Cisco Catalyst 3550シリーズスイッチの設定記録

投稿者: | 2021-04-07
0件のコメント

Cisco Catalyst 3550はCisco製のLayer 3スイッチです（現在は製造終了）。SVI（スイッチ仮想インターフェイス）を使ったVLAN間ルーティング・スパニングツリー・DHCPサーバー機能など、エンタープライズ向けの豊富な機能を備えています。今回はVLAN分割とL3ルーティングを組み合わせた構成をまとめます。

環境・構成

  • FE0/1：ルーターへのアップリンク（L3ポート・192.168.1.2/24）
  • FE0/2〜12：アクセスポート（VLAN2〜12に割り当て）
  • FE0/13〜24：トランクポート（dot1q）
  • Vlan2〜12（SVI）：各VLANのデフォルトゲートウェイ（192.168.2〜12.1/24）

設定のポイント

  • VLAN間ルーティング（L3スイッチング）：ip routingを有効化しSVIインターフェイスでVLAN間通信を実現します
  • DHCPサーバー：各VLAN用のDHCPプールをスイッチ上で設定し端末にIPを自動配布します
  • デフォルトルート：ip route 0.0.0.0 0.0.0.0 192.168.1.1でルーター側にデフォルト経路を向けます
  • スパニングツリー（PVST）：spanning-tree mode pvstでVLAN単位のSTPを動作させループを防止します
  • PortFast＋BPDUGuard：エンドホスト接続ポートに適用しSTP収束時間を短縮します
  • SSH v2・ACLによるvtyアクセス制限：管理アクセスをSSH v2に限定しACLでソースIPを制限します

設定ファイル

以下は実際の設定ファイルです。パスワード類は伏字にしています。

Building configuration...

Current configuration : 8000 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Switch
!
!
no aaa new-model
clock timezone JST 9
ip subnet-zero
ip routing
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.2.1
ip dhcp excluded-address 192.168.3.1
ip dhcp excluded-address 192.168.4.1
ip dhcp excluded-address 192.168.5.1
ip dhcp excluded-address 192.168.6.1
ip dhcp excluded-address 192.168.7.1
ip dhcp excluded-address 192.168.8.1
ip dhcp excluded-address 192.168.9.1
ip dhcp excluded-address 192.168.10.1
ip dhcp excluded-address 192.168.11.1
ip dhcp excluded-address 192.168.12.1
!
ip dhcp pool Vlan2
   network 192.168.2.0 255.255.255.0
   default-router 192.168.2.1
   dns-server 192.168.1.1
!
ip dhcp pool Vlan3
   network 192.168.3.0 255.255.255.0
   default-router 192.168.3.1
   dns-server 192.168.1.1
!
ip dhcp pool Vlan4
   network 192.168.4.0 255.255.255.0
   default-router 192.168.4.1
   dns-server 192.168.1.1
!
ip dhcp pool Vlan5
   network 192.168.5.0 255.255.255.0
   default-router 192.168.5.1
   dns-server 192.168.1.1
!
ip dhcp pool Vlan6
   network 192.168.6.0 255.255.255.0
   default-router 192.168.6.1
   dns-server 192.168.1.1
!
ip dhcp pool Vlan7
   network 192.168.7.0 255.255.255.0
   default-router 192.168.7.1
   dns-server 192.168.1.1
!
ip dhcp pool Vlan8
   network 192.168.8.0 255.255.255.0
   default-router 192.168.8.1
   dns-server 192.168.1.1
!
ip dhcp pool Vlan9
   network 192.168.9.0 255.255.255.0
   default-router 192.168.9.1
   dns-server 192.168.1.1
!
ip dhcp pool Vlan10
   network 192.168.10.0 255.255.255.0
   default-router 192.168.10.1
   dns-server 192.168.1.1
!
ip dhcp pool Vlan11
   network 192.168.11.0 255.255.255.0
   default-router 192.168.11.1
   dns-server 192.168.1.1
!
ip dhcp pool Vlan12
   network 192.168.12.0 255.255.255.0
   default-router 192.168.12.1
   dns-server 192.168.1.1
!
!
!
!
spanning-tree mode pvst
spanning-tree portfast bpduguard default
spanning-tree etherchannel guard misconfig
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
ip ssh version 2
!
!
!
!
!
interface FastEthernet0/1
 no switchport
 ip address 192.168.1.2 255.255.255.0
 no cdp enable
!
interface FastEthernet0/2
 switchport access vlan 2
 switchport mode access
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/3
 switchport access vlan 3
 switchport mode access
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/4
 switchport access vlan 4
 switchport mode access
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/5
 switchport access vlan 5
 switchport mode access
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/6
 switchport access vlan 6
 switchport mode access
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/7
 switchport access vlan 7
 switchport mode access
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/8
 switchport access vlan 8
 switchport mode access
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/9
 switchport access vlan 9
 switchport mode access
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/10
 switchport access vlan 10
 switchport mode access
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/11
 switchport access vlan 11
 switchport mode access
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/12
 switchport access vlan 12
 switchport mode access
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/13
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/14
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/15
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/16
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/17
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/18
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/19
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/20
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/21
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/22
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/23
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no cdp enable
 spanning-tree portfast
!
interface FastEthernet0/24
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no cdp enable
 spanning-tree portfast
!
interface GigabitEthernet0/1
 switchport mode dynamic desirable
!
interface GigabitEthernet0/2
 switchport mode dynamic desirable
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan2
 ip address 192.168.2.1 255.255.255.0
!
interface Vlan3
 ip address 192.168.3.1 255.255.255.0
!
interface Vlan4
 ip address 192.168.4.1 255.255.255.0
!
interface Vlan5
 ip address 192.168.5.1 255.255.255.0
!
interface Vlan6
 ip address 192.168.6.1 255.255.255.0
!
interface Vlan7
 ip address 192.168.7.1 255.255.255.0
!
interface Vlan8
 ip address 192.168.8.1 255.255.255.0
!
interface Vlan9
 ip address 192.168.9.1 255.255.255.0
!
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
!
interface Vlan11
 ip address 192.168.11.1 255.255.255.0
!
interface Vlan12
 ip address 192.168.12.1 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.1.1 permanent
no ip http server
no ip http secure-server
!
!
access-list 1 permit 192.168.2.0 0.0.0.255
access-list 1 deny   any
!
control-plane
!
!
line con 0
 login local
line vty 0 4
 access-class 1 in
 login local
 transport input ssh
line vty 5 15
 access-class 1 in
 login local
 transport input ssh
!
ntp server 133.243.238.163
ntp server 133.243.238.164
ntp server 133.243.238.243
ntp server 133.243.238.244
end

Related Posts: