S7500交换机上isolate-user-vlan的配置

S7500交换机上isolate-user-vlan的配置

 

一、组网需求：

1) Switch A交换机下接Switch B、Switch C交换机，要求从Switch A上看，Switch B、Switch C发出的报文都是不带VLAN Tag的，无需考虑下层交换机的VLAN配置。

2) Switch B上的VLAN 5为isolate-user-VLAN，包含上行端口Ethernet1/0/1和两个Secondary VLAN：VLAN 2和VLAN 3，VLAN 3包含端口Ethernet1/0/2，VLAN 2包含端口Ethernet1/0/5。

3) Switch C上的VLAN 6为isolate-user-VLAN，包含上行端口Ethernet1/0/1和两个Secondary VLAN：VLAN 3和VLAN 4，VLAN 3包含端口Ethernet1/0/3，VLAN 4包含端口Ethernet1/0/4。

二、组网图：

图1. 组网图

三、配置步骤：

 

1.配置Switch B

1) 配置isolate-user-VLAN。

<SwitchB> system-view

[SwitchB] vlan 5

[SwitchB-vlan5] isolate-user-vlan enable

2) 配置Secondary VLAN。

[SwitchB-vlan5] quit

[SwitchB] vlan 3

[SwitchB-vlan3] quit

[SwitchB] vlan 2

3) 将端口Ethernet1/0/2添加到isolate-user-VLAN和Secondary VLAN中，并配置untag操作

[SwitchB-vlan2] quit

[SwitchB] interface Ethernet 1/0/2

[SwitchB-Ethernet1/0/2] port link-type hybrid

[SwitchB-Ethernet1/0/2] port hybrid vlan 3 untagged

[SwitchB-Ethernet1/0/2] port hybrid vlan 5 untagged

[SwitchB-Ethernet1/0/2] port hybrid pvid vlan 3

4) 将端口Ethernet1/0/5添加到isolate-user-VLAN和Secondary VLAN中，并配置untag操作

[SwitchB-Ethernet1/0/2] quit

[SwitchB] interface Ethernet 1/0/5

[SwitchB-Ethernet1/0/5] port link-type hybrid

[SwitchB-Ethernet1/0/5] port hybrid vlan 2 untagged

[SwitchB-Ethernet1/0/5] port hybrid vlan 5 untagged

[SwitchB-Ethernet1/0/5] port hybrid pvid vlan 2

5) 将端口Ethernet1/0/1添加到isolate-user-VLAN和Secondary VLAN中，并配置untag操作

[SwitchB-Ethernet1/0/5] quit

[SwitchB] interface Ethernet 1/0/1

[SwitchB-Ethernet1/0/1] port link-type hybrid

[SwitchB-Ethernet1/0/1] port hybrid vlan 2 untagged

[SwitchB-Ethernet1/0/1] port hybrid vlan 3 untagged

[SwitchB-Ethernet1/0/1] port hybrid vlan 5 untagged

[SwitchB-Ethernet1/0/1] port hybrid pvid vlan 5

6) 配置isolate-user-VLAN和Secondary VLAN间的映射关系。

[SwitchB-Ethernet1/0/1] quit

[SwitchB] isolate-user-vlan 5 secondary 2 to 3

2.配置Switch C

1) 配置isolate-user-VLAN。

<SwitchC> system-view

[SwitchC] vlan 6

[SwitchC-vlan6] isolate-user-vlan enable

2) 配置Secondary VLAN。

[SwitchC-vlan6] quit

[SwitchC] vlan 3

[SwitchC-vlan3] vlan 4

3) 将端口Ethernet1/0/3添加到isolate-user-VLAN和Secondary VLAN中，并配置untag操作

[SwitchC-vlan4] quit

[SwitchC] interface Ethernet 1/0/3

[SwitchC-Ethernet1/0/3] port link-type hybrid

[SwitchC-Ethernet1/0/3] port hybrid vlan 3 untagged

[SwitchC-Ethernet1/0/3] port hybrid vlan 6 untagged

[SwitchC-Ethernet1/0/3] port hybrid pvid vlan 3

4) 将端口Ethernet1/0/4添加到isolate-user-VLAN和Secondary VLAN中，并配置untag操作

[SwitchC-Ethernet1/0/3] quit

[SwitchC] interface Ethernet1/0/4

[SwitchC-Ethernet1/0/4] port link-type hybrid

[SwitchC-Ethernet1/0/4] port hybrid vlan 4 untagged

[SwitchC-Ethernet1/0/4] port hybrid vlan 6 untagged

[SwitchC-Ethernet1/0/4] port hybrid pvid vlan 4

5) 将端口Ethernet1/0/1添加到isolate-user-VLAN和Secondary VLAN中，并配置untag操作

[SwitchC-Ethernet1/0/4] quit

[SwitchC] interface Ethernet 1/0/1

[SwitchC-Ethernet1/0/1] port link-type hybrid

[SwitchC-Ethernet1/0/1] port hybrid vlan 3 untagged

[SwitchC-Ethernet1/0/1] port hybrid vlan 4 untagged

[SwitchC-Ethernet1/0/1] port hybrid vlan 6 untagged

[SwitchC-Ethernet1/0/1] port hybrid pvid vlan 6

6) 配置isolate-user-VLAN和Secondary VLAN间的映射关系。

[SwitchC-Ethernet1/0/1] quit

[SwitchC] isolate-user-vlan 6 secondary 3 to 4

经过上述配置，Switch A可以接收到Switch B和Switch C发出的报文，而且全部是不携带VLAN Tag的报文。Switch B和Switch C各自配置的VLAN 3之间由于在到达A处理时已经去除了VLAN Tag，所以不能够通信，这就使下层交换机拥有仅本地有效的VLAN配置，从而达到了节约全局VLAN资源的目的。