Spanning-Tree Port-priority Example

未調整前，Port-Priority先比較Port-ID   

調整介面Port-Priority值


!-----手動指定為vlan 4,44,52,63的Spanning-tree Root
spanning-tree vlan 4,44,52,63 root primary

! -----手動指定fa0/14的Spanning-tree Port-Priority為32
interface FastEthernet0/14
spanning-tree vlan 4,44,52,63 port-priority 32

! -----手動指定fa0/15的Spanning-tree Port-Priority為16
interface FastEthernet0/15
spanning-tree vlan 4,44,52,63 port-priority 16

驗證方式
#show spanning-tree vlan 44 detail
Port 15 (FastEthernet0/13) of VLAN0044 is blocking
Designated port id is 128.15, designated path cost 0  
-----預設值128

Port 16 (FastEthernet0/14) of VLAN0044 is blocking
Designated port id is 32.16, designated path cost 0
-----手動調整為32

Port 17 (FastEthernet0/15) of VLAN0044 is forwarding
Designated port id is 16.17, designated path cost 0   
-----手動調整為16 (值較低故優先)

Fall Back Bridge Example

 

!-----啟動Integrated Routing and Bridging模式
bridge irb

! -----指定Bridge-Group 1 (Fa0/0介面界接SW1 VLAN 10)
interface FastEthernet0/0
no ip address
bridge-group 1

!-----指定Bridge-Group 1 (Fa0/0介面界接SW2 VLAN 20)
interface FastEthernet0/1
no ip address
bridge-group 1

! -----建立Bridge Virtual Interface
interface BVI1
ip address 192.168.1.254 255.255.255.0

! -----指定Bridge-Group的封裝模式為802.1q
bridge 1 protocol ieee

!-----指定Bridge-Group的Routing模式為IP Routing
bridge 1 route ip

驗證方式
#show interface irb | begin FastEthernet0/0
FastEthernet0/0
Routed protocols on FastEthernet0/0:
ip
Bridged protocols on FastEthernet0/0:
appletalk clns decnet ip

#show interface irb | begin FastEthernet0/1
FastEthernet0/1
Routed protocols on FastEthernet0/1:
ip
Bridged protocols on FastEthernet0/1:
appletalk clns decnet ip

802.1x & Radius Auth Example

!-----透過aaa來指定802.1x所使用的認證機制
aaa new-model
aaa authentication dot1x default group radius

!-----啟動系統的802.1x認證機制
dot1x system-auth-control

!-----在介面上啟動802.1x認證機制
interface FastEthernet0/9
switchport mode access
dot1x port-control auto
!
interface FastEthernet0/10
switchport mode access
dot1x port-control auto

!-----指定連線到Radius主機所使用的IP位址
ip radius source-interface Loopback0

!-----指定用來認證的Radius主機位址
radius-server host 204.12.1.100

驗證方式
#show dot1x
Sysauthcontrol = Enabled
Supplicant Allowed In Guest Vlan = Disabled
Dot1x Protocol Version = 1

#show dot1x all
Dot1x Info for interface FastEthernet0/9
<output omitted>
HostMode = Single
PortControl = Auto
ControlDirection = Both
QuietPeriod = 60 Seconds
Re-authentication = Disabled
<output omitted>
Dot1x Info for interface FastEthernet0/10

#show aaa servers
RADIUS: id 1, priority 1, host 204.12.1.100, auth-port 1645, acct-port
1646
State: current UP, duration 3634s, previous duration 0s

DTP-Dymanic Trunking Protocol

DTP模式介紹
1. 手動指定
╠switchport mode access (手動指定為Access)
╠switchport mode trunk (手動指定為Trunk)
╚switchport nonegotiate (關閉協商)
2. 動態協商
╠switchport mode dynamic auto (被動協商) (預設值)
╚switchport mode dynamic desitable (主動協商)

注意
兩端點設備的" VTP Domain "需一致方能進行動態協商，手動指定則無此限制

DTP協商關係一覽表

	Dynamic Auto (自動協商) (被動)	Dynamic Desirable (自動協商) (主動)	Trunk (手動指定)	Access (手動指定)
Dynamic Auto (自動協商) (被動)	Access	Trunk	Trunk	Access
Dynamic Desirable (自動協商) (主動)	Trunk	Trunk	Trunk	Access
Trunk (手動指定)	Trunk	Trunk	Trunk	不建議
Access (手動指定)	Access	Access	不建議	Access

設定範例
DTP trunk mode in L3 Switch
1. 指定封裝模式

(conf-int)#switchport trunk encapsulation [do1q | isl ]
2. 指定DTP模式
(conf-int)#switchport mode trunk
3. 指定允許通過的VLAN

(conf-int)#switcgport trunk allow vlan 1-10
4. 指定不被允許通過的VLAN (除了…其他都允許)
(conf-int)#switchport trink allow vlan except 1-10

DTP trunk mode in L2 Switch
1. 指定DTP模式

(conf-int)#switchport mode trunk

DTP access mode

1. 指定DTP模式
(conf-int)#switchport mode access
2. 指定允許通過的VLAN
(conf-int)#switchport access vlan 10

DTP dynamic auto mode (被動協商) (預設值)
1. 指定DTP模式
(conf-int)#switchport mode dynamic auto

 

DTP dynamic desirable mode (主動協商) 
1. 指定DTP模式
(conf-int)#switchport mode dynamic Desirable

DTP nonegotiate mode (關閉協商)
1. 指定DTP模式
(conf-int)#switchport mode dynamic Desirable

透過esxcfg或vicfg指令集設定VMware ESXi 4.1 vSwitch & dvSwitch

Single vSwitch Topology 
 

Single dvSwich Topology 


Single Cisco Nexus 1000v Topology

Multiple dvSwitch Topology

Hybrid vSwitch & dvSwitch Topology

Hybrid vSwitch & Cisco Nexus 1000v Topology

顯示現有的網卡狀態
esxcfg-nics -l

顯示現有的vSwitch狀態
esxcfg-vswitch -l

顯示現有的vmknic狀態
esxcfg-vmknic -l

vSwitch設定
Step1 建立vSwitch
新增vSwitch
esxcfg-vswitch -a "vSwitch Name"
ex: esxcfg-vswitch -a vSwitch0

刪除vSwitch
esxcfg-vswitch -d "vSwitch Name"
ex: esxcfg-vswitch -d vSiwtch0

Step2 將實體網卡與vSwitch做連結
將vmnic0增加到vSwitch上
esxcfg-vswitch –L "網卡名稱" "vSwitch Name"
ex: esxcfg-vswitch -L vmnic0 vSwitch0

將vmnic0從vSwitch上移除
esxcfg-vswitch -U "網卡名稱" "vSwitch Name"
ex: esxcfg-vswitch -U vmnic0 vSwitch0

Step3 建立vSwitch上的Port Group
新增Port Group到vSwitch上
esxcfg-vswitch -A "vSwitch Port Group Name" "vSwitch Name"
ex: esxcfg-vswitch -A vSwitch-PG vSwitch0

刪除vSwitch上的Port Group
esxcfg-vswitch -D "vSwitch Port Group Name" "vSwitch Name"
ex: esxcfg-vswitch -D vSwitch-PG vSwitch0

Step4 新增IP到vSwitch上的Port Group
新增VMkernel的IP到vSwitch上
esxcfg-vmknic -a –i "IP位址" -n "子網路遮罩" "vSwitch Port Group Name"
ex: esxcfg-vmknic -a -i 192.168.1.1 -n 255.255.255.0 vSwitch-PG

移除vSwitch上的VMkernel
esxcfg-vmknic –d "VMkernel網卡" "vSwitch Name"
ex: esxcfg-vmknic -d vmk0 vSwitch0

dvSwitch設定
Step1 透過vSphere Client連線到vCenter建立dvSwitch

Step2 透過vSphere Client連線到vCenter建立dvSwitch上的Port Group

Step3 透過vSphere Client連線到vCenter的Host上透過升級方式將vSwitch移轉到dvSwitch上

當設定錯誤導致無法連線時,可直接於Host透過下列指令對dvSwitch做調整
將實體網卡與vSwitch做連結
將vmnic0增加到dvSwitch上
esxcfg-vswitch -P "網卡名稱" "dvSwitch Name"
ex: esxcfg-vswitch –P vmnic0 dvSwitch0

將實體網卡從dvSwitch上移除
esxcfg-vswitch -Q "網卡名稱" -V "dvSwitch Port ID" "dvSwitch Name"  
ex: esxcfg-vswitch -Q vmnic0 -V 100 dvSwitch0

新增IP到dvSwitch上的Port Group
新增VMkernel的IP到dvSwitch上
esxcfg-vmknic -a -i "IP位址" -n "子網路遮罩" -s "dvSwitch Name" -v "dvSwitch Port ID"
ex: esxcfg-vmknic -a -i 172.16.1.1 -n 255.255.255.0 -s dvSwitch0 -v 100

移除dvSwitch上的VMkernel
esxcfg-vmknic –d "VMKernel網卡名稱" -s "dvSwitch Name" -v "dvSwitch Port ID"
ex: esxcfg-vmknic -d vmk0 -s dvSwitch0 -v 100

參考文件 vSphere Command-Line Interface Installation and Scripting Guide

Frame-Relay EEK & PPP over Frame-Relay

Topology

NET檔案

CONFIG檔案

R1
!
!Basic Setting
conf t
hostname R1
logging console
no ip domain-lookup
end
!
!Basic IP Setting
conf t
int lo 0
ip add 10.1.1.1 255.255.255.0
no sh
!
int s 0/0
ip add 10.0.1.1 255.255.255.0
no sh
end
!
!Frame-Relay Setting
conf t
int s 0/0
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay lmi-type ansi
frame-relay interface-dlci 102
frame-relay interface-dlci 103
frame-relay map ip 10.0.1.1 102 broadcast
frame-relay map ip 10.0.1.2 102 broadcast
frame-relay map ip 10.0.1.3 103 broadcast
end
!
!Basic Dynamic Routing Setting
conf t
router eigrp 100
passive-interface lo 0
network 10.0.0.0
no auto
end

R2
!
!Basic Setting
conf t
hostname R2
logging console
no ip domain-lookup
end
!
!Basic IP Setting
conf t
int lo 0
ip add 10.2.2.2 255.255.255.0
no sh
!
int s 0/0
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay lmi-type ansi
no ip add
no sh
end
!
!Frame-Relay Setting
conf t
int s 0/0.201 point-to-point
ip add 10.0.1.2 255.255.255.0
no frame-relay inverse-arp
frame-relay interface-dlci 201
no sh
!
int s 0/0.203 point-to-point
no frame-relay inverse-arp
frame-relay interface-dlci 203
no sh
end
!
!Frame-Relay EEK Setting
conf t
map-class frame-relay EEK
frame-relay end-to-end keepalive mode bidirectional
end
!
conf t
int s 0/0.203 point-to-point
frame-relay interface-dlci 203
class EEK
end
!
!PPP Over Frame-Relay Setting
conf t
int s 0/0.203
frame-relay interface-dlci 203 ppp virtual-template 1
int virtual-template 1
ip add 10.0.23.2 255.255.255.0
no sh
!
!fix PPP over Frame-Relay IGP prefix error
conf t
int virtual-template 1
no peer neighbor-route
end
!
!fix ppp over Frame-Relay ping self error
conf t
int virtual-template 1
ppp multilink
end
!
!Basic Dynamic Routing Setting
conf t
router eigrp 100
passive-interface lo 0
network 10.0.0.0
no auto
end

R3
!
!Basic Setting
conf t
hostname R3
logging console
no ip domain-lookup
end
!
!Basic IP Setting
conf t
int lo 0
ip add 10.3.3.3 255.255.255.0
no sh
!
int s 0/0
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay lmi-type ansi
no ip add
no sh
end
!
!Frame-Relay Setting
conf t
int s 0/0.301 point-to-point
ip add 10.0.1.3 255.255.255.0
no frame-relay inverse-arp
frame-relay interface-dlci 301
no sh
!
int s 0/0.302 point-to-point
no frame-relay inverse-arp
frame-relay interface-dlci 302
no sh
end
!
!Frame-Relay EEK Setting
conf t
map-class frame-relay EEK
frame-relay end-to-end keepalive mode bidirectional
end
!
conf t
int s 0/0.302 point-to-point
frame-relay interface-dlci 302
class EEK
end
!
!PPP Over Frame-Relay Setting
conf t
int s 0/0.302
frame-relay interface-dlci 302 ppp virtual-template 1
int virtual-template 1
ip add 10.0.23.3 255.255.255.0
no sh
end
!
!fix PPP over Frame-Relay IGP prefix error
conf t
int virtual-template 1
no peer neighbor-route
end
!
!fix ppp over Frame-Relay ping self error
conf t
int virtual-template 1 
ppp multilink 
end
!
!Basic Dynamic Routing Setting
conf t
router eigrp 100
passive-interface lo 0
network 10.0.0.0
no auto
end

FR
!
!Basic Setting
conf t
hostname FR
logging console
no ip domain-lookup
end
!
!Frame-Relay Switching Setting
conf t
frame-relay switching
int s 1/1
encapsulation frame-relay
frame-relay lmi-type ansi
frame-relay intf-type dce
frame-relay route 102 interface s 1/2 201
frame-relay route 103 interface s 1/3 301
no sh
int s 1/2
encapsulation frame-relay
frame-relay lmi-type ansi
frame-relay intf-type dce
frame-relay route 201 interface s 1/1 102
frame-relay route 203 interface s 1/3 302
no sh
int s 1/3
encapsulation frame-relay
frame-relay lmi-type ansi
frame-relay intf-type dce
frame-relay route 301 interface s 1/1 103
frame-relay route 302 interface s 1/2 203
no sh
end

show指令
show ip int brief
show frame-relay lmi
show frame-relay pvc
show frame-relay map
show frame-relay route
show frame-relay end-to-end keepalive
show interface virtual-access 1
show ip route
show ip eigrp neighbor
show interface s 0/0
show ip interface s 0/0

debug指令
debug ppp negotiation 
debug frame-relay adjacency

參考文件
Troubleshooting: IP Addressing Tricks & Tips Using PPP

Frame Relay Switch Configuration

透過AVG指令模式來替即時通訊/下載軟體掃毒

1. 安裝AVG Free防毒軟體主程式  載點

2. 開啟文字編輯器並將下列程式碼貼上，另存檔案成AvgScan.bat
然後將該檔案存放到"C:\Program Files\AVG\AVG9\"下

@echo off
"C:\Program Files\AVG\AVG9\avgscanx.exe" /SCAN=%1 /HEUR /ARC /PUP /CLEAN

3. 開啟即時通訊軟體或下載軟體的防毒過濾設定頁面，並將指定透過下列路徑掃毒即可!!

範例
MSN
"C:\Program Files\AVG\AVG9\AvgScan.bat"

FlashGet
"C:\Program Files\AVG\AVG9\AvgScan.bat"

FireFox download statusbar
防毒軟體位置 "C:\Program Files\AVG\AVG9\avgscanx.exe"
參數 /SCAN=%1 /HEUR /ARC /PUP /CLEAN