公司新增VLAN无法互通
- 0关注
- 1收藏，898浏览
问题描述：
公司架构如下，总部三层交换机为S3600 下面有四个部门，每个部门都是以二层交换机通过光纤的方式连接至 S3600，以下简称部门一部门二部门三部门四 部门一的网段为10.1.0.0 ，部门二的网段为10.3.0.0 部门三的网段为10.4.0.0 部门四的网段为192.168.2.0 现需在部门三新增一个网段为192.168.20.0 ，且更换了新的三层设备，为何新增这个VLAN20 的网段之后 无法通信？S3600的配置我贴在下方。
为什么没法放TXT文件
# sysname s3600 # super password level 3 cipher BJ>:3V;@ZI;Q=^Q`MAF4<1!! # dhcp-server 1 ip 10.0.0.1 dhcp relay information enable # radius scheme system # domain system # local-user h3c password cipher C"RV9X$G#7/Q=^Q`MAF4<1!! service-type ssh telnet level 3 # acl number 3001 rule 199 deny IP source 10.2.0.0 0.0.255.255 rule 200 permit IP source 10.2.0.0 0.0.255.255 destination 10.0.0.0 0.0.0.255 rule 210 permit IP source 10.2.0.0 0.0.255.255 destination 10.2.0.0 0.0.255.255 rule 220 permit IP source 10.2.0.0 0.0.255.255 destination 10.7.0.254 0 rule 230 permit IP source 10.2.1.2 0 rule 240 permit IP source 10.2.20.2 0 rule 250 permit IP source 10.2.15.2 0 rule 260 permit IP source 10.2.20.0 0.0.0.255 acl number 3002 rule 80 permit IP rule 90 deny IP source 10.1.4.0 0.0.0.255 destination 10.0.0.0 0.255.255.255 rule 101 permit IP source 10.1.4.0 0.0.0.255 destination 10.0.0.0 0.0.0.255 rule 110 permit IP source 10.1.4.0 0.0.0.255 destination 10.1.4.0 0.0.0.255 # vlan 1 # vlan 10 # vlan 20 # vlan 110 to 150 # vlan 201 to 220 # vlan 300 # vlan 400 # vlan 500 # vlan 701 # interface Vlan-interface1 ip address 192.168.1.254 255.255.255.0 # interface Vlan-interface10 ip address 10.0.0.254 255.255.255.0 # interface Vlan-interface20 ip address 192.168.10.1 255.255.255.0 # interface Vlan-interface110 ip address 10.1.1.1 255.255.255.0 # interface Vlan-interface120 ip address 10.1.2.1 255.255.255.0 # interface Vlan-interface130 ip address 10.1.3.1 255.255.255.0 # interface Vlan-interface140 ip address 10.1.4.1 255.255.255.0 # interface Vlan-interface150 ip address 10.1.5.1 255.255.255.0 # interface Vlan-interface201 ip address 10.2.1.1 255.255.255.0 # interface Vlan-interface202 ip address 10.2.2.1 255.255.255.0 # interface Vlan-interface203 ip address 10.2.3.1 255.255.255.0 # interface Vlan-interface204 ip address 10.2.4.1 255.255.255.0 # interface Vlan-interface205 ip address 10.2.5.1 255.255.255.0 # interface Vlan-interface206 ip address 10.2.6.1 255.255.255.0 # interface Vlan-interface207 ip address 10.2.7.1 255.255.255.0 # interface Vlan-interface208 ip address 10.2.8.1 255.255.255.0 # interface Vlan-interface209 ip address 10.2.9.1 255.255.255.0 # interface Vlan-interface210 ip address 10.2.10.1 255.255.255.0 # interface Vlan-interface211 ip address 10.2.11.1 255.255.255.0 # interface Vlan-interface212 ip address 10.2.12.1 255.255.255.0 # interface Vlan-interface213 ip address 10.2.13.1 255.255.255.0 # interface Vlan-interface214 ip address 10.2.14.1 255.255.255.0 # interface Vlan-interface215 ip address 10.2.15.1 255.255.255.0 # interface Vlan-interface216 ip address 10.2.16.1 255.255.255.0 # interface Vlan-interface217 ip address 10.2.17.1 255.255.255.0 # interface Vlan-interface218 ip address 10.2.18.1 255.255.255.0 # interface Vlan-interface219 ip address 10.2.19.1 255.255.255.0 # interface Vlan-interface220 ip address 10.2.20.1 255.255.255.0 # interface Vlan-interface300 ip address 10.3.1.1 255.255.255.0 # interface Vlan-interface400 ip address 10.4.1.1 255.255.255.0 # interface Vlan-interface500 ip address 10.5.1.1 255.255.255.0 # interface Vlan-interface701 ip address 10.7.0.1 255.255.255.0 # interface Aux1/0/0 # interface Ethernet1/0/1 # interface Ethernet1/0/2 port link-type trunk port trunk permit vlan 1 20 400 # interface Ethernet1/0/3 port link-type trunk port trunk permit vlan 1 201 to 220 300 packet-filter inbound ip-group 3001 rule 199 packet-filter inbound ip-group 3001 rule 200 packet-filter inbound ip-group 3001 rule 210 packet-filter inbound ip-group 3001 rule 220 packet-filter inbound ip-group 3001 rule 230 packet-filter inbound ip-group 3001 rule 240 packet-filter inbound ip-group 3001 rule 250 packet-filter inbound ip-group 3001 rule 260 # interface Ethernet1/0/4 port link-type trunk port trunk permit vlan 1 500 # interface Ethernet1/0/5 port link-type trunk port trunk permit vlan 1 100 to 150 # interface Ethernet1/0/6 port link-type trunk port trunk permit vlan 1 100 to 150 # interface Ethernet1/0/7 port link-type trunk port trunk permit vlan 1 100 to 150 500 # interface Ethernet1/0/8 port link-type trunk port trunk permit vlan 1 100 to 150 # interface Ethernet1/0/9 # interface Ethernet1/0/10 port access vlan 10 dhcp-snooping trust # interface Ethernet1/0/11 # interface Ethernet1/0/12 # interface Ethernet1/0/13 # interface Ethernet1/0/14 port access vlan 10 # interface Ethernet1/0/15 # interface Ethernet1/0/16 port access vlan 10 # interface Ethernet1/0/17 port access vlan 10 # interface Ethernet1/0/18 # interface Ethernet1/0/19 # interface Ethernet1/0/20 port access vlan 701 # interface Ethernet1/0/21 # interface Ethernet1/0/22 # interface Ethernet1/0/23 # interface Ethernet1/0/24 # interface GigabitEthernet1/1/1 port access vlan 701 # interface GigabitEthernet1/1/2 # interface GigabitEthernet1/1/3 port access vlan 701 # interface GigabitEthernet1/1/4 port access vlan 10 # undo irf-fabric authentication-mode # interface NULL0 # dhcp-snooping # voice vlan mac-address 0001-e300-0000 mask ffff-ff00-0000 # ip route-static 0.0.0.0 0.0.0.0 10.7.0.254 preference 60 ip route-static 10.4.1.0 255.255.255.0 10.4.1.254 preference 60 ip route-static 192.168.2.0 255.255.255.0 192.168.1.8 preference 60 # ssh authentication-type default password-publickey ssh user h3c authentication-type password ssh user h3c service-type stelnet # user-interface aux 0 7 user-interface vty 0 4 authentication-mode scheme user privilege level 3 set authentication password cipher C"RV9X$G#7/Q=^Q`MAF4<1!! # return
- 2019-07-04提问
- 举报
-
(0)
最佳答案
这配置没法看。。。
S3600是网关吗？二层交换机上放通vlan20了吗？网关设备上有没有终端的arp？
- 2019-07-04回答
- 评论(1)
- 举报
-
(0)
可以私聊我给你配置帮忙看一下吗？
#sysname s3600
#super password level 3 cipher BJ>:3V;@ZI;Q=^Q`MAF4<1!!
#dhcp-server 1 ip 10.0.0.1
dhcp relay information enable
# radius scheme system
# domain system
# local-user h3cpassword cipher C"RV9X$G#7/Q=^Q`MAF4<1!!service-type ssh telnetlevel 3
# acl number 3001
rule 199 deny IP source 10.2.0.0 0.0.255.255
rule 200 permit IP source 10.2.0.0 0.0.255.255 destination 10.0.0.0 0.0.0.255
rule 210 permit IP source 10.2.0.0 0.0.255.255 destination 10.2.0.0 0.0.255.255
rule 220 permit IP source 10.2.0.0 0.0.255.255 destination 10.7.0.254 0
rule 230 permit IP source 10.2.1.2 0
rule 240 permit IP source 10.2.20.2 0
rule 250 permit IP source 10.2.15.2 0
rule 260 permit IP source 10.2.20.0 0.0.0.255 acl number 3002
rule 80 permit IPrule 90 deny IP source 10.1.4.0 0.0.0.255 destination 10.0.0.0 0.255.255.255
rule 101 permit IP source 10.1.4.0 0.0.0.255 destination 10.0.0.0 0.0.0.255
rule 110 permit IP source 10.1.4.0 0.0.0.255 destination 10.1.4.0 0.0.0.255
# vlan 1 # vlan 10 # vlan 20 # vlan 110 to 150 # vlan 201 to 220 # vlan 300 # vlan 400 # vlan 500 # vlan 701
# interface Vlan-interface1
ip address 192.168.1.254 255.255.255.0
# interface Vlan-interface10
ip address 10.0.0.254 255.255.255.0
# interface Vlan-interface20
ip address 192.168.10.1 255.255.255.0
# interface Vlan-interface110
ip address 10.1.1.1 255.255.255.0
# interface Vlan-interface120
ip address 10.1.2.1 255.255.255.0
# interface Vlan-interface130
ip address 10.1.3.1 255.255.255.0
# interface Vlan-interface140
ip address 10.1.4.1 255.255.255.0
# interface Vlan-interface150
ip address 10.1.5.1 255.255.255.0
# interface Vlan-interface201
ip address 10.2.1.1 255.255.255.0
# interface Vlan-interface202
ip address 10.2.2.1 255.255.255.0
# interface Vlan-interface203
ip address 10.2.3.1 255.255.255.0
# interface Vlan-interface204
ip address 10.2.4.1 255.255.255.0
# interface Vlan-interface205
ip address 10.2.5.1 255.255.255.0
# interface Vlan-interface206
ip address 10.2.6.1 255.255.255.0
# interface Vlan-interface207
ip address 10.2.7.1 255.255.255.0
# interface Vlan-interface208
ip address 10.2.8.1 255.255.255.0
# interface Vlan-interface209
ip address 10.2.9.1 255.255.255.0
# interface Vlan-interface210
ip address 10.2.10.1 255.255.255.0
# interface Vlan-interface211
ip address 10.2.11.1 255.255.255.0
# interface Vlan-interface212
ip address 10.2.12.1 255.255.255.0
# interface Vlan-interface213
ip address 10.2.13.1 255.255.255.0
# interface Vlan-interface214
ip address 10.2.14.1 255.255.255.0
# interface Vlan-interface215
ip address 10.2.15.1 255.255.255.0
# interface Vlan-interface216
ip address 10.2.16.1 255.255.255.0
# interface Vlan-interface217
ip address 10.2.17.1 255.255.255.0
# interface Vlan-interface218
ip address 10.2.18.1 255.255.255.0
# interface Vlan-interface219
ip address 10.2.19.1 255.255.255.0
# interface Vlan-interface220
ip address 10.2.20.1 255.255.255.0
# interface Vlan-interface300
ip address 10.3.1.1 255.255.255.0
# interface Vlan-interface400
ip address 10.4.1.1 255.255.255.0
# interface Vlan-interface500
ip address 10.5.1.1 255.255.255.0
# interface Vlan-interface701
ip address 10.7.0.1 255.255.255.0
# interface Aux1/0/0
# interface Ethernet1/0/1
# interface Ethernet1/0/2
port link-type trunk
port trunk permit vlan 1 20 400
# interface Ethernet1/0/3
port link-type trunk
port trunk permit vlan 1 201 to 220 300
packet-filter inbound ip-group 3001 rule 199
packet-filter inbound ip-group 3001 rule 200
packet-filter inbound ip-group 3001 rule 210
packet-filter inbound ip-group 3001 rule 220
packet-filter inbound ip-group 3001 rule 230
packet-filter inbound ip-group 3001 rule 240
packet-filter inbound ip-group 3001 rule 250
packet-filter inbound ip-group 3001 rule 260
# interface Ethernet1/0/4
port link-type trunk
port trunk permit vlan 1 500
# interface Ethernet1/0/5
port link-type trunk
port trunk permit vlan 1 100 to 150
# interface Ethernet1/0/6
port link-type trunk
port trunk permit vlan 1 100 to 150
# interface Ethernet1/0/7
port link-type trunk
port trunk permit vlan 1 100 to 150 500
# interface Ethernet1/0/8
port link-type trunk
port trunk permit vlan 1 100 to 150
# interface Ethernet1/0/9
# interface Ethernet1/0/10
port access vlan 10
dhcp-snooping trust
# interface Ethernet1/0/11
# interface Ethernet1/0/12
# interface Ethernet1/0/13
# interface Ethernet1/0/14
port access vlan 10
# interface Ethernet1/0/15
# interface Ethernet1/0/16
port access vlan 10
# interface Ethernet1/0/17
port access vlan 10
# interface Ethernet1/0/18
# interface Ethernet1/0/19
# interface Ethernet1/0/20
port access vlan 701
# interface Ethernet1/0/21
# interface Ethernet1/0/22
# interface Ethernet1/0/23
# interface Ethernet1/0/24
# interface GigabitEthernet1/1/1
port access vlan 701
# interface GigabitEthernet1/1/2
# interface GigabitEthernet1/1/3
port access vlan 701
# interface GigabitEthernet1/1/4
port access vlan 10
#undo irf-fabric authentication-mode
# interface NULL0
#dhcp-snooping
#voice vlan mac-address 0001-e300-0000 mask ffff-ff00-0000
#ip route-static 0.0.0.0 0.0.0.0 10.7.0.254 preference 60
ip route-static 10.4.1.0 255.255.255.0 10.4.1.254 preference 60
ip route-static 192.168.2.0 255.255.255.0 192.168.1.8 preference 60
#ssh authentication-type default password-publickeyssh user h3c authentication-type passwordssh user h3c service-type stelnet
# user-interface aux 0 7 user-interface vty 0 4authentication-mode schemeuser privilege level 3set authentication password cipher C"RV9X$G#7/Q=^Q`MAF4<1!!
# return
- 2019-07-04回答
- 评论(2)
- 举报
-
(0)
你说你新增了个192.168.20.0 段，又说vlan20不通，你 # interface Vlan-interface20 ip address 192.168.10.1 255.255.255.0 ，这儿vlan20配的是192.168.10.0 /24 啊
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
可以私聊我给你配置帮忙看一下吗？