070-交换机配置VRRP+MSTP典型应用

STYLEREFContents错误！文档中没有指定样式的文字。DOCPROPERTY"Product&ProjectName"BTS3606CCDMA基站DOCPROPERTYDocumentName产品概述内部公开交换机配置VRRP+MSTP典型应用重庆环联科技有限公司李想组网需求如REF_Ref129400466\r\h图1-1所示，两台S5700作为接入交换机，S7700作为作为下联网络中网关设备。两台S7700配置VRRP做冗余备份，整网中配置了MSTP破环协议。网络中有4个网段，通过S9700做策略路由，实现财务部门（1.0段）和办公部门（2.0段）走电信（AR1）上网；销售部门（3.0段）和生产部门（4.0段）走移动（AR2）上网。同时要求公司内部都能互访单位的具体需求如下：两台S5700作为接入交换机，创建vlan10、20、30/40，方便配置MSTP域，并为每个vlan配置不同的实例。S7700-1对于instance1对应vlan10，作为stp的primary；instance2对应vlan20，作为stp的secondary；instance3对应vlan30，作为stp的primary；instance4对应vlan40，作为stp的secondary。vlan10为VRRP主设备，vlan20为VRRP备设备，vlan30为VRRP主设备，vlan40为VRRP备设备。S7700-2反之，3.分别把两台S7700作为各个网段的DHCP服务器，为了起备份作用，S7700-1分配4个网段的前128个IP地址，S7700-2分配4个网段的后128个地址，网关分别是对应VRRP的虚地址（10.1.X.100）4.对于S9700，两台S7700针对10.1.5.0做VRRP，S9700作为核心设备，配置策略路由实现财务部门和办公部门走电信（AR1）上网；销售部门和生产部门走移动（AR2）上网5.两台AR配置nat实现上网，配置路由和公网以及内网互通规划1.VRRP虚拟网关备份规划VRRP能够在不改变组网的情况下，采用将多台路由设备组成一个虚拟路由器，通过配置虚拟路由器的IP地址为默认网关，实现默认网关的备份。当网关设备发生故障时，VRRP机制能够选举新的网关设备承担数据流量，从而保障网络的可靠通信。2. MSTP破环规划MSTP形成多棵无环路的树，解决广播风暴并实现冗余备份。收敛速度快。多棵生成树在VLAN间实现负载均衡，不同VLAN的流量按照不同的路径转发。3. DHCP自动分配IP规划DHCP实现了IP地址及网络配置参数的自动分配的功能。DHCP允许计算机快速、动态地获取IP地址，而不是静态为每台主机指定地址。DHCP技术实现了IP地址的合理分配，提高了IP地址的使用率，避免了IP地址的浪费。4. 多出口选路规划为了实现特殊内网用户的流量能够通过特定的运营商链路转发，网络出口部署了两台AR系列路由器。我们需要在核心交换机上配置策略路由功能。本案例的交换机S9700通过流分类、流行为和流量策略来实现策略路由功能。主要是实现各个部门的数据分流，减轻网络从一个出口出去的压力。5. NAT规划为了保证内网大量用户能够通过有限的公网地址访问外网，需要在AR路由器上部署源NAT功能。配置步骤步骤一：配置S5700S5700-1配置MSTP基本功能SW1：sysnameSW1#vlanbatch10203040#stpregion-configurationregion-namehwinstance1vlan10instance2vlan20instance3vlan30instance4vlan40activeregion-configuration配eth-trunk做链路备份功能：#interfaceEth-Trunk1portlink-typetrunkporttrunkallow-passvlan2to4094#interfaceGigabitEthernet0/0/3eth-trunk1#interfaceGigabitEthernet0/0/4eth-trunk1配置接口划分vlan功能：#interfaceGigabitEthernet0/0/1portlink-typeaccessportdefaultvlan10#interfaceGigabitEthernet0/0/2portlink-typeaccessportdefaultvlan20#interfaceGigabitEthernet0/0/5portlink-typetrunkporttrunkallow-passvlan2to4094步骤二：配置S7700-1功能配置MSTP功能：#vlanbatch5to710203040#stpregion-configurationregion-namehwinstance1vlan10instance2vlan20instance3vlan30instance4vlan40activeregion-configuration#stpinstance1rootprimarystpinstance2rootsecondarystpinstance3rootprimarystpinstance4rootsecondary配置VRRP功能：#interfaceVlanif5ipaddress10.1.5.1255.255.255.0vrrpvrid5virtual-ip10.1.5.100vrrpvrid5priority120#interfaceVlanif10ipaddress10.1.1.1255.255.255.0vrrpvrid1virtual-ip10.1.1.100vrrpvrid1priority120#interfaceVlanif20ipaddress10.1.2.1255.255.255.0vrrpvrid2virtual-ip10.1.2.100vrrpvrid2priority60#interfaceVlanif30ipaddress10.1.3.1255.255.255.0vrrpvrid3virtual-ip10.1.3.100vrrpvrid3priority120#interfaceVlanif40ipaddress10.1.4.1255.255.255.0vrrpvrid4virtual-ip10.1.4.100vrrpvrid4priority60配置DHCP功能：#ippool1gateway-list10.1.1.100network10.1.1.0mask255.255.255.0static-bindip-address10.1.1.99mac-address5489-98e0-3436excluded-ip-address10.1.1.12910.1.1.254#ippool2gateway-list10.1.2.100network10.1.2.0mask255.255.255.0excluded-ip-address10.1.2.12910.1.2.254#ippool3gateway-list10.1.3.100network10.1.3.0mask255.255.255.0excluded-ip-address10.1.3.12910.1.3.254#ippool4gateway-list10.1.4.100network10.1.4.0mask255.255.255.0excluded-ip-address10.1.4.12910.1.4.254##interfaceVlanif10ipaddress10.1.1.1255.255.255.0dhcpselectglobal#interfaceVlanif20ipaddress10.1.2.1255.255.255.0dhcpselectglobal#interfaceVlanif30ipaddress10.1.3.1255.255.255.0dhcpselectglobal#interfaceVlanif40ipaddress10.1.4.1255.255.255.0dhcpselectglobal配置路由功能：#iproute-static0.0.0.00.0.0.010.1.5.2配置管理IP地址以及Telnet功能：#interfaceVlanif1ipaddress192.168.1.324#aaalocal-useradminpasswordcipherAdmin@123local-useradminprivilegelevel15local-useradminservice-typetelnet#user-interfacevty04authentication-modeaaaS7700-2的配置和S7700-1基本一致，详情请见附件步骤三：配置S9700配置设备的IP地址：#vlanbatch5to7#interfaceVlanif5ipaddress10.1.5.2255.255.255.0#interfaceVlanif6ipaddress10.1.6.1255.255.255.0#interfaceVlanif7ipaddress10.1.7.1255.255.255.0配置接口划分vlan：#interfaceGigabitEthernet0/0/1portlink-typeaccessportdefaultvlan5#interfaceGigabitEthernet0/0/2portlink-typeaccessportdefaultvlan5#interfaceGigabitEthernet0/0/3portlink-typeaccessportdefaultvlan7#interfaceGigabitEthernet0/0/4portlink-typeaccessportdefaultvlan6配置策略路由：#aclnumber3001rule5permitipsource10.1.1.00.0.0.255rule10permitipsource10.1.2.00.0.0.255aclnumber3002rule5permitipsource10.1.3.00.0.0.255rule10permitipsource10.1.4.00.0.0.255#trafficclassifierc2if-matchacl3001trafficclassifierc3if-matchacl3002#trafficbehaviorb1permittrafficbehaviorb2redirectip-nexthop10.1.7.2trafficbehaviorb3redirectip-nexthop10.1.6.2#trafficpolicyp1classifierc2behaviorb2trafficpolicyp2classifierc3behaviorb3#interfaceGigabitEthernet0/0/1traffic-policyp1inbound#interfaceGigabitEthernet0/0/2traffic-policyp2inbound配置路由功能：#iproute-static0.0.0.00.0.0.010.1.6.2iproute-static0.0.0.00.0.0.010.1.7.2iproute-static10.1.1.0255.255.255.010.1.5.100iproute-static10.1.2.0255.255.255.010.1.5.100iproute-static10.1.3.0255.255.255.010.1.5.100iproute-static10.1.4.0255.255.255.010.1.5.100#步骤四配置AR路由器配置nat上网功能aclnumber2000rule5permit#interfaceGigabitEthernet0/0/0ipaddress10.1.7.2255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress202.1.11.208255.255.255.0natoutbound2000配置路由功能：#iproute-static0.0.0.00.0.0.0202.1.11.209iproute-static10.1.1.0255.255.255.010.1.7.1iproute-static10.1.2.0255.255.255.010.1.7.1iproute-static10.1.3.0255.255.255.010.1.7.1iproute-static10.1.4.0255.255.255.010.1.7.1iproute-static10.1.5.0255.255.255.010.1.7.1配置文件SW1：sysnameSW1#vlanbatch10203040#dhcpenable#stpregion-configurationregion-namehwinstance1vlan10instance2vlan20instance3vlan30instance4vlan40activeregion-configuration#aaalocal-useradminpasswordcipherAdmin@123local-useradminprivilegelevel15local-useradminservice-typetelnet#interfaceVlanif1ipaddress192.168.1.124#interfaceMEth0/0/1#interfaceEth-Trunk1portlink-typetrunkporttrunkallow-passvlan2to4094#interfaceGigabitEthernet0/0/1portlink-typeaccessportdefaultvlan10#interfaceGigabitEthernet0/0/2portlink-typeaccessportdefaultvlan20#interfaceGigabitEthernet0/0/3eth-trunk1#interfaceGigabitEthernet0/0/4eth-trunk1#interfaceGigabitEthernet0/0/5portlink-typetrunkporttrunkallow-passvlan2to4094#user-interfacevty04authentication-modeaaa<SW1>disstpbriefMSTIDPortRoleSTPStateProtection0GigabitEthernet0/0/1DESIFORWARDINGNONE0GigabitEthernet0/0/2DESIFORWARDINGNONE0GigabitEthernet0/0/5DESIFORWARDINGNONE0Eth-Trunk1ROOTFORWARDINGNONE1GigabitEthernet0/0/1DESIFORWARDINGNONE1GigabitEthernet0/0/5ALTEDISCARDINGNONE1Eth-Trunk1ROOTFORWARDINGNONE2GigabitEthernet0/0/2DESIFORWARDINGNONE2GigabitEthernet0/0/5ROOTFORWARDINGNONE2Eth-Trunk1ALTEDISCARDINGNONE3GigabitEthernet0/0/5ALTEDISCARDINGNONE3Eth-Trunk1ROOTFORWARDINGNONE4GigabitEthernet0/0/5ROOTFORWARDINGNONE4Eth-Trunk1ALTEDISCARDINGNONESW2：<SW2>discur#sysnameSW2#vlanbatch10203040#dhcpenable#stpregion-configurationregion-namehwinstance1vlan10instance2vlan20instance3vlan30instance4vlan40activeregion-configuration#aaalocal-useradminpasswordcipherAdmin@123local-useradminprivilegelevel15local-useradminservice-typetelnet#interfaceVlanif1ipaddress192.168.1.224#interfaceMEth0/0/1#interfaceEth-Trunk2portlink-typetrunkporttrunkallow-passvlan2to4094#interfaceGigabitEthernet0/0/1portlink-typeaccessportdefaultvlan30#interfaceGigabitEthernet0/0/2portlink-typeaccessportdefaultvlan40#interfaceGigabitEthernet0/0/3eth-trunk2#interfaceGigabitEthernet0/0/4eth-trunk2#interfaceGigabitEthernet0/0/5portlink-typetrunkporttrunkallow-passvlan2to4094#user-interfacevty04authentication-modeaaa<SW2>disstpbriefMSTIDPortRoleSTPStateProtection0GigabitEthernet0/0/1DESIFORWARDINGNONE0GigabitEthernet0/0/2DESIFORWARDINGNONE0GigabitEthernet0/0/5ROOTFORWARDINGNONE0Eth-Trunk2DESIFORWARDINGNONE1GigabitEthernet0/0/5ROOTFORWARDINGNONE1Eth-Trunk2ALTEDISCARDINGNONE2GigabitEthernet0/0/5ALTEDISCARDINGNONE2Eth-Trunk2ROOTFORWARDINGNONE3GigabitEthernet0/0/1DESIFORWARDINGNONE3GigabitEthernet0/0/5ROOTFORWARDINGNONE3Eth-Trunk2ALTEDISCARDINGNONE4GigabitEthernet0/0/2DESIFORWARDINGNONE4GigabitEthernet0/0/5ALTEDISCARDINGNONE4Eth-Trunk2ROOTFORWARDINGNONESW3：#sysnameSW3#vlanbatch5to710203040#stpinstance1rootprimarystpinstance2rootsecondarystpinstance3rootprimarystpinstance4rootsecondary#dhcpenable#stpregion-configurationregion-namehwinstance1vlan10instance2vlan20instance3vlan30instance4vlan40activeregion-configuration#ippool1gateway-list10.1.1.100network10.1.1.0mask255.255.255.0static-bindip-address10.1.1.99mac-address5489-98e0-3436excluded-ip-address10.1.1.12910.1.1.254#ippool2gateway-list10.1.2.100network10.1.2.0mask255.255.255.0excluded-ip-address10.1.2.12910.1.2.254#ippool3gateway-list10.1.3.100network10.1.3.0mask255.255.255.0excluded-ip-address10.1.3.12910.1.3.254#ippool4gateway-list10.1.4.100network10.1.4.0mask255.255.255.0excluded-ip-address10.1.4.12910.1.4.254#aaalocal-useradminpasswordcipherAdmin@123local-useradminprivilegelevel15local-useradminservice-typetelnet#interfaceVlanif1ipaddress192.168.1.324#interfaceVlanif5ipaddress10.1.5.1255.255.255.0vrrpvrid5virtual-ip10.1.5.100vrrpvrid5priority120#interfaceVlanif10ipaddress10.1.1.1255.255.255.0vrrpvrid1virtual-ip10.1.1.100vrrpvrid1priority120dhcpselectglobal#interfaceVlanif20ipaddress10.1.2.1255.255.255.0vrrpvrid2virtual-ip10.1.2.100vrrpvrid2priority60dhcpselectglobal#interfaceVlanif30ipaddress10.1.3.1255.255.255.0vrrpvrid3virtual-ip10.1.3.100vrrpvrid3priority120dhcpselectglobal#interfaceVlanif40ipaddress10.1.4.1255.255.255.0vrrpvrid4virtual-ip10.1.4.100vrrpvrid4priority60dhcpselectglobal#interfaceMEth0/0/1#interfaceEth-Trunk1portlink-typetrunkporttrunkallow-passvlan2to4094#interfaceGigabitEthernet0/0/1portlink-typeaccessportdefaultvlan5#interfaceGigabitEthernet0/0/3eth-trunk1#interfaceGigabitEthernet0/0/4eth-trunk1#interfaceGigabitEthernet0/0/5portlink-typetrunkporttrunkallow-passvlan2to4094#interfaceGigabitEthernet0/0/6portlink-typetrunkporttrunkallow-passvlan2to4094#iproute-static0.0.0.00.0.0.010.1.5.2#user-interfacevty04authentication-modeaaa<SW3>disstpbriefMSTIDPortRoleSTPStateProtection0GigabitEthernet0/0/1DESIFORWARDINGNONE0GigabitEthernet0/0/5DESIFORWARDINGNONE0GigabitEthernet0/0/6DESIFORWARDINGNONE0Eth-Trunk1DESIFORWARDINGNONE1GigabitEthernet0/0/5DESIFORWARDINGNONE1GigabitEthernet0/0/6DESIFORWARDINGNONE1Eth-Trunk1DESIFORWARDINGNONE2GigabitEthernet0/0/5DESIFORWARDINGNONE2GigabitEthernet0/0/6ROOTFORWARDINGNONE2Eth-Trunk1DESIFORWARDINGNONE3GigabitEthernet0/0/5DESIFORWARDINGNONE3GigabitEthernet0/0/6DESIFORWARDINGNONE3Eth-Trunk1DESIFORWARDINGNONE4GigabitEthernet0/0/5DESIFORWARDINGNONE4GigabitEthernet0/0/6ROOTFORWARDINGNONE4Eth-Trunk1DESIFORWARDINGNONE<SW3>displayvrrpbriefVRIDStateInterfaceTypeVirtualIP----------------------------------------------------------------1MasterVlanif10Normal10.1.1.1002BackupVlanif20Normal10.1.2.1003MasterVlanif30Normal10.1.3.1004BackupVlanif40Normal10.1.4.1005MasterVlanif5Normal10.1.5.100----------------------------------------------------------------Total:5Master:3Backup:2Non-active:0SW4：#sysnameSW4#vlanbatch5to710203040#stpinstance1rootsecondarystpinstance2rootprimarystpinstance3rootsecondarystpinstance4rootprimary#dhcpenable#stpregion-configurationregion-namehwinstance1vlan10instance2vlan20instance3vlan30instance4vlan40activeregion-configuration#ippool5gateway-list10.1.1.100network10.1.1.0mask255.255.255.0excluded-ip-address10.1.1.110.1.1.99excluded-ip-address10.1.1.10110.1.1.128#ippool6gateway-list10.1.2.100network10.1.2.0mask255.255.255.0excluded-ip-address10.1.2.110.1.2.99excluded-ip-address10.1.2.10110.1.2.128#ippool7gateway-list10.1.3.100network10.1.3.0mask255.255.255.0excluded-ip-address10.1.3.110.1.3.99excluded-ip-address10.1.3.10110.1.3.128#ippool8gateway-list10.1.4.100network10.1.4.0mask255.255.255.0excluded-ip-address10.1.4.110.1.4.99excluded-ip-address10.1.4.10110.1.4.128#aaalocal-useradminpasswordcipherAdmin@123local-useradminprivilegelevel15local-useradminservice-typetelnet#interfaceVlanif1ipaddress192.168.1.424#interfaceVlanif5ipaddress10.1.5.3255.255.255.0vrrpvrid5virtual-ip10.1.5.100vrrpvrid5priority60#interfaceVlanif10ipaddress10.1.1.2255.255.255.0vrrpvrid1virtual-ip10.1.1.100vrrpvrid1priority60dhcpselectglobal#interfaceVlanif20ipaddress10.1.2.2255.255.255.0vrrpvrid2virtual-ip10.1.2.100vrrpvrid2priority120dhcpselectglobal#interfaceVlanif30ipaddress10.1.3.2255.255.255.0vrrpvrid3virtual-ip10.1.3.100vrrpvrid3priority60dhcpselectglobal#interfaceVlanif40ipaddress10.1.4.2255.255.255.0vrrpvrid4virtual-ip10.1.4.100vrrpvrid4priority120dhcpselectglobal#interfaceMEth0/0/1#interfaceEth-Trunk2portlink-typetrunkporttrunkallow-passvlan2to4094#interfaceGigabitEthernet0/0/1portlink-typeaccessportdefaultvlan5#interfaceGigabitEthernet0/0/2#interfaceGigabitEthernet0/0/3eth-trunk2#interfaceGigabitEthernet0/0/4eth-trunk2#interfaceGigabitEthernet0/0/5portlink-typetrunkporttrunkallow-passvlan2to4094#interfaceGigabitEthernet0/0/6portlink-typetrunkporttrunkallow-passvlan2to4094#iproute-static0.0.0.00.0.0.010.1.5.2#user-interfacevty04authentication-modeaaa<SW4>disstpbriefMSTIDPortRoleSTPStateProtection0GigabitEthernet0/0/1DESIFORWARDINGNONE0GigabitEthernet0/0/5ALTEDISCARDINGNONE0GigabitEthernet0/0/6ROOTFORWARDINGNONE0Eth-Trunk2ALTEDISCARDINGNONE1GigabitEthernet0/0/5DESIFORWARDINGNONE1GigabitEthernet0/0/6ROOTFORWARDINGNONE1Eth-Trunk2DESIFORWARDINGNONE2GigabitEthernet0/0/5DESIFORWARDINGNONE2GigabitEthernet0/0/6DESIFORWARDINGNONE2Eth-Trunk2DESIFORWARDINGNONE3GigabitEthernet0/0/5DESIFORWARDINGNONE3GigabitEthernet0/0/6ROOTFORWARDINGNONE3Eth-Trunk2DESIFORWARDINGNONE4GigabitEthernet0/0/5DESIFORWARDINGNONE4GigabitEthernet0/0/6DESIFORWARDINGNONE4Eth-Trunk2DESIFORWARDINGNONE<SW4>disvrrpbriefVRIDStateInterfaceTypeVirtualIP----------------------------------------------------------------1BackupVlanif10Normal10.1.1.1002MasterVlanif20Normal10.1.2.1003BackupVlanif30Normal10.1.3.1004MasterVlanif40Normal10.1.4.1005BackupVlanif5Normal10.1.5.100----------------------------------------------------------------Total:5Master:2Backup:3Non-active:0SW5：#sysnameSW5#vlanbatch5to7#aclnumber3000rule5permitipsource10.1.1.00.0.0.255destination10.1.2.00.0.0.255rule10permitipsource10.1.1.00.0.0.255destination10.1.3.00.0.0.255rule15permitipsource10.1.1.00.0.0.255destination10.1.4.00.0.0.255rule20permitipsource10.1.2.00.0.0.255destination10.1.1.00.0.0.255rule25permitipsource10.1.2.00.0.0.255destination10.1.3.00.0.0.255rule30permitipsource10.1.2.00.0.0.255destination10.1.4.00.0.0.255rule35permitipsource10.1.3.00.0.0.255destination10.1.1.00.0.0.255rule40permitipsource10.1.3.00.0.0.255destination10.1.2.00.0.0.255rule45permitipsource10.1.3.00.0.0.255destination10.1.4.00.0.0.255rule50permitipsource10.1.4.00.0.0.255destination10.1.1.00.0.0.255rule60permitipsource10.1.4.00.0.0.255destination10.1.2.00.0.0.255rule65permitipsource10.1.4.00.0.0.255destination10.1.3.00.0.0.255aclnumber3001rule5permitipsource10.1.1.00.0.0.255rule10permitipsource10.1.2.00.0.0.255aclnumber3002rule5permitipsource10.1.3.00.0.0.255rule10permitipsource10.1.4.00.0.0.255#trafficclassifierc1operatorandif-matchacl3000trafficclassifierc2operatorandif-matchacl3001trafficclassifierc3operatorandif-matchacl3002#trafficbehaviorb1permittrafficbehaviorb2redirectip-nexthop10.1.7.2trafficbehaviorb3redirectip-nexthop10.1.6.2#trafficpolicyp1classifierc2behaviorb2trafficpolicyp2classifierc3behaviorb3#aaalocal-useradminpasswordcipherAdmin@123local-useradminprivilegelevel15local-useradminservice-typetelnet#interfaceVlanif1ipaddress192.168.1.524#interfaceVlanif5ipaddress10.1.5.2255.255.255.0#interfaceVlanif6ipaddress10.1.6.1255.255.255.0#interfaceVlanif7ipaddress10.1.7.1255.255.255.0#interfaceMEth0/0/1#interfaceGigabitEthernet0/0/1portlink-typeaccessportdefaultvlan5traffic-policyp1inbound#interfaceGigabitEthernet0/0/2portlink-typeaccessportdefaultvlan5traffic-policyp2inbound#interfaceGigabitEthernet0/0/3portlink-typeaccessportdefaultvlan7#interfaceGigabitEthernet0/0