Example for Assigning VLANs Based on MAC Addresses
Networking Requirements
On a company network, the network administrator adds users in a department to the same VLAN. To improve information security, only users is this department are allowed to access the intranet.
In Figure 5-23, User1, User2, and User3 connect to the key department demanding high security. It is required that only the three users be allowed to access the intranet through Switch.
To improve information security of the key department, you can configure MAC address-based VLAN assignment and bind MAC addresses of User1, User2, and User3 to a VLAN.
Configuration Roadmap
Create VLANs and determine which VLAN the users of employees belong to.
Add Ethernet interfaces to VLANs so that packets from the VLANs can pass through the interfaces.
Associate MAC addresses of User1, User2, and User3 with the specified VLAN so that the VLAN of the packet can be determined based on the source MAC address.
Procedure
- Configure the Switch.
# Create VLANs.
<HUAWEI> system-view [~HUAWEI] sysname Switch [*HUAWEI] commit [~Switch] vlan batch 10 [*Switch] commit
# Add interfaces to the VLANs. The configuration of 10GE1/0/3 and 10GE1/0/4 is the same as that of 10GE1/0/2.
[~Switch] interface 10ge 1/0/1 [~Switch-10GE1/0/1] port link-type hybrid [*Switch-10GE1/0/1] port hybrid tagged vlan 10 [*Switch-10GE1/0/1] quit [*Switch] interface 10ge 1/0/2 [*Switch-10GE1/0/2] port link-type hybrid [*Switch-10GE1/0/2] port hybrid untagged vlan 10 [*Switch-10GE1/0/2] quit [*Switch] commit
# Associate MAC addresses of User1, User2, and User3 with VLAN 10.
[~Switch] vlan 10 [~Switch-vlan10] mac-vlan mac-address 22-22-22 [*Switch-vlan10] mac-vlan mac-address 33-33-33 [*Switch-vlan10] mac-vlan mac-address 44-44-44 [*Switch-vlan10] quit [*Switch] commit
# Enable MAC address-based VLAN assignment on 10GE1/0/2. The configuration of 10GE1/0/3 and 10GE1/0/4 is the same as that of 10GE1/0/2.
[~Switch] interface 10ge 1/0/2 [~Switch-10GE1/0/2] mac-vlan enable [*Switch-10GE1/0/2] quit [*Switch] commit
- Verify the configuration.
User1, User2, and User3 can access the intranet, whereas other users cannot access the intranet.
Configuration Files
Configuration file of the Switch
# sysname Switch # vlan batch 10 # vlan 10 mac-vlan mac-address 0022-0022-0022 mac-vlan mac-address 0033-0033-0033 mac-vlan mac-address 0044-0044-0044 # interface 10GE1/0/1 port link-type hybrid port hybrid tagged vlan 10 # interface 10GE1/0/2 port link-type hybrid port hybrid untagged vlan 10 mac-vlan enable # interface 10GE1/0/3 port link-type hybrid port hybrid untagged vlan 10 mac-vlan enable # interface 10GE1/0/4 port link-type hybrid port hybrid untagged vlan 10 mac-vlan enable # return