75 phút
Switching và VLAN
Switching và VLAN
Cisco IOS
Command Modes
User EXEC mode (>) - Read-only
Privileged EXEC mode (#) - All commands
Global config (config)# - Global config
Interface config (config-if)#
Line config (config-line)#
Router config (config-router)#
Basic Commands
Router> enable # Enter privileged
Router# configure terminal # Enter global config
Router(config)# hostname SW01 # Set hostname
SW01(config)# exit # Back
SW01# disable # Back to user mode
# Save config
SW01# write memory
SW01# copy running-config startup-config
# Show config
SW01# show running-config
SW01# show startup-config
SW01# show version
SW01# show ip interface brief
SW01# show interfaces
SW01# show mac address-table
SW01# show vlan
Help Features
? - Context help
TAB - Autocomplete
show ? - List show commands
sh ip int br - Abbreviation
Ctrl+A - Beginning of line
Ctrl+E - End of line
Ctrl+Z - Exit to privileged
Ctrl+C - Cancel command
Switch Configuration
Initial Setup
Switch> enable
Switch# configure terminal
Switch(config)# hostname SW01
SW01(config)# enable secret Cisco123
SW01(config)# line console 0
SW01(config-line)# password Console123
SW01(config-line)# login
SW01(config-line)# exit
SW01(config)# line vty 0 4
SW01(config-line)# password Vty123
SW01(config-line)# login
SW01(config-line)# transport input ssh
SW01(config-line)# exit
SW01(config)# service password-encryption
SW01(config)# banner motd # Authorized access only #
SW01(config)# end
SW01# write memory
Interface Configuration
SW01(config)# interface FastEthernet0/1
SW01(config-if)# description "Uplink to Core"
SW01(config-if)# speed 100
SW01(config-if)# duplex full
SW01(config-if)# no shutdown
SW01(config-if)# exit
# Range
SW01(config)# interface range fa0/1-10
SW01(config-if-range)# switchport mode access
SW01(config-if-range)# switchport access vlan 10
SW01(config-if-range)# spanning-tree portfast
SW01(config-if-range)# exit
Management IP
SW01(config)# interface vlan 1
SW01(config-if)# ip address 192.168.1.10 255.255.255.0
SW01(config-if)# no shutdown
SW01(config-if)# exit
SW01(config)# ip default-gateway 192.168.1.1
MAC Address Table
View MAC table
SW01# show mac address-table
SW01# show mac address-table dynamic
SW01# show mac address-table interface fa0/1
SW01# show mac address-table vlan 10
SW01# show mac address-table address 0001.2222.3333
Static MAC
SW01(config)# mac address-table static 0001.2222.3333 vlan 10 interface fa0/5
Port Security
SW01(config)# interface fa0/1
SW01(config-if)# switchport mode access
SW01(config-if)# switchport port-security
SW01(config-if)# switchport port-security maximum 2
SW01(config-if)# switchport port-security mac-address sticky
SW01(config-if)# switchport port-security violation shutdown
SW01(config-if)# end
# Verify
SW01# show port-security
SW01# show port-security interface fa0/1
SW01# show port-security address
# Violation types:
# Protect - Drop, no notification
# Restrict - Drop, increment counter, SNMP trap
# Shutdown - Err-disable port (default)
VLAN
VLAN Ranges
0 - Reserved
1 - Default VLAN (không xóa được)
2-1001 - Normal VLAN range
1002-1005 - Reserved (Token Ring, FDDI)
1006-4094 - Extended range
Create VLAN
SW01(config)# vlan 10
SW01(config-vlan)# name Sales
SW01(config-vlan)# exit
SW01(config)# vlan 20
SW01(config-vlan)# name HR
SW01(config-vlan)# exit
# Verify
SW01# show vlan brief
SW01# show vlan id 10
Assign Ports to VLAN
# Access port
SW01(config)# interface fa0/1
SW01(config-if)# switchport mode access
SW01(config-if)# switchport access vlan 10
SW01(config-if)# exit
# Voice VLAN
SW01(config)# interface fa0/5
SW01(config-if)# switchport mode access
SW01(config-if)# switchport access vlan 10
SW01(config-if)# switchport voice vlan 100
SW01(config-if)# mls qos trust cos
Trunk Ports
# Manual trunking (không khuyến nghị)
SW01(config)# interface gi0/1
SW01(config-if)# switchport trunk encapsulation dot1q
SW01(config-if)# switchport mode trunk
SW01(config-if)# switchport trunk native vlan 99
SW01(config-if)# switchport trunk allowed vlan 10,20,30
SW01(config-if)# exit
# DTP (Dynamic Trunking Protocol)
# switchport mode:
# - access
# - trunk
# - dynamic auto (chờ bên kia)
# - dynamic desirable (chủ động)
# Best practice: hardcode
SW01(config-if)# switchport nonegotiate
Verify Trunk
SW01# show interfaces trunk
SW01# show interfaces gi0/1 switchport
SW01# show vlan brief
Native VLAN
VLAN mà traffic untagged đi qua trunk
Mặc định: VLAN 1
Best practice: đổi thành VLAN khác (VD: 999)
Phải giống nhau 2 đầu trunk!
Cấu hình:
SW01(config)# vlan 999
SW01(config-vlan)# name Native
SW01(config-vlan)# exit
SW01(config)# interface gi0/1
SW01(config-if)# switchport trunk native vlan 999
Inter-VLAN Routing
Router-on-a-Stick
# Router
Router(config)# interface gi0/0
Router(config-if)# no shutdown
Router(config-if)# exit
Router(config)# interface gi0/0.10
Router(config-subif)# encapsulation dot1q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config-subif)# exit
Router(config)# interface gi0/0.20
Router(config-subif)# encapsulation dot1q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0
Router(config-subif)# exit
# Switch port to router
SW01(config)# interface gi0/1
SW01(config-if)# switchport mode trunk
SW01(config-if)# switchport trunk native vlan 999
Layer 3 Switch (SVI)
SW01(config)# ip routing
SW01(config)# vlan 10
SW01(config-vlan)# exit
SW01(config)# interface vlan 10
SW01(config-if)# ip address 192.168.10.1 255.255.255.0
SW01(config-if)# no shutdown
SW01(config-if)# exit
SW01(config)# vlan 20
SW01(config-vlan)# exit
SW01(config)# interface vlan 20
SW01(config-if)# ip address 192.168.20.1 255.255.255.0
SW01(config-if)# no shutdown
SW01(config-if)# exit
# Routed port (không phải SVI)
SW01(config)# interface gi0/1
SW01(config-if)# no switchport
SW01(config-if)# ip address 10.0.0.1 255.255.255.252
VTP (VLAN Trunking Protocol)
VTP Modes
Server - Create, modify, delete VLANs, advertise
Client - Receive updates, không tạo được VLAN
Transparent - Local only, forward VTP
Off - Disabled (VTPv3)
VTP Configuration
SW01(config)# vtp mode server
SW01(config)# vtp domain COMPANY
SW01(config)# vtp password Cisco123
SW01(config)# vtp version 2
# Client
SW02(config)# vtp mode client
SW02(config)# vtp domain COMPANY
SW02(config)# vtp password Cisco123
# Verify
SW01# show vtp status
SW01# show vtp password
VTP Pruning
SW01(config)# vtp pruning
# Giảm broadcast traffic trên trunk links
STP (Spanning Tree Protocol)
STP Port States
Blocking - 20s (max age)
Listening - 15s (forward delay)
Learning - 15s (forward delay)
Forwarding - Operational
Disabled - Shutdown
Total convergence: 30-50s
STP Timers
Hello: 2 seconds
Max Age: 20 seconds
Forward Delay: 15 seconds
STP Port Roles
Root Port - 1 per non-root switch (best path to root)
Designated Port - 1 per segment (forwarding)
Non-Designated Port - Blocking
Root Bridge Election
Lowest Bridge ID wins
Bridge ID = Priority (4 bits) + MAC (48 bits)
Default priority: 32768
Cấu hình:
SW01(config)# spanning-tree vlan 10 root primary
SW01(config)# spanning-tree vlan 20 root secondary
SW01(config)# spanning-tree vlan 10 priority 4096
Verify STP
SW01# show spanning-tree
SW01# show spanning-tree vlan 10
SW01# show spanning-tree summary
SW01# show spanning-tree interface fa0/1
SW01# show spanning-tree root
PortFast và BPDU Guard
# Global (trên tất cả access ports)
SW01(config)# spanning-tree portfast default
# Interface
SW01(config)# interface range fa0/1-10
SW01(config-if-range)# spanning-tree portfast
SW01(config-if-range)# spanning-tree bpduguard enable
SW01(config-if-range)# exit
# Global BPDU Guard
SW01(config)# spanning-tree portfast bpduguard default
# BPDU Filter
SW01(config-if-range)# spanning-tree bpdufilter enable
# Cẩn thận khi dùng - có thể tạo loop
Rapid PVST+ (RSTP)
SW01(config)# spanning-tree mode rapid-pvst
# Port states (RSTP):
# Discarding (Blocking + Listening + Disabled)
# Learning
# Forwarding
# Convergence: < 1s
EtherChannel
# LACP (IEEE)
SW01(config)# interface range gi0/1-2
SW01(config-if-range)# shutdown
SW01(config-if-range)# switchport mode trunk
SW01(config-if-range)# channel-protocol lacp
SW01(config-if-range)# channel-group 1 mode active
SW01(config-if-range)# no shutdown
SW01(config-if-range)# exit
SW01(config)# interface port-channel 1
SW01(config-if)# switchport mode trunk
SW01(config-if)# exit
# PAgP (Cisco)
SW01(config-if-range)# channel-group 1 mode desirable
# Static
SW01(config-if-range)# channel-group 1 mode on
# Verify
SW01# show etherchannel summary
SW01# show etherchannel port-channel
SW01# show lacp neighbor
Bài tập thực hành
Hãy cấu hình VLAN và trunk!