Table of Contents

Chapter 1 VLAN Overview.. 1-1

1.1 VLAN Support Matrix. 1-1

1.1.1 Support for VLAN on H3C Low-End Ethernet Switches. 1-1

1.2 Configuration Guide. 1-2

1.2.1 Configuring Basic VLAN Settings. 1-2

1.2.2 Configuring Basic Settings of a VLAN Interface. 1-4

1.2.3 Protocol VLAN Configuration. 1-5

Chapter 2 Configuration Examples. 2-1

2.1 VLAN Configuration Example. 2-1

2.1.1 Network Requirements. 2-1

2.1.2 Network Diagram.. 2-2

2.1.3 Configuration Outlines. 2-2

2.1.4 Configuration Procedure. 2-5

2.2 Precautions. 2-9

Chapter 3 Appendix. 3-1

3.1 Protocols and Standards. 3-1

 

VLAN Configuration Examples

Keywords: VLAN, 802.1q, VLAN interface, protocol VLAN

Abstract: This document introduces how VLAN of the H3C series Ethernet switches is applied and configured in practical networking implementations and how protocols are used in conjunction with VLANs.

Acronyms: VLAN (Virtual local area network)

 

Chapter 1  VLAN Overview

1.1  VLAN Support Matrix

1.1.1  Support for VLAN on H3C Low-End Ethernet Switches

Table 1-1 Support for VLAN on H3C low-end ethernet switches

Feature (right)	802.1Q VLAN	VLAN interface	Protocol VLAN
Model (below)
S3600-EI	l	l	l
S3600-SI	l	l	l
S5600	l	l	l
S5100-EI	l	¡	l
S3100-SI	l	¡	–
S3100-52P	l	l	–

 

 

1.2  Configuration Guide

 

 

1.2.1  Configuring Basic VLAN Settings

The H3C series switches support IEEE 802.1Q VLAN. The technology allows you to organize Ethernet ports into virtual workgroups by assigning them to different VLANs.

Follow these steps to create a VLAN and perform basic VLAN configuration:

To do...	Use the command...	Remarks
Enter system view	system-view	—
Create multiple VLANs in bulk	vlan { vlan-id1 to vlan-id2 | all }	Optional
Create a VLAN and enter VLAN view	vlan vlan-id	Required By default, only one default VLAN (VLAN 1) exists in the system.
Assign a name for the current VLAN	name text	Optional By default, the name of a VLAN is its VLAN ID, for example, VLAN 0001.
Configure the description of the current VLAN	description text	Optional By default, the description of a VLAN is its VLAN ID, for example, VLAN 0001.
Display VLAN information	display vlan [ vlan-id [ to vlan-id ] | all | dynamic | static ]	Available in any view

 

You can assign a port to a VLAN in Ethernet port view or in VLAN view.

Follow these steps to assign a port to a VLAN in VLAN view:

To do...	Use the command...	Remarks
Enter system view	system-view	—
Enter VLAN view	vlan vlan-id	—
Assign a list of Ethernet ports to the VLAN	port interface-list	Required By default, all ports belong to the default VLAN (VLAN 1).

 

 

Follow these steps to assign a port to a VLAN in Ethernet port view:

To do...		Use the command...	Remarks
Enter system view		system-view	—
Enter Ethernet port view		interface interface-type interface-number	—
Configure the port type		port link-type { access | trunk | hybrid }	Optional By defaults, all ports are access ports.
Assign the current port to the specified VLAN(s)	For an access port	port access vlan vlan-id	Required By default, all the three types of ports belong to the default VLAN (VLAN 1).
	For a trunk port	port trunk permit vlan { vlan-id-list | all }
	For a hybrid port	port hybrid vlan vlan-id-list { tagged | untagged }
Specify the default VLAN for the current port	For a trunk port	port trunk pvid vlan vlan-id	Optional By default, the default VLAN of an Ethernet port is VLAN 1. Because an access port can be assigned to only one VLAN, its default VLAN is the VLAN to which it belongs. Therefore, you do not need to configure a default VLAN for it.
	For a hybrid port	port hybrid pvid vlan vlan-id

 

1.2.2  Configuring Basic Settings of a VLAN Interface

You can enable your switch to perform Layer 3 forwarding by configuring VLAN interfaces with IP addresses on the switch.

Follow these steps to configure basic settings of a VLAN interface:

To do...	Use the command...	Remarks
Enter system view	system-view	—
Create a VLAN interface and enter VLAN interface view	interface Vlan-interface vlan-id	Required By default, no VLAN interface exists.
Assign an IP address to the current VLAN interface	ip address ip-address { mask | mask-length } [ sub ]	Required No IP address is assigned to any VLAN interface by default.
Configure the description of the current VLAN interface	description text	Optional By default, the description of a VLAN interface is its name, for example, Vlan-interface1 Interface.
Shut down the VLAN interface	shutdown	Optional By default, a VLAN interface is in the up state. In this case, the VLAN interface is up so long as one port in the VLAN is up and goes down if all ports in the VLAN go down. An administratively shut down VLAN interface however will be in the down state until you bring it up, regardless of how the state of the ports in the VLAN changes.
Bring up the VLAN interface	undo shutdown
Display information about the VLAN interface	display interface Vlan-interface [ vlan-id ]	Available in any view

 

 

1.2.3  Protocol VLAN Configuration

Protocol VLAN enables your switch to assign an incoming untagged frame to a VLAN based on its protocol. To configure a protocol VLAN, first create a protocol template to enable protocol VLAN, and then assign Ethernet ports to the protocol VLAN.

Follow these steps to configure a protocol VLAN:

To do...	Use the command...	Remarks
Enter system view	system-view	—
Enter VLAN view	vlan vlan-id	—
Create a protocol template	protocol-vlan [ protocol-index ] { at | ip | ipx { ethernetii | llc | raw | snap } | mode { ethernetii etype etype-id | llc { dsap dsap-id ssap ssap-id } | snap etype etype-id } }	Required No protocol template exists by default.
Return to system view	quit	—
Enter Ethernet port view	interface interface-type interface-number	—
Configure the port as a hybrid port	port link-type hybrid	Required All Ethernet ports are access ports by default.
Assign the port to the protocol VLAN and configure the port to forward the frames of the VLAN with their VLAN tag removed	port hybrid vlan vlan-id untagged	Required All ports belong to VLAN 1 by default.
Associate the port with the protocol VLAN	port hybrid protocol-vlan vlan vlan-id { protocol-index [ to protocol-index-end ] | all }	Required By default, an Ethernet port is not associated with any protocol VLAN.
Display information about the protocol templates of the specified VLAN(s)	display protocol-vlan vlan { vlan-id [ to vlan-id ] | all }	Available in any view
Display information about the protocol templates of the protocol VLANs associated with the specified port(s)	display protocol-vlan interface { interface-type interface-number [ to interface-type interface-number ] | all }

 

Chapter 2  Configuration Examples

2.1  VLAN Configuration Example

2.1.1  Network Requirements

A company has three departments: the R&D department, the marketing department, and the design department. The three departments are located in the same building. The R&D department and the marketing department are located in different office areas. The design department and part of the R&D department share the same office area. The hosts of the design department use the Apple operating system (OS), and the hosts of the other two departments use Windows. Use VLANs to fulfill the following:

l           Employees of the same department can communicate with each other, while employees of different departments cannot.

l           The R&D department and the marketing department are on different IP network segments. A switch (Core-Switch A in Figure 2-1) assigns addresses to hosts of the two departments automatically.

l           Both the R&D department and the marketing department can access the public servers. However, the design server and the R&D server are accessible to only the employees of the design department and the R&D department respectively.

l           The hosts and server of the R&D department and those of the design department cannot access the Internet; the hosts and server of the marketing department and those of the design department cannot access the VPN of the R&D department.

2.1.2  Network Diagram

Figure 2-1 Network diagram for VLAN configuration

2.1.3  Configuration Outlines

I. Configuration on Switch A

Figure 2-2 Network diagram for Switch A

On Switch A, assign the port connecting to the independent office area of the R&D department and the port connecting to the independent office area of the marketing department to different VLANs, thus isolating the two areas.

As the shared office area is used by two departments, assigning the port connecting to the area to a VLAN cannot isolate the two departments. Considering that the design department and the R&D department use different operating systems, you can assign Apple hosts whose network protocol is Appletalk and Windows hosts whose network protocol is IP to different protocol VLANs.

Configure GigabitEthernet 1/1/1 to permit frames of all existing VLANs to pass through with VLAN tags for VLAN identification.

II. Configuration on Switch B

Figure 2-3 Network diagram for Switch B

On Switch B, assign the port connecting to the marketing department and the port connecting to the R&D department to different VLANs. Note that, the configuration of the VLAN to which a department belongs must be the same on both Switch A and Switch B. Configure the port connecting to Core-Switch A to permit the frames of all existing VLANs to pass through with VLAN tags.

III. Configuration on Core-Switch A

Figure 2-4 Network diagram for Core-Switch A

On Core-Switch A, configure the port connecting to Switch B to permit the frames of the three departments to pass through.

Configure Core-Switch A as the DHCP server for IP address assignment. As it is the egress device for the R&D department to access the VPN, configure Core-Switch A as the gateway for the R&D department and configure the port connecting to the VPN to permit only the frames of the R&D department to pass through. As Core-Switch B is the egress device for accessing the Internet and only the marketing department is allowed to access the Internet, configure Core-Switch B as the gateway for the marketing department.

IV. Configuration on Core-Switch B

Figure 2-5 Network diagram for Core-Switch B

Each server is connected to Core-Switch B through an individual port. Assign these ports to different VLANs to provide the departments exclusive access to their respective servers.

As the public servers are accessible to both the R&D department and the marketing department, create an individual VLAN for the public servers to forward Layer 3 traffic between the servers and the clients. As Core-Switch A forwards Layer 3 traffic between the R&D department and the public servers, configure the link between Core-Switch B and Core-Switch A to permit the frames of the VLAN created for the public servers to pass through besides the frames of the three departments.

As Core-Switch B is the egress device for accessing the Internet and only the marketing department is allowed to access the Internet, configure a VLAN interface with an IP address for the VLAN of the marketing department and configure the port connecting to the Internet to permit only the frames of the VLAN to pass through. The IP address of the VLAN interface will be used as the gateway address for the marketing department on Core-Switch A.

V. Summary

Assign the hosts and server of the R&D department, those of the marketing department, and those of the design department to VLAN 100, VLAN 200, and VLAN 300 respectively. The public servers belong to VLAN 500 and lie on the network segment 192.168.50.0. The following diagram shows the planned VLANs:

Figure 2-6 Network diagram for the deployment of VLANs

2.1.4  Configuration Procedure

I. Device and version used

S3600 series, Test 1510.

II. Configuration procedure

l           Configure Switch A

# Create VLAN 100, VLAN 200, and VLAN 300.

<SwitchA> system-view

[SwitchA] vlan 100

[SwitchA-vlan100] quit

[SwitchA] vlan 200

[SwitchA-vlan200] quit

[SwitchA] vlan 300

[SwitchA-vlan300]

[SwitchA-vlan300] quit

# Assign Ethernet 1/0/5 to VLAN 100.

[SwitchA] interface Ethernet 1/0/5

[SwitchA-Ethernet1/0/5] port access vlan 100

[SwitchA-Ethernet1/0/5] quit

# Assign Ethernet 1/0/7 to VLAN 200.

[SwitchA] interface Ethernet 1/0/7

[SwitchA-Ethernet1/0/7] port access vlan 200

[SwitchA-Ethernet1/0/7] quit

# Create a protocol template for VLAN 100 to carry IP and a protocol template for VLAN 300 to carry Appletalk.

[SwtichA] vlan 100

[SwitchA-vlan100] protocol-vlan ip

[SwitchA-vlan100] quit

[SwitchA] vlan 300

[SwitchA-vlan300] protocol-vlan at

[SwitchA-vlan300] quit

# Create a user-defined protocol template for VLAN 100 to carry ARP for IP communication, assuming that Ethernet_II encapsulation is used.

[SwitchA] vlan 100

[SwitchA-vlan100] protocol-vlan mode ethernetii etype 0806

# Configure Ethernet 1/0/10 as a hybrid port permitting the frames of VLAN 100 and VLAN 300 to pass through untagged.

[SwitchA] interface Ethernet 1/0/10

[SwitchA-Ethernet1/0/10] port link hybrid

[SwitchA-Ethernet1/0/10] port hybrid vlan 100 300 untagged

# Associate Ethernet 1/0/10 with all the protocol templates of VLAN 100 and VLAN 300.

[SwitchA-Ethernet1/0/10] port hybrid protocol-vlan vlan 100 all

[SwitchA-Ethernet1/0/10] port hybrid protocol-vlan vlan 300 all

[SwitchA-Ethernet1/0/10] quit

# Configure GigabitEthernet 1/1/1 as a trunk port permitting the frames of VLAN 100, VLAN 200, and VLAN 300 to pass through with VLAN tags.

[SwitchA] interface GigabitEthernet 1/1/1

[SwitchA-GigabitEthernet1/1/1] port link-type trunk

[SwitchA-GigabitEthernet1/1/1] port trunk permit vlan 100 200 300

l           Configure Switch B

# Create VLAN 100, VLAN 200, and VLAN 300 on Switch B as you have done on Switch A.

# Assign Ethernet 1/0/2 and Ethernet 1/0/3 to VLAN 200 and VLAN 100 respectively.

<SwitchB> system-view

[SwitchB] interface Ethernet 1/0/2

[SwitchB-Ethernet1/0/2] port access vlan 200

[SwitchB-Ethernet1/0/2] quit

[SwitchB] interface Ethernet 1/0/3

[SwitchB-Ethernet1/0/3] port access vlan 100

[SwitchB-Ethernet1/0/3] quit

# Configure GigabitEthernet 1/1/1 and GigabitEthernet 1/1/2 as trunk ports permitting the frames of VLAN 100, VLAN 200, and VLAN 300 to pass through with VLAN tags.

[SwitchB] interface GigabitEthernet 1/1/1

[SwitchB-GigabitEthernet1/1/1] port link-type trunk

[SwitchB-GigabitEthernet1/1/1] port trunk permit vlan 100 200 300

[SwitchB-GigabitEthernet1/1/1] quit

[SwitchB] interface GigabitEthernet 1/1/2

[SwitchB-GigabitEthernet1/1/2] port link-type trunk

[SwitchB-GigabitEthernet1/1/2] port trunk permit vlan 100 200 300

[SwitchB-GigabitEthernet1/1/2] quit

l           Configure Core-Switch A

# Create VLAN 100, VLAN 200, and VLAN 300 on Core-Switch A. The configuration procedure is the same as that on Switch A.

# Configure GigabitEthernet 1/1/1 and GigabitEthernet 1/1/2 as trunk ports permitting the frames of VLAN 100, VLAN 200, and VLAN 300 to pass through with VLAN tags. The configuration procedure is the same as that on Switch B.

# Create VLAN-interface 100 and assign it IP address 192.168.30.1. Use this address as the IP address of the gateway for the R&D department. Allocate IP addresses in the address pool 192.168.30.0/24 for the hosts of the R&D department.

[Core-SwitchA] dhcp enable

[Core-SwitchA] interface Vlan-interface 100

[Core-SwitchA-Vlan-interface100] ip address 192.168.30.1 24

[Core-SwitchA-Vlan-interface100] dhcp select interface

[Core-SwitchA-Vlan-interface100] quit

# Create a global IP address pool mk with the address segment 192.168.40.0/24 to allocate IP addresses for the hosts of the marketing department. Configure the gateway IP address as 192.168.40.1 for the hosts, pointing to Core-Switch B.

[Core-SwitchA] dhcp server ip-pool mk

[Core-SwitchA-dhcp-pool-mk] network 192.168.40.0 mask 255.255.255.0

[Core-SwitchA-dhcp-pool-mk] gateway-list 192.168.40.1

 

 

# Create VLAN 500 and VLAN-interface 500 on Core-Switch A and assign IP address 192.168.50.1/24 to VLAN-interface 500. Configure the trunk port GigabitEthernet 1/1/1 to carry VLAN 500 and configure GigabitEthernet 1/1/1 to permit the frames of VLAN 500 to pass through with VLAN tags.

[Core-SwitchA] vlan 500

[Core-SwitchA-vlan500] quit

[Core-SwitchA] interface Vlan-interface 500

[Core-SwitchA-Vlan-interface500] ip address 192.168.50.1 24

[Core-SwitchA-Vlan-interface500] quit

[Core-SwitchA] interface GigabitEthernet 1/1/1

[Core-SwitchA-GigabitEthernet1/1/1] port trunk permit vlan 500

# Create a VLAN-interface on Core-Switch A to forward traffic of the R&D department to the VPN and assign an IP address to the VLAN-interface. Assign Ethernet 1/0/20 to the VLAN corresponding to the VLAN-interface. The configuration procedure is omitted here.

l           Configuration on Core-Switch B

# Create VLAN 100, VLAN 200, VLAN 300, and VLAN 500 on Core-Switch B. The configuration procedure is the same as that on Switch A.

# Configure GigabitEthernet 1/1/1 as a trunk port permitting the frames of VLAN 100, VLAN 200, VLAN 300, and VLAN 500 to pass through with VLAN tags. The configuration procedure is omitted here.

# Create a VLAN-interface on Core-Switch B to forward traffic of the marketing department to the Internet and assign an IP address to the VLAN-interface. Assign Ethernet 1/0/15 to the VLAN corresponding to the VLAN-interface. The configuration procedure is omitted here.

# Configure GigabitEthernet 1/1/3 and GigabitEthernet 1/1/4 to permit only the frames of VLAN 300 and only the frames of VLAN 100 to pass through respectively.

# Configure GigabitEthernet 1/1/2 to permit only the frames of VLAN 500 to pass through.

# Assign IP address 192.168.40.1 to VLAN-interface 200. The configuration procedure is omitted here.

III. Configuration remarks

After you finish the configuration, the hosts of the three departments should be isolated at the data link layer.

As no VLAN interface is created for the VLAN of the marketing department on the VPN gateway Core-Switch A, the hosts of the marketing department should not be able to access the VPN or the R&D department through Layer 3 forwarding. Similarly, as no VLAN interface is created for the VLAN of the R&D department on the Internet gateway Core-Switch B, the hosts of the R&D department should not be able to access the Internet or the marketing department through Layer 3 forwarding.

Thus, all departments are isolated at both the data link layer and the network layer.

 

 

2.2  Precautions

l           Because IP depends on ARP for address resolution in Ethernet, you are recommended to configure the IP and ARP templates in the same VLAN and associate them with the same port to prevent communication failure.

l           The maximum number of protocol templates that can be bound to a port varies by device.

 

Chapter 3  Appendix

3.1  Protocols and Standards

IEEE 802.1Q: Virtual Bridged Local Area Networks