Example for Assigning VLANs Based on Ports
Networking Requirements
In Figure 5-22, multiple user terminals are connected to switches in a data center. Users who use the same service all access the network using different devices.
To ensure communication security and avoid broadcast storms, the administrator wants to allow users who use the same service to communicate with each other but isolate users who use different services.
Configure the switch with port-based VLAN assignment and add ports connected to users who use the same service to the same VLAN. This way, users who use the same services can directly communicate, but users using different services cannot communicate over Layer 2.
Configuration Roadmap
- Create VLANs and add ports connected to users using different services to different VLANs to isolate Layer 2 traffic.
- Configure the type of link between SwitchA and SwitchB and VLANs to allow users who use the same service to communicate.
Procedure
- Create VLAN2 and VLAN3 on SwitchA, and add ports connecting to user terminals to different VLANs. Configuration of SwitchB is the same as that of SwitchA.
<HUAWEI> system-view [~HUAWEI] sysname SwitchA [*HUAWEI] commit [~SwitchA] vlan batch 2 3 [*SwitchA] interface 10ge 1/0/1 [*SwitchA-10GE1/0/1] port default vlan 2 [*SwitchA-10GE1/0/1] quit [*SwitchA] interface 10ge 1/0/2 [*SwitchA-10GE1/0/2] port default vlan 3 [*SwitchA-10GE1/0/2] quit [*SwitchA] commit
- Configure the type of the port connected to SwitchB on SwitchA and the allowed VLANs. The configuration of SwitchB is the same as that of SwitchA.
[~SwitchA] interface 10ge 1/0/3 [~SwitchA-10GE1/0/3] port link-type trunk [*SwitchA-10GE1/0/3] port trunk allow-pass vlan 2 3 [*SwitchA-10GE1/0/3] commit
- Verify the configuration.
Add User1 and User2 to the same IP address segment, for example, 192.168.100.0/24. Add User3 and User4 to the same IP address segment, for example, 192.168.200.0/24.
Only User1's and User2's terminals can ping each other. Only User3's and User4's terminals can ping each other.
Configuration Files
Configuration file of SwitchA
# sysname SwitchA # vlan batch 2 to 3 # interface 10GE1/0/1 port default vlan 2 # interface 10GE1/0/2 port default vlan 3 # interface 10GE1/0/3 port link-type trunk port trunk allow-pass vlan 2 to 3 # return
Configuration file of SwitchB
# sysname SwitchB # vlan batch 2 to 3 # interface 10GE1/0/1 port default vlan 2 # interface 10GE1/0/2 port default vlan 3 # interface 10GE1/0/3 port link-type trunk port trunk allow-pass vlan 2 to 3 # return