目录
1.交换机学习和转发
案例
1.设置静态地址表项
2.配置黑洞mac地址表项
1.交换机学习和转发
交换机工作在数据链路层。当交换机从某个端口收到一个帧时,它并不是向所有的接口转发此帧,而是根据此帧的目的MAC地址,查找交 换机中的交换表(又称为MAC地址表),然后将该帧转发到某个端口 (称为转发),或者把它丢弃(称为过滤)。
交换机运行自学习算法自动维护交换表。交换机从某端口收到一数据帧后,先进行自学习,之后进行帧的转发处理。
首先取得源MAC地址,然后查找交换表,确定其中是否有与收到帧 的源地址相匹配的MAC地址。
(1)如没有,就在交换表中增加一个表项,记录源MAC地址、所属 VLAN、进入的端口和老化时间。
(2)如有,则把原有的表项进行更新,更新进入的端口和老化时 间。 然后取得目的地址,查找交换表中,确定是否有与收到帧的目的 MAC地址相匹配的地址。
(1)如没有,则向所有其他端口(进入的端口除外)转发(称之 为广播)。
(2)如有,则按交换表中给出的端口进行转发(称之为单播)。
(3)若交换表中给出的端口就是该帧进入交换机的端口,则丢弃 这个帧,因为这时目的站和源站都在同一个端口方向上,不需要经过交 换机进行转发。
然后取得目的地址,查找交换表中,确定是否有与收到帧的目的 MAC地址相匹配的地址。
(1)如没有,则向所有其他端口(进入的端口除外)转发(称之 为广播)。
(2)如有,则按交换表中给出的端口进行转发(称之为单播)。
(3)若交换表中给出的端口就是该帧进入交换机的端口,则丢弃 这个帧,因为这时目的站和源站都在同一个端口方向上,不需要经过交 换机进行转发。
mac地址表
每一条表 项都有一个生存周期,到达生存周期仍得不到刷新的表项将被删除,这个生存周期被称作老化时间。如果在到达生存周期前某表项被刷新,则重新计算该表项的老化时间。
mac地址表项
静态mac地址
· 静态MAC地址表项不会老化,保存后设备重启不会消失,只能手动删除。
· 静态MAC地址表项中指定的VLAN必须已经创建,且已经加入绑定的端口。
· 静态MAC地址表项中指定的MAC地址必须是单播MAC地址,不能是组播和广播MAC地址。 · 静态MAC地址表项的优先级高于动态MAC地址表项。
案例
1.设置静态地址表项
按如下进行配置
按照上图做以下配置
因为PC1和PC2在同一个网段,所以可以互ping
PC>ping 192.168.100.12
Ping 192.168.100.12: 32 data bytes, Press Ctrl_C to break
From 192.168.100.12: bytes=32 seq=1 ttl=128 time=47 ms
From 192.168.100.12: bytes=32 seq=2 ttl=128 time=31 ms
From 192.168.100.12: bytes=32 seq=3 ttl=128 time=31 ms
From 192.168.100.12: bytes=32 seq=4 ttl=128 time=62 ms
From 192.168.100.12: bytes=32 seq=5 ttl=128 time=31 ms
--- 192.168.100.12 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 31/40/62 ms
PC>ping 192.168.100.11
Ping 192.168.100.11: 32 data bytes, Press Ctrl_C to break
From 192.168.100.11: bytes=32 seq=1 ttl=128 time=47 ms
From 192.168.100.11: bytes=32 seq=2 ttl=128 time=47 ms
From 192.168.100.11: bytes=32 seq=3 ttl=128 time=47 ms
From 192.168.100.11: bytes=32 seq=4 ttl=128 time=47 ms
From 192.168.100.11: bytes=32 seq=5 ttl=128 time=47 ms
--- 192.168.100.11 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 47/47/47 ms
PC1和PC2也能ping Server1
PC>ping 192.168.100.2
Ping 192.168.100.2: 32 data bytes, Press Ctrl_C to break
From 192.168.100.2: bytes=32 seq=1 ttl=255 time=16 ms
From 192.168.100.2: bytes=32 seq=2 ttl=255 time=46 ms
From 192.168.100.2: bytes=32 seq=3 ttl=255 time=16 ms
From 192.168.100.2: bytes=32 seq=4 ttl=255 time=15 ms
From 192.168.100.2: bytes=32 seq=5 ttl=255 time=16 ms
--- 192.168.100.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 15/21/46 ms
PC>ping 192.168.100.2
Ping 192.168.100.2: 32 data bytes, Press Ctrl_C to break
From 192.168.100.2: bytes=32 seq=1 ttl=255 time=32 ms
From 192.168.100.2: bytes=32 seq=2 ttl=255 time=15 ms
From 192.168.100.2: bytes=32 seq=3 ttl=255 time=16 ms
From 192.168.100.2: bytes=32 seq=4 ttl=255 time=31 ms
From 192.168.100.2: bytes=32 seq=5 ttl=255 time=47 ms
--- 192.168.100.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 15/28/47 ms
对LSW1进行配置
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]display device
S5700-28C-HI's Device status:
Slot Sub Type Online Power Register Status Role
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
0 - 5728C Present PowerOn Registered Normal Master
[Huawei]sysname LSW1
#显示交换机mac地址表
[LSW1]display mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-98ed-52ad 1 - - GE0/0/1 dynamic 0/-
5489-9885-10ce 1 - - GE0/0/3 dynamic 0/-
5489-9875-1fce 1 - - GE0/0/2 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 3
#显示交换机MAC地址表的静态表项
[LSW1]display mac-address static
#显示交换机MAC地址表的动态表项
[LSW1]dis mac-address dynamic
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-98ed-52ad 1 - - GE0/0/1 dynamic 0/-
5489-9885-10ce 1 - - GE0/0/3 dynamic 0/-
5489-9875-1fce 1 - - GE0/0/2 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 3
[LSW1]display mac-address g0/0/3
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9885-10ce 1 - - GE0/0/3 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
[LSW1]display mac-address static g0/0/3
[LSW1]display mac-address dynamic g0/0/3
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9885-10ce 1 - - GE0/0/3 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
[LSW1]display mac-address dynamic g0/0/3
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9885-10ce 1 - - GE0/0/3 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
#显示交换机VLAN1的mac地址表项
[LSW1]display mac-address vlan 1
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-98ed-52ad 1 - - GE0/0/1 dynamic 0/-
5489-9875-1fce 1 - - GE0/0/2 dynamic 0/-
5489-9885-10ce 1 - - GE0/0/3 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 3
#显示交换机的静态表项
[LSW1]display mac-address static vlan 1
#显示交换机vlan1学习到的mac地址表项
[LSW1]display mac-address dynamic vlan 1
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-98ed-52ad 1 - - GE0/0/1 dynamic 0/-
5489-9875-1fce 1 - - GE0/0/2 dynamic 0/-
5489-9885-10ce 1 - - GE0/0/3 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 3
可以看到交换机的mac地址存储的都是动态地址,没有静态地址
注:若 MAC地址表为空,请重新执行步骤4,然后重新执行上述显示交换机MAC 地址表的相关命令。因为MAC地址表项的默认老化时间为300秒,超过这 个时间的表项都被清除了
由上面执行的代码可以看出
PC1的mac地址 5489-98ed-52ad
PC2的mac地址 5489-9875-1fce
Server1的mac地址 5489-9885-10ce
静态mac地址需要手动配置
[LSW1]mac-address static 5489-9885-10ce gigabitethernet 0/0/3 vlan 1
[LSW1]mac-address static 5489-98ed-52ad gigabitethernet 0/0/1 vlan 1
[LSW1]mac-address static 5489-9875-1fce gigabitethernet 0/0/2 vlan 1
[LSW1]display mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-98ed-52ad 1 - - GE0/0/1 static -
5489-9885-10ce 1 - - GE0/0/3 static -
5489-9875-1fce 1 - - GE0/0/2 static -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 3
[LSW1]display mac-address dynamic
此时,就算删除PC1到交换机的连线,重新建立连线,pc1也能ping通pc2或server1
因为静态MAC地址表项不会老化,保存后设备重启不会消失,只能手动删除
如何删除静态表项?
#动态地址表项会老化,一定要重新ping,才能显示正确结果
[LSW1]undo mac-address static 5489-98ed-52ad gigabitethernet 0/0/1 vlan 1
[LSW1]display mac-address static
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9885-10ce 1 - - GE0/0/3 static -
5489-9875-1fce 1 - - GE0/0/2 static -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 2
[LSW1]display mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9885-10ce 1 - - GE0/0/3 static -
5489-9875-1fce 1 - - GE0/0/2 static -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 2
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-98ed-52ad 1 - - GE0/0/1 dynamic 0/-
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
2.配置黑洞mac地址表项
以上图为例,禁止PC-1对网络的访问,将PC-1的 MAC地址配置为黑洞MAC地址。
配置黑洞mac地址
#将PC-1的mac地址添加为黑洞表项,默认时,所有端口都属于虚拟局域网vlan 1
[LSW1]mac-address blackhole 5489-98ed-52ad vlan 1
[LSW1]display mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-98ed-52ad 1 - - - blackhole -
5489-9885-10ce 1 - - GE0/0/3 static -
5489-9875-1fce 1 - - GE0/0/2 static -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 3
[LSW1]display mac-address blackhole
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-98ed-52ad 1 - - - blackhole -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
[LSW1]display mac-address blackhole vlan 1
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-98ed-52ad 1 - - - blackhole -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1
[LSW1]
PC1和PC2 可以ping Server1
PC>ping 192.168.100.2
Ping 192.168.100.2: 32 data bytes, Press Ctrl_C to break
From 192.168.100.11: Destination host unreachable
From 192.168.100.11: Destination host unreachable
From 192.168.100.11: Destination host unreachable
From 192.168.100.11: Destination host unreachable
From 192.168.100.11: Destination host unreachable
--- 192.168.100.2 ping statistics ---
5 packet(s) transmitted
0 packet(s) received
100.00% packet loss
Ping 192.168.100.2: 32 data bytes, Press Ctrl_C to break
From 192.168.100.2: bytes=32 seq=1 ttl=255 time=47 ms
From 192.168.100.2: bytes=32 seq=2 ttl=255 time=31 ms
From 192.168.100.2: bytes=32 seq=3 ttl=255 time=31 ms
From 192.168.100.2: bytes=32 seq=4 ttl=255 time=15 ms
From 192.168.100.2: bytes=32 seq=5 ttl=255 time=16 ms
--- 192.168.100.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 15/28/47 ms
删除黑洞表项
<LSW1>sys
Enter system view, return user view with Ctrl+Z.
[LSW1]undo mac-address blackhole 5489-98ed-52ad vlan 1
[LSW1]display mac-address
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-9885-10ce 1 - - GE0/0/3 static -
5489-9875-1fce 1 - - GE0/0/2 static -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 2
[LSW1]display mac-address blackhole
#无黑洞表项