VLAN 简介
什么是VLAN呢？
VLAN（Virtual Local Area Network）即虚拟局域网，是将一个物理的LAN在逻辑上划分成多个广播域的通信技术。
VLAN有哪些作用呢？
一张图看懂VLAN的作用:
image
由上图可以看出：通过划分不同的VLAN，VLAN内的主机间可以直接通信，而VLAN间不能直接互通，从而将广播报文限制在一个VLAN内。
- 限制广播域：广播域被限制在一个VLAN内，节省了带宽，提高了网络处理能力。
- 增强局域网的安全性：不同VLAN内的报文在传输时是相互隔离的，即一个VLAN内的用户不能和其它VLAN内的用户直接通信。
- 提高网络的健壮性：故障被限制在一个VLAN内，本VLAN内的故障不会影响其他VLAN的正常工作
- 灵活构建虚拟工作组：用VLAN可以划分不同的用户到不同的工作组，同一工作组的用户也不必局限于某一固定的物理范围，网络构建和维护更方便灵活。
vlan划分实验
划分vlan拓扑图
image
配置参数表
image
以Switch1为例，演示配置：
Switch>en
Switch#conf ter
Switch(config)#vlan 10
Switch(config-vlan)#name v10
Switch(config-vlan)#exit
Switch(config)#vlan 20
Switch(config-vlan)#name v20
Switch(config-vlan)#exit
Switch(config)#vlan 30
Switch(config-vlan)#name v30
Switch(config-vlan)#exit
Switch(config)#hostname switchA
switchA(config)#interface fa0/1
switchA(config-if)#switchport access vlan 30 //端口划分到哪个vlan
switchA(config-if)#exit
switchA(config)#inter fa1/1
switchA(config-if)#swit
switchA(config-if)#switchport access vlan 20
switchA(config-if)#exit
switchA(config)#swi
switchA(config)#inter fa 2/1
switchA(config-if)#switchpo access vlan 10
switchA(config-if)#exit
switchA(config)#interface FastEthernet3/1
switchA(config-if)#switchport mode trunk //出口配置trunk
switchA(config)#exit
switchA#show vlan // 查看一下现在的vlan划分
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa3/1, Fa4/1, Fa5/1
10 v10 active Fa2/1
20 v20 active Fa1/1
30 v30 active Fa0/1
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
Switch2 做相应的操作，步骤几乎一样，不再赘述
Switch0 作为trunk，需要配置端口为trunk
switchC>en
switchC#config t
Enter configuration commands, one per line. End with CNTL/Z.
switchC(config)#interface fa0/1
switchC(config-if)#switchp mode trunk
switchC(config-if)#exit
switchC(config)#inte fa1/1
switchC(config-if)#switchp mode trunk
switchC(config-if)#exit
之后就划分好了vlan，然后以PC0为例（PC0是192.168.10.2 vlan10），应该只能通192.168.10.3（PC3-vlan10）
与其他主机因为vlan不同，广播包过不去。
PC>ping 192.168.20.2
Pinging 192.168.20.2 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.20.2:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
PC>ping 192.168.10.3
Pinging 192.168.10.3 with 32 bytes of data:
Reply from 192.168.10.3: bytes=32 time=0ms TTL=128
Reply from 192.168.10.3: bytes=32 time=0ms TTL=128
Reply from 192.168.10.3: bytes=32 time=1ms TTL=128
Reply from 192.168.10.3: bytes=32 time=0ms TTL=128
Ping statistics for 192.168.10.3:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
PC>ping 192.168.30.3
Pinging 192.168.30.3 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.30.3:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
PC>
vlan补充
不同的vlan是可以通过路由器转发进而通信的，如果将上述实验的拓扑改成一下，会发现vlan之间的也是可以通信的，这就是通过路由器转发而成的。
image
依旧以PC0为例
PC>ping 192.168.20.3
Pinging 192.168.20.3 with 32 bytes of data:
Request timed out.
Reply from 192.168.20.3: bytes=32 time=3ms TTL=127
Reply from 192.168.20.3: bytes=32 time=0ms TTL=127
Reply from 192.168.20.3: bytes=32 time=11ms TTL=127
Ping statistics for 192.168.20.3:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 11ms, Average = 4ms
PC>ping 192.168.30.2
Pinging 192.168.30.2 with 32 bytes of data:
Request timed out.
Reply from 192.168.30.2: bytes=32 time=0ms TTL=127
Reply from 192.168.30.2: bytes=32 time=10ms TTL=127
Reply from 192.168.30.2: bytes=32 time=10ms TTL=127
Ping statistics for 192.168.30.2:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 10ms, Average = 6ms
PC>
事实上，划分vlan不是为了让他们不能通信的，是限制他们在二层上（二层交换网络）直接通信。加上路由器就是为了让不同vlan通信。如果不想让两个网络通信可以在路由器上再加ACL做包过滤。
