49 стр.
cisco · 8 стр.
Cisco Configuring Wired Dynamic PVLAN: Руководство по настройке и ограничениям (EN)
Оригинальное название: Cisco Configuring Wired Dynamic PVLAN: Руководство по настройке и ограничениям
Похожие инструкции
49 стр.
22 стр.
55 стр.
24 стр.
24 стр.
30 стр.
40 стр.
Содержание
Текст документа
Information About Wired Dynamic PVLAN
Configuring Wired Dynamic PVLAN The following sections provide information about configuring wired dynamic PVLAN: Restrictions for Wired Dynamic PVLAN, on page 1 Information About Wired Dynamic PVLAN, on page 1 Configuring Wired Dynamic PVLAN, on page 3 Feature History for Wired Dynamic PVLAN, on page 8 Restrictions for Wired Dynamic PVLAN • High availability is not supported with Wired Dynamic PVLAN. • Voice VLAN configuration cannot co-exist with this feature. • Local Web Authentication (LWA) and Central Web Authentication (CWA) cannot be used with this feature. • All wired clients using the dynamic PVLAN interface template will be programmed as data clients.
• Only interfaces with existing Access or PVLAN Host switchport mode support PVLAN template. • Identity Based Networking Services 2.0 (IBNS 2.0) must be used for dynamic template support. Information About Wired Dynamic PVLAN Wired Dynamic PVLAN is a feature that uses a private VLAN with AAA authorization to isolate clients and provide Zero-Trust. It is a method to block peer to peer communications within a subnet/VLAN. Here, the client is assigned to a PVLAN which isolates a wired client connected on one port from all other ports on Layer 2 while the Layer 3 communication occurs via the promiscuous port.
In this feature, a single wired data client is supported per port interface, to ensure point-to-point blocking. Traffic from multiple clients on the same interface will not be blocked. Note Configuring Wired Dynamic PVLAN 1
Information About Wired Dynamic PVLAN
In this topology, the hosts are connected to Switch A and they can communicate only with the promiscuous trunk port on the switch. The PVLAN can be extended to span across multiple switches by adding intermediate switches. If there is a switch (Switch C) between Switch A and Switch B in the above topology, then layer 2 trunk ports need to be configured on the intermediate links. If case of a community VLAN, it allows packets to be seen on other hosts within the same community VLAN. When a host is connected to a switch port with a cable, it is placed into an Isolated PVLAN where it cannot discover any other hosts. The host is then authenticated by the RADIUS server.
Another scenario is when the port is placed in closed mode, and if the port is not authenticated, only Extensible Authentication Protocol over LAN (EAPoL) packets are allowed. Once the port is authenticated it is placed into an Isolated VLAN dynamically. As the host first authenticates with the RADIUS server, it sends the name of a dynamic interface template to be applied to the host's port. This interface template contains the configurations to enable the PVLAN Primary and Secondary VLANs on the port. With the template applied to the host, the switchport mode will be changed which will cause the port to flap from access mode to PVLAN mode.
Configuring Wired Dynamic PVLAN Information About Wired Dynamic PVLAN Configuring Wired Dynamic PVLAN 2
Configuring Wired Dynamic PVLAN
The interface template with the same name as referred by AAA Authorization needs to be configured on the switch. Note When the interface template is being applied, the port will physically go down for a time period set by the sticky timer and come up again. When the RADIUS server sends the interface template a second time, it is ignored as the conversion has been completed. The port is then assigned to a PVLAN which keeps it isolated. The host completes authorization and comes up to ready state. Configure the keep time for which the interface template information is retained before it is removed from the port using the access-session interface-template sticky timer time command.
Configuring Wired Dynamic PVLAN To configure Wired Dynamic PVLAN, perform these steps on the user device (Switch A in the above topology): Before you begin Ensure that the dot1x aaa is configured on the user device. Procedure Configuring Wired Dynamic PVLAN Configuring Wired Dynamic PVLAN Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode. Enter your password if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 vlan vlan-id Example: Device(config)# vlan 200 (Optional) Enters VLAN configuration mode and designates or creates a VLAN that will be an isolated VLAN.
The VLAN ID range is 2 to 1001 and 1006 to 4094. Step 4 private-vlan isolated Example: Device(config-vlan)# private-vlan isolated Designates the VLAN as an isolated VLAN. Configuring Wired Dynamic PVLAN 3
Configuring Wired Dynamic PVLAN
Configuring Wired Dynamic PVLAN Configuring Wired Dynamic PVLAN Command or Action Purpose Step 5 exit Example: Device(config-vlan)# exit Returns to global configuration mode. Step 6 vlan vlan-id Example: Device(config)# vlan 100 Enters VLAN configuration mode and designates or creates a VLAN that will be the primary VLAN. The VLAN ID range is 2 to 1001 and 1006 to 4094. Step 7 private-vlan primary Example: Device(config-vlan)# private-vlan primary Designates the VLAN as the primary VLAN. Step 8 private-vlan association [add | remove] secondary vlan list _ _ Example: Device(config-vlan)# private-vlan association 200 Associates the secondary VLANs with the primary VLAN.
It can be a single private-VLAN ID or a hyphenated range of private-VLAN IDs. • The secondary vlan list parameter _ _ cannot contain spaces. It can contain multiple comma-separated items. Each item can be a single private-VLAN ID or a hyphenated range of private-VLAN IDs. • The secondary vlan list parameter can _ _ contain multiple community VLAN IDs but only one isolated VLAN ID. • Enter a secondary vlan list, or use the _ _ add keyword with a secondary vlan list _ _ to associate secondary VLANs with a primary VLAN. • Use the remove keyword with a secondary vlan list to clear the _ _ association between secondary VLANs and a primary VLAN.
• The command does not take effect until you exit VLAN configuration mode. Step 9 exit Example: Returns to global configuration mode. Configuring Wired Dynamic PVLAN 4