带有 VLAN 的 SG300 上的路由

网络工程 思科 路由 思科-SG300
2022-02-05 02:42:54

我的设置：

我从我的 ISP 收到一个/24公共 IP 子网（例如：）20.20.20.0/24。

我们的一些部门想要完全控制他们的公共 IP，所以我把它分成了几个/27子网。

一开始我想设置 3 个 VLAN：

  1. VLAN 100：20.20.20.32/27
  2. VLAN 200：20.20.20.128/27
  3. VLAN 5（WAN 连接）：20.20.20.0/30

交换机的网关是20.20.20.1。

我在 SG300-28 上配置了一条静态路由（处于 L3 模式）：

0.0.0.0/0超过20.20.20.1

VLAN 100 或 VLAN 200 中的客户端无法访问 ISP 网关或互联网。

如果我将客户端放在 VLAN 5 中，他当然可以连接到 GW 和互联网。

我是盲目地看到错误，所以我指望你们。

Cisco Packet Tracer 示例：PKT 文件

配置：

config-file-header
switche5bce7
v1.4.5.02 / R800_NIK_1_4_194_194
CLI v1.0
set system mode router 

file SSD indicator encrypted
@
ssd-control-start 
ssd config 
ssd file passphrase control unrestricted 
no ssd file integrity control 
ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0 
!
vlan database
vlan 5,10,100,200 
exit
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00d01e Pingtel_phone___________
voice vlan oui-table add 00e075 Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
ip dhcp server 
ip dhcp pool network Pool_5
address low 20.20.20.6 high 20.20.20.10 255.255.255.224 
default-router 20.20.20.5
dns-server 8.8.8.8
exit
ip dhcp pool network Pool_100
address low 20.20.20.34 high 20.20.20.62 255.255.255.224 
default-router 20.20.20.33
dns-server 8.8.8.8
exit
ip dhcp pool network Pool_200
address low 20.20.20.130 high 20.20.20.158 255.255.255.224 
default-router 20.20.20.129
dns-server 8.8.8.8
exit
bonjour interface range vlan 1
ip access-list extended VLAN_100-IN
permit ip any any ace-priority 1
exit
ip access-list extended VLAN_1-IN
permit ip any any ace-priority 1
exit
hostname switche5bce7
line console
no autobaud
exit
no passwords complexity enable 
username cisco password encrypted d033e22ae348aeb5660fc2140aec35850c4da997 privilege 15 
ip ssh server
ip ssh-client server authentication 
ip telnet server
!
interface vlan 1
 no ip address dhcp 
 service-acl input VLAN_1-IN default-action permit-any 
!
interface vlan 5
 name WAN 
!
interface vlan 10
 name MGMT 
 ip address 10.10.10.10 255.255.255.0 
!
interface vlan 100
 name VLAN_100 
 ip address 20.20.20.33 255.255.255.224 
 service-acl input VLAN_100-IN default-action permit-any 
!
interface vlan 200
 name VLAN_200 
 ip address 20.20.20.129 255.255.255.224 
!
interface gigabitethernet1
 ip address 20.20.20.2 255.255.255.252 
!
interface gigabitethernet2
 switchport mode access 
 switchport access vlan 5 
!
interface gigabitethernet3
 switchport mode access 
!
interface gigabitethernet4
 switchport mode access 
!
interface gigabitethernet5
 switchport mode access 
!
interface gigabitethernet10
 service-acl input VLAN_100-IN 
 switchport mode access 
 switchport access vlan 100 
!
interface gigabitethernet20
 switchport mode access 
 switchport access vlan 200 
!
interface gigabitethernet25
 switchport mode access 
 switchport access vlan 10 
!
interface gigabitethernet26
 switchport mode access 
 switchport access vlan 10 
!
exit
ip default-gateway 20.20.20.1
2个回答

由于 SG300 的限制，它不起作用。
SG300 没有路由端口。

我设置了一个干净的 SG300 配置，但无法访问 ISP 网关：
SG300 的配置：

config-file-header
switche5bce7
v1.4.5.02 / R800_NIK_1_4_194_194
CLI v1.0
set system mode router 

file SSD indicator encrypted
@
ssd-control-start 
ssd config 
ssd file passphrase control unrestricted 
no ssd file integrity control 
ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0 
!
vlan database
vlan 100,200 
exit
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00d01e Pingtel_phone___________
voice vlan oui-table add 00e075 Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
bonjour interface range vlan 1
hostname switche5bce7
no passwords complexity enable 
username cisco password encrypted d033e22ae348aeb5660fc2140aec35850c4da997 privilege 15 
!
interface vlan 100
 name "VLAN100" 
 ip address 20.20.20.33 255.255.255.224 
!
interface vlan 200
 name "VLAN200" 
 ip address 20.20.20.129 255.255.255.224 
!
interface gigabitethernet1
 ip address 20.20.20.2 255.255.255.252 
!
interface gigabitethernet10
 switchport mode access 
 switchport access vlan 100 
!
interface gigabitethernet20
 switchport mode access 
 switchport access vlan 200 
!
exit
ip default-gateway 20.20.20.1

之后，我设置了具有相同 VLAN 和配置的 Catalyst 3750 交换机，并且能够no switchport在Interface Gigabit1/0/1.

现在我可以到达应有的 ISP 网关了。
3750的配置：

Current configuration : 3535 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Switch
!
boot-start-marker
boot-end-marker
!
!
!
!
no aaa new-model
switch 1 provision ws-c3750x-24p
system mtu routing 1500
ip routing
!
!
!         
!
crypto pki trustpoint TP-self-signed-2617031040
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-2617031040
 revocation-check none
 rsakeypair TP-self-signed-2617031040
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
!
interface FastEthernet0
 no ip address
 no ip route-cache cef
 no ip route-cache
 no ip mroute-cache
!
interface GigabitEthernet1/0/1
 no switchport
 ip address 20.20.20.2 255.255.255.252
!
interface GigabitEthernet1/0/2
!
interface GigabitEthernet1/0/3
!
interface GigabitEthernet1/0/4
!
interface GigabitEthernet1/0/5
!
interface GigabitEthernet1/0/6
!
interface GigabitEthernet1/0/7
!
interface GigabitEthernet1/0/8
!
interface GigabitEthernet1/0/9
!
interface GigabitEthernet1/0/10
 switchport access vlan 100
 switchport mode access
!         
interface GigabitEthernet1/0/11
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/0/13
!
interface GigabitEthernet1/0/14
!
interface GigabitEthernet1/0/15
!
interface GigabitEthernet1/0/16
!
interface GigabitEthernet1/0/17
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
!
interface GigabitEthernet1/0/20
!
interface GigabitEthernet1/0/21
!
interface GigabitEthernet1/0/22
!
interface GigabitEthernet1/0/23
!
interface GigabitEthernet1/0/24
!
interface GigabitEthernet1/1/1
!
interface GigabitEthernet1/1/2
!
interface GigabitEthernet1/1/3
!
interface GigabitEthernet1/1/4
!
interface TenGigabitEthernet1/1/1
!
interface TenGigabitEthernet1/1/2
!
interface Vlan1
 no ip address
!
interface Vlan100
 ip address 20.20.20.33 255.255.255.224
!         
ip classless
ip route 0.0.0.0 0.0.0.0 20.20.20.1
ip http server
ip http secure-server
!
ip sla enable reaction-alerts
!
!
line con 0
line vty 0 4
 login
line vty 5 15
 login
!
end

你有几个问题：

  • 不需要 VLAN 5。
  • VLAN 10 应使用环回处理。
  • VLAN 100 引用了一个不存在的 ACL。
  • VLAN 没有默认路由。

尝试将此配置添加到您的交换机中：

no interface vlan 5
!
no interface vlan 10
!
vlan database
 no vlan 5
 no vlan 10
exit
!
no ip dhcp pool network Pool_5
!
interface loopback 1
 name MGMT 
 ip address 10.10.10.10 255.255.255.0 
!
interface vlan 100
 no service-acl input VLAN_100-IN default-action permit-any 
!
ip route 0.0.0.0 0.0.0.0 20.20.20.1
!
其它你可能感兴趣的问题
上一篇两台路由器DHCP服务器设置 下一篇如果我将一台交换机连接到另一台交换机的端口，是否会导致上层交换机的转发表不断更新？