18일차 PVLAN

 

erase start
delete vlan.dat

GW2이 맨 위에

en
conf t
cdp time 5
cdp hold 10
no ip domain lookup
line con 0
exec-t 0 0
logging syn
exi
hostname XX

\\\\\\\\\\\\\\\\\\\\\\\\\\
루트가드!!
ser-sw_f0/x --------------------- f0/x_DSW1

# ser-sw
vlan 10
exi
int fa 0/13
sw tr en dot
sw mo tr
sw tr all vlan 10
no shut
exi
spanning-tree vlan 10 priority 0

# DSW1
vlan 10
spann vlan 10 roo prima di 2
int fa 0/13
sw tr en do
sw mo tr
sw tr all vlan 10
spanning-tree guard root
no shut
exi
debug spann event

DSW# show spanning-tree vlan 10
// 루트가드를 권유한 곳에게서만 확인할 수 있다.
DSW# show spanning-tree inconsistentports
// 자기가 루트인지 확인

\\\\\\\\\\\\\\\

VACL (3560이 한대)

127.160.70.21,  22

GW2 2611

show ip int b
conf t
int fa 0/0
no shut
int fa 0/1
no shut
end
show cdp nei

conf t
int fa 0/1
ip add 121.160.70.22 255.255.255.0
ip nat outside
ip accounting
exi
int fa 0/0
ip add 10.1.100.254 255.255.255.0
ip nat inside
ip accouning
exi
ip route 0.0.0.0 0.0.0.0 121.160.70.254
ip route 10.1.0.0 255.255.0.0 10.1.100.250
ip nat inside source list 10 int fa 0/0
access-list 10 per 10.1.0.0 0.0.255.255

ip dhcp pool AA
network 10.1.10.0 /24
dns-server 168.126.63.1
lease 10
exi
ip dhcp excluded-add 10.1.10.240 10.1.10.254

GW-SW

int rang fa 0/1 - 12
shut
exi
vlan 100
int fa 0/3
sw mo acc
sw acc vlan 100
no shut
spann portfast
exi
int fa 0/11
no shut
sw tr en dot
sw mo tr
sw tr all vlan 100
sw nonego
exi

DSW-x
ip routing
vlan 10
vlan 100
exi
int fa 0/8
sw tr en dot
sw mo tr
sw tr all vlan 100
sw nonego
no shut
int fa 0/7
sw tr en dot
sw mo tr
sw tr all vlan 10
sw nonego
no shut
exi
int vlan 10
ip add 10.1.20.254 255.255.255.0
ip helper-add 10.1.100.254
exi
int vlan 100
ip add 10.1.100.250 255.255.255.0
exi
ip route 0.0.0.0 0.0.0.0 10.1.100.254

SW1(ser-sw/ASW/NAD)
vlan 10
int rag fa 0/1 - 24
shut
exi
int fa 0/a
no shut
sw tr en dot
sw mo tr
sw tr all vlan 10
sw nonego
exi
int fa 0/b
no shut
sw mo acc
sw acc vlan 10
spann portfast
spann bpdufilter enable
exi

---------------------------------
GW2
line vty 0 4
pass cisco
login
exi
enable pass cisco

pc
telnet 10.1.100.254
cisco
en
cisco

121.160.70.22
================막아보자
(dsw2)3560
ip access-list extend HTTP
per tcp any any eq 80
exi
ip access-list extend Telnet
per tcp any any eq 23
exi
vlan access-map AA 10
match ip add HTTP
action drop
vlan access-map AA 20
match ip add Telnet
action drop
exi
vlan filter AA vlan-list 10
vlan filter AA vlan-list 100
// action drop이므로 permit이 any가 거부가 된다.

\\\\\\\
실습다음주 private VLAN
3560이상만 가능하다

primary vlan이라는 대표vlan이 있다.
-secondary vlan라는 새끼가 있다.
    isolated vlan (오직 1개만 존재)  -- protect가 유사함
    community (복수개 가능)
    promiscuous (복수개 가능)

할당된 ip 121.160.70.22 한개로 각각 나누어 독립된 isolated vlan을 만들고 primary vlan으로 인터넷을 연결한다.
promiscuous로 내부단의 서버와는 통신가능하게 할 수 있다.