximumnumberofmacaddressesallowedintheaddresstableforthisportCountcanbefrom1to132Defaultis132wg_sw_a(config)#interfacee0/4wg_sw_a(config-if)#portsecuremax-mac-count1portsecure[max-mac-countcount]配置端口安全wg_sw_a#showmac-address-tablesecuritywg_sw_a#showmac-address-tablesecurityActionuponaddressviolation:SuspendInterfaceAddressingSecurityAddressTableSize------------------------------------------------------------------------------------Ethernet0/1Disabled N/AEthernet0/2Disabled N/AEthernet0/3Disabled N/AEthernet0/4Enabled 1Ethernet0/5Disabled N/AEthernet0/6Disabled N/AEthernet0/7Disabled N/AEthernet0/8Disabled N/AEthernet0/9Disabled N/AEthernet0/10Disabled N/AEthernet0/11Disabled N/AEthernet0/12Disabled N/A配置端口安全wg_sw_a#showmac-address-tablesecuritywg_sw_a(config)#address-violation{suspend|disable|ignore}wg_sw_a#showmac-address-tablesecurityActionuponaddressviolation:SuspendInterfaceAddressingSec