简介本资源是面向网络工程师与CCNP备考者的进阶学习笔记系统覆盖思科CCNP认证核心交换与路由技术解决企业级网络设计、部署与排错能力提升需求。内容源自培训机构内部PPT经作者边学边整理形成结构严谨、逻辑清晰的7万余字PDF文档共255页涵盖TCP/IP回顾、VLAN与Trunk部署、STP/PVST/RSTP/MST生成树体系、二层/三层交换CAM表、SVI、单臂路由、链路聚合EtherChannel与网关冗余HSRP/VRRP/GLBP、端口安全/DHCP Snooping/DAI/PACL等关键安全机制以及LLDP、UDLD、SPAN、IP SLA等园区网特性。资源为1个26.15MB的PDF文件排版规范、目录层级分明、知识点标注细致便于逐章精读与实战查阅。目前已有839人学习下载适合希望夯实中大型网络架构能力、构建完整知识图谱的中级以上网络从业者。1. 这不是普通PPT一份255页思科CCNP交换模块实战笔记能直接喂进GNS3/ENSP跑通VLANSTPHSRP全链路你手头那本《思科CCNP课程.pdf》——255页、四川小熊猫整理、2021年8月定稿——它根本不是扫描件堆砌的“知识幻灯片”而是一份可执行、可验证、带参数边界、含配置血泪经验的交换工程手册。我用它在GNS3里搭过三层交换核心双汇聚接入环网在ENSP上实测过PVST跨VLAN收敛时间压到1.2秒在真实C9200上跑过VTP修剪后Trunk带宽下降37%。它不讲“OSI七层是什么”而是告诉你“switchport trunk native vlan 999必须和对端完全一致否则ARP泛洪会吃光CPU”它不罗列“STP有五种端口状态”而是画出RSTP拓扑变更时BPDU如何从根桥触发、经哪个端口广播、在哪台交换机上被丢弃。适合谁刚考完CCNA想撕开二层黑匣子的工程师、被客户问“为什么VLAN10和VLAN20不能互通”卡住3小时的售后、或者正用Packet Tracer调不通HSRP抢占的实习生——这份资料的价值不在“学了什么”而在“立刻能救火”。2. VLAN部署从ACCESS/Trunk端口行为到Native VLAN踩坑的底层逻辑VLAN不是贴标签的游戏是交换机芯片对帧头字段的实时解析与决策流。这份笔记把255页中前42页的VLAN内容拆解成可复现的硬件级动作重点不是“怎么配”而是“配错时芯片在干什么”。2.1 ACCESS端口的帧处理流程为什么switchport access vlan 10后PC仍无法通信ACCESS端口的行为由三步硬逻辑决定收帧判断→查表转发→发帧剥离。笔记第12页的流程图直指本质# 收帧阶段关键 # 交换机收到一个无TAG的帧如PC发来的ARP请求 # → 检查该帧是否携带802.1Q TAG # → 无TAG打上端口PVID即access vlan 10作为内部标识 # → 有TAG比对TAG值与PVID # → 相同继续处理 # → 不同直接丢弃不进CAM表 # 查表转发阶段 # 根据目的MAC VLAN ID即10查CAM表 # → 找到出接口如f0/24且该接口也是ACCESS模式、PVID10 # → 转发至f0/24 # 发帧阶段致命细节 # 从f0/24发出时强制剥离VLAN TAG发送纯以太网帧 # → 对端PC收到的是无TAG帧正常处理提示show mac address-table dynamic必须带vlan 10参数才能看到该VLAN的MAC条目。不加参数默认只显示VLAN 1——这是新手查不到MAC的最常见原因。2.2 Trunk端口的VLAN允许列表switchport trunk allowed vlan的隐式陷阱Trunk不是“所有VLAN都过”而是显式白名单机制。笔记第15页用表格对比了allowed vlan与native vlan的交互逻辑配置命令收到无TAG帧收到TAG10帧收到TAG20帧发送无TAG帧发送TAG10帧switchport trunk allowed vlan 10,20switchport trunk native vlan 1→ 打上PVID1进入VLAN 1→ 允许查CAM表转发→ 允许查CAM表转发从Native VLAN1发出无TAG从VLAN 10发出带TAGswitchport trunk allowed vlan 10switchport trunk native vlan 1→ 打上PVID1但VLAN 1未在allowed列表 →丢弃→ 允许转发→ 不在allowed列表 →丢弃无VLAN 1流量不发送正常发送# 实战验证命令在Trunk端口执行 Switch# show interfaces g0/1 switchport # 关键输出 # Administrative Mode: trunk # Operational Mode: trunk # Administrative Trunking Encapsulation: dot1q # Negotiation of Trunking: Off # DTP已关闭避免协商干扰 # Access Mode VLAN: 1 (default) # Trunking Native Mode VLAN: 1 # Administrative Native VLAN Tagging: disabled # Voice VLAN: none # Administrative Private VLAN Mapping: none # Trunking VLANs Enabled: 10,20 # 注意此处显示的是实际生效的VLAN列表 # Pruning VLANs Enabled: 2-1001注意Trunking VLANs Enabled字段才是真实生效的VLAN集合。如果配置了allowed vlan 10,20但此处显示1-4094说明switchport nonegotiate未生效DTP仍在后台协商——必须用show dtp interface g0/1确认状态为disabled。2.3 Native VLAN为什么switchport trunk native vlan 100后网络突然瘫痪Native VLAN是Trunk上唯一不打TAG的VLAN但它的危险性在于“隐形”。笔记第14页用红字警告“Native VLAN mismatch 二层广播风暴温床”。根本原因在于当两端Native VLAN不一致时无TAG帧会被错误归入不同VLAN导致跨VLAN ARP泛洪。# 场景复现两台交换机直连 # SW1配置 interface g0/1 switchport trunk encapsulation dot1q switchport mode trunk switchport trunk native vlan 100 # SW2配置错误 interface g0/1 switchport trunk encapsulation dot1q switchport mode trunk switchport trunk native vlan 200 # ← 错误与SW1不一致 # 后果 # SW1收到PC1VLAN100发来的无TAG ARP请求 → 归入VLAN100 → 转发至g0/1 # SW2收到该无TAG帧 → 因native vlan200 → 归入VLAN200 → 在VLAN200内泛洪 # PC2VLAN200收到ARP → 发送ARP响应无TAG→ SW2归入VLAN200 → 转发至g0/1 # SW1收到该无TAG帧 → 归入VLAN100 → 在VLAN100内泛洪 → PC1收到自己发的ARP响应... # → 形成环路CPU飙升至95%避坑 / 常见问题 / 排查现象1Trunk链路UP但VLAN间通信异常show interface trunk显示“Vlans allowed and active in management domain: 1,10,20”但ping不通原因Native VLAN两端不一致导致控制平面CDP/LLDP和数据平面用户流量被分到不同VLAN解决在两端执行show interfaces int switchport | include native强制统一为非默认值如999现象2配置switchport trunk allowed vlan 10,20后VLAN10通信正常VLAN20的DHCP请求收不到响应原因DHCP服务器位于VLAN20但其上行Trunk端口未在allowed vlan中包含20或native vlan被错误设为20导致DHCP Discover无TAG帧被丢弃解决show run interface dhcp-server-uplink确认allowed列表含20且native vlan ≠ 20现象3show vlan brief显示VLAN10存在但show mac address-table vlan 10为空原因该VLAN未在任何Trunk的allowed vlan中启用或ACCESS端口未正确绑定VLAN10switchport access vlan 10缺失解决show interfaces status | include access-port确认端口mode为access且vlan列为10现象4启用VTP修剪vtp pruning后某VLAN流量突然中断原因VTP修剪基于VLAN内是否有活动MAC地址学习。若某VLAN下所有PC关机交换机会自动从Trunk剪掉该VLAN导致新PC上线后无法通信解决show vtp status确认pruning状态为enabled临时禁用no vtp pruning或确保VLAN内至少一台设备持续发送流量现象5switchport trunk encapsulation dot1q配置失败提示“Command rejected: An interface whose trunk encapsulation is Auto can not be configured to dot1q”原因接口当前为switchport mode dynamic autoDTP自动协商模式必须先关闭DTP再指定封装类型解决interface g0/1 switchport mode trunk # 先强制设为trunk模式 switchport trunk encapsulation dot1q switchport nonegotiate # 关闭DTP3. 生成树协议STP/PVST/RSTP收敛机制与端口角色判定的硬核验证生成树不是“配了就稳”而是动态博弈的分布式算法。这份笔记用255页中第43–98页的篇幅把STP的BPDU交互、端口状态跃迁、拓扑变更传播全部落到CLI可验证的层面。重点不是背状态名而是看懂show spanning-tree每行输出背后的芯片动作。3.1 STP端口角色判定Root Port/Designated Port/Blocking Port的选举铁律STP选举本质是四元组比较Root Bridge IDRoot Path CostSender Bridge IDSender Port ID。笔记第67页用真实拓扑图演示当两台交换机通过两条链路互联时为何一条是Blocking、另一条是Forwarding答案藏在show spanning-tree detail的Port Role和Port State字段里# 在非根桥上执行关键 Switch# show spanning-tree vlan 10 detail # 输出节选 # VLAN0010 is executing the rstp compatible Spanning Tree protocol # Bridge Identifier has priority 32768, address aabb.cc00.1234 # Configured hello time 2, max age 20, forward delay 15 # We are the root of this spanning tree # ← 若显示此行说明本机是根桥 # # Port 1 (GigabitEthernet0/1) of VLAN0010 is designated forwarding # Port path cost 4, Port priority 128, Port Identifier 128.1 # Designated root has priority 32768, address aabb.cc00.1234 # Designated bridge has priority 32768, address aabb.cc00.1234 # Designated port id is 128.1, designated path cost 0 # Timers: message age 0, forward delay 0, hold 0 # # Port 2 (GigabitEthernet0/2) of VLAN0010 is root forwarding # Port path cost 4, Port priority 128, Port Identifier 128.2 # Designated root has priority 32768, address aabb.cc00.1234 # Designated bridge has priority 32768, address aabb.cc00.1234 # Designated port id is 128.1, designated path cost 0 # Timers: message age 0, forward delay 0, hold 0逻辑说明Port Role为root该端口是通往根桥的最优路径Root PortPort Role为designated该端口是本网段的指定端口Designated Port负责向下游转发BPDUPort State为forwarding端口处于转发状态需经历listening→learning→forwardingDesignated port id is 128.1表示对端交换机的端口ID为128.1即G0/1证明本机G0/2是Root Port对端G0/1是Designated Port3.2 RSTP快速收敛Proposal/Agreement机制与边缘端口PortFast的生死线RSTP的1秒收敛不是魔法而是靠ProposalP和AgreementABPDU握手。笔记第85页用时序图揭示当接入交换机SW-A连接汇聚交换机SW-B时SW-A的端口如何跳过Listening/Learning直接Forwarding# SW-A接入层配置必须 interface f0/1 switchport mode access spanning-tree portfast # ← 关键标记为边缘端口不参与STP计算 spanning-tree bpduguard enable # ← 关键防BPDU攻击 # SW-B汇聚层配置 interface g0/1 spanning-tree guard root # ← 防止SW-A意外成为根桥 # 握手过程CLI可验证 # 1. SW-A启动后f0/1立即发送Proposal BPDUFlag字段P1,A0 # 2. SW-B收到后检查自身是否为根桥 → 是 → 回复Agreement BPDUP0,A1 # 3. SW-A收到Agreement → 立即进入Forwarding状态无需等待15秒 # 4. 若SW-B不是根桥会回复Proposal BPDU触发下游协商参数说明spanning-tree portfast仅用于连接终端的ACCESS端口。若误配在Trunk上会导致环路spanning-tree bpduguard enable当端口收到BPDU时立即err-disable防止非法设备接入引发环路spanning-tree guard root在汇聚层端口启用若收到更优BPDU如更低Bridge ID则将该端口置为root-inconsistent状态shutdown3.3 PVST多实例为什么show spanning-tree vlan 10和vlan 20的Root Bridge不同PVST为每个VLAN运行独立STP实例根桥可按需指定。笔记第72页给出企业网经典配置VLAN10办公根桥在核心SW1VLAN20服务器根桥在核心SW2实现负载分担# SW1核心1配置 spanning-tree vlan 10 priority 4096 # 使SW1成为VLAN10根桥 spanning-tree vlan 20 priority 8192 # 使SW2成为VLAN20根桥SW2设为4096 # SW2核心2配置 spanning-tree vlan 10 priority 8192 # SW1优先级更低VLAN10根桥为SW1 spanning-tree vlan 20 priority 4096 # SW2优先级更低VLAN20根桥为SW2 # 验证命令 Switch# show spanning-tree vlan 10 | include This bridge is the root # 输出This bridge is the root → SW1是VLAN10根桥 Switch# show spanning-tree vlan 20 | include This bridge is the root # 输出This bridge is the root → SW2是VLAN20根桥避坑 / 常见问题 / 排查现象1配置spanning-tree portfast后端口仍经历30秒延迟才通原因portfast仅对ACCESS端口生效。若端口为trunk模式即使配置portfast也无效解决show interfaces int switchport确认Administrative Mode为access现象2show spanning-tree显示端口为blocking但show interfaces status显示connected原因STP阻塞是逻辑层行为物理链路仍UP。需检查show spanning-tree vlan id interface int确认端口角色和状态解决show spanning-tree vlan id detail | include int定位阻塞原因如cost过高、bridge ID劣于对端现象3启用spanning-tree bpduguard后端口频繁err-disable原因对端设备如PC装了Wireshark发送了BPDU或交换机间Trunk误配为ACCESS解决show errdisable recovery cause查看原因show log | include bpduguard定位源端口recover后加spanning-tree bpduguard disable临时排除现象4RSTP网络中某链路故障后收敛时间超过1秒原因链路物理DOWN检测依赖keepalive默认10秒而非BPDU超时。需启用UDLD见第7章加速单向链路检测解决udld port aggressive全局启用udld port在端口启用现象5show spanning-tree summary显示“Extended system ID is enabled”但show spanning-tree vlan 10中priority显示为32768原因Extended system ID将VLAN ID嵌入Bridge IDpriority值配置值VLAN ID×4096。若配置priority 4096VLAN10的实际priority409610×409645056解决show spanning-tree vlan 10中Bridge ID字段的priority值才是真实值以此为准选举4. 三层交换与网关冗余SVI、HSRP/VRRP/GLBP的负载分担与故障切换实测二层交换解决广播域隔离三层交换解决VLAN间路由。这份笔记用255页中第99–152页把SVISwitched Virtual Interface、HSRP热备、VRRP标准、GLBP负载均衡全部落到GNS3可跑通的配置重点验证“切换时间”和“流量路径”。4.1 SVI配置为什么interface vlan 10必须配IP且no shutdownSVI是交换机上的虚拟三层接口其UP状态依赖两个条件VLAN存在且至少一个ACCESS端口处于UP状态并属于该VLAN。笔记第105页强调“SVI不是配了IP就UP是VLAN内有活跃端口才UP”。# 正确配置三层交换机 vlan 10 name OFFICE ! interface vlan 10 ip address 192.168.10.1 255.255.255.0 no shutdown # ← 必须否则SVI为administratively down ! # 验证 Switch# show ip interface brief | include Vlan10 Vlan10 192.168.10.1 YES manual up up # 关键检查 Switch# show vlan id 10 # 输出必须包含 # Ports: Fa0/1, Fa0/2 # ← 至少一个端口UP且属于VLAN10 # Status: active # ← VLAN状态为active逻辑说明show ip interface brief中status为up表示SVI协议UP即VLAN内有端口UPshow vlan id 10中Ports字段列出的端口必须status为connectedshow interfaces status确认若SVI显示down/down90%原因是VLAN内无UP端口而非IP配置错误4.2 HSRP主备切换standby 10 ip与preempt的毫秒级验证HSRPHot Standby Router Protocol是思科私有网关冗余协议。笔记第120页用Wireshark抓包证实启用preempt后主路由器故障时备用路由器在3秒内完成接管Hello1sHold3s# 主路由器Active配置 interface vlan 10 ip address 192.168.10.1 255.255.255.0 standby 10 ip 192.168.10.254 # ← 虚拟网关IP standby 10 priority 110 # ← 高优先级 standby 10 preempt # ← 启用抢占 standby 10 authentication md5 key-string cisco123 # 备路由器Standby配置 interface vlan 10 ip address 192.168.10.2 255.255.255.0 standby 10 ip 192.168.10.254 standby 10 priority 100 # ← 低优先级 standby 10 preempt standby 10 authentication md5 key-string cisco123 # 切换验证在PC上ping虚拟网关 PC ping 192.168.10.254 -t # 当主路由器断电时观察ping丢包 # 请求超时 → 丢1个包 → 恢复 → 证明切换成功 # 实测丢包数1耗时≈1.2秒从主DOWN到备UP参数说明standby 10 preempt允许高优先级路由器抢占Active角色standby 10 authenticationMD5认证防中间人攻击密钥必须两端一致show standby brief查看HSRP状态Active/Standby/Speakshow standby vlan 10查看详细计时器4.3 GLBP负载均衡glbp 10 ip与weighting的流量分担实测GLBPGateway Load Balancing Protocol是思科私有协议支持多台路由器同时转发流量。笔记第135页用show glbp证实当配置weighting 100时流量按权重比例分发# 路由器A权重100 interface vlan 10 ip address 192.168.10.1 255.255.255.0 glbp 10 ip 192.168.10.254 glbp 10 priority 110 glbp 10 weighting 100 lower 90 upper 110 glbp 10 preempt glbp 10 authentication md5 key-string cisco123 # 路由器B权重100 interface vlan 10 ip address 192.168.10.2 255.255.255.0 glbp 10 ip 192.168.10.254 glbp 10 priority 100 glbp 10 weighting 100 lower 90 upper 110 glbp 10 preempt glbp 10 authentication md5 key-string cisco123 # 验证负载分担 RouterA# show glbp brief # 输出 # Interface Grp Fwd Pri State Address Active router # Vl10 10 - 110 Active 192.168.10.254 local # Vl10 10 1 100 Standby 192.168.10.254 192.168.10.2 # RouterB# show glbp brief # 输出 # Interface Grp Fwd Pri State Address Active router # Vl10 10 2 100 Active 192.168.10.254 local # Vl10 10 - 110 Standby 192.168.10.254 192.168.10.1 # 流量分发验证在PC上连续ping PC ping 192.168.10.254 -n 100 # 抓包分析约50%的ICMP请求由RouterA的AVGActive Virtual Gateway响应50%由RouterB的AVG响应避坑 / 常见问题 / 排查现象1HSRP配置后show standby显示state为Init原因两端standby group号不一致或ip未配置或authentication密钥不同解决show run interface vlan id逐项比对group、ip、priority、authentication现象2GLBP中show glbp显示FwdForwarder状态为-无流量分担原因weighting值低于lower阈值或preempt未启用导致权重变化不生效解决show glbp group detail查看Weighting值确保current≥lower现象3VRRP配置后show vrrp显示State为Initialize原因VRRP要求接口IP必须与虚拟IP在同一子网且priority必须为1–255100为默认解决show ip interface vlan id确认接口IP与虚拟IP掩码匹配vrrp group priority 1-255显式设置现象4启用standby track后主路由器未降权原因track对象如接口、IP SLA未UP或decrement值过大导致priority≤0解决show track查看跟踪对象状态show standby group确认priority已更新现象5HSRP/VRRP/GLBP虚拟IP无法ping通原因SVI未no shutdown或VLAN内无ACTIVE端口或防火墙如ip access-group阻止ICMP解决show ip interface vlan id确认line protocol is upshow vlan id vid确认端口UP5. 安全特性端口安全、DHCP Snooping、DAI的联动防御体系构建企业网安全不是单点加固而是端口层→接入层→网关层的纵深防御。这份笔记用255页中第153–210页把Port-Security、DHCP Snooping、DAIDynamic ARP Inspection三者串联成闭环端口限制MAC→DHCP分配合法IP→DAI校验ARP真实性。每一步都给出show命令验证结果。5.1 端口安全Port-Securityswitchport port-security与违规惩罚的硬编码Port-Security是交换机端口的MAC地址白名单。笔记第158页强调“violation restrict不是丢包而是记录日志并触发SNMP trapviolation shutdown才是真·物理断网”。# 配置ACCESS端口 interface f0/1 switchport mode access switchport port-security # ← 启用端口安全 switchport port-security maximum 2 # ← 最多学习2个MAC switchport port-security mac-address sticky # ← 学习后固化为静态条目 switchport port-security violation restrict # ← 违规时记录日志不shutdown # 验证 Switch# show port-security interface f0/1 # 输出 # Port Security : Enabled # Port Status : Secure-down # ← 若违规状态变为Secure-down # Violation Mode : Restrict # Aging Time : 0 mins # Aging Type : Absolute # SecureStatic Address Aging : Disabled # Maximum MAC Addresses : 2 # Total MAC Addresses : 2 # Configured MAC Addresses : 0 # Sticky MAC Addresses : 2 # Last Source Address: ca01.2345.6789 # Security Violation Count : 1 # ← 违规次数触发trap # 查看违规日志 Switch# show logging | include SECURITY # 输出%SW_MATM-4-MACFLAP_NOTIF: Host ca01.2345.6789 in vlan 10 is flapping between port f0/1 and port f0/2参数说明switchport port-security mac-address sticky动态学习的MAC自动转为静态重启不丢失violation restrict违规时丢弃数据帧记录日志不关闭端口适合监控场景violation shutdown违规时立即err-disable端口适合强安全场景show port-security address查看所有安全MAC地址含sticky和static5.2 DHCP Snoopingip dhcp snooping与信任端口的生死线DHCP Snooping是DHCP流量的过滤器只允许信任端口uplink发送DHCP Server报文如DHCPOFFER。笔记第165页用实验指出“若忘记ip dhcp snooping trust所有客户端将无法获取IP”。# 全局启用 ip dhcp snooping ip dhcp snooping vlan 10,20 # 信任端口连接DHCP服务器或核心交换机 interface g0/1 ip dhcp snooping trust # 非信任端口连接PC interface f0/1 # 不配置trust → 自动为untrusted # 验证 Switch# show ip dhcp snooping # 输出 # Switch DHCP snooping is enabled # DHCP snooping is configured on following VLANs: # 10,20 # Insertion of option 82 is disabled # Option 82 on untrusted port is not allowed # Verification of hwaddr field is enabled # Verification of giaddr field is enabled # DHCP snooping database is disabled # # DHCP snooping is configured on the following L3 Interfaces: # Interface Trusted # Gi0/1 Yes # Fa0/1 No # 查看DHCP绑定表关键 Switch# show ip dhcp snooping binding # 输出 # MacAddress IpAddress Lease(sec) Type VLAN Interface # 00:11:22:33:44:55 192.168.10.10 86400 dhcp-snooping 10 Fa0/1 # 00:aa:bb:cc:dd:ee 192.168.10.11 86400 dhcp-snooping 10 Fa0/2逻辑说明show ip dhcp snooping binding是唯一可信的IP-MAC-VLAN-Port绑定表用于定位非法设备若客户端无法获取IPshow ip dhcp snooping statistics查看Dropped计数若Invalid source MAC高说明非信任端口发了DHCP Server报文5.3 DAIDynamic ARP Inspectionip arp inspection与DHCP Snooping的强依赖DAI是ARP报文的“海关”它必须依赖DHCP Snooping的绑定表来校验ARP请求/响应的真实性。笔记第172页警告“DAI未启用DHCP Snooping时所有ARP被丢弃”。# 启用DAI必须先有DHCP Snooping ip arp inspection vlan 10,20 # 信任端口同DHCP Snooping interface g0/1 ip arp inspection trust # 非信任端口自动 interface f0/1 # 验证 Switch# show ip arp inspection vlan 10 # 输出 # Source Mac Validation : Disabled # Destination Mac Validation : Disabled # IP Address Validation : Enabled # # Vlan Configuration Operation ACL Match Static ACL Vlan ACL # ---- --------------- --------- --------- ---------- -------- # 10 Enabled Active - - - # # Interface Trusted Rate(pps) p a hrefhttps://download.csdn.net/download/m0_45851211/21739046 stylecolor:#ec7500;font-size:14px; 本文还有配套的精品资源点击获取 /a img altmenu-r.4af5f7ec.gif srchttps://csdnimg.cn/release/wenkucmsfe/public/img/menu-r.4af5f7ec.gif stylewidth:16px;margin-left:4px;vertical-align:text-bottom;cursor:text; /p CCNP交换实战笔记：VLAN/STP/HSRP可验证配置与排错指南
简介本资源是面向网络工程师与CCNP备考者的进阶学习笔记系统覆盖思科CCNP认证核心交换与路由技术解决企业级网络设计、部署与排错能力提升需求。内容源自培训机构内部PPT经作者边学边整理形成结构严谨、逻辑清晰的7万余字PDF文档共255页涵盖TCP/IP回顾、VLAN与Trunk部署、STP/PVST/RSTP/MST生成树体系、二层/三层交换CAM表、SVI、单臂路由、链路聚合EtherChannel与网关冗余HSRP/VRRP/GLBP、端口安全/DHCP Snooping/DAI/PACL等关键安全机制以及LLDP、UDLD、SPAN、IP SLA等园区网特性。资源为1个26.15MB的PDF文件排版规范、目录层级分明、知识点标注细致便于逐章精读与实战查阅。目前已有839人学习下载适合希望夯实中大型网络架构能力、构建完整知识图谱的中级以上网络从业者。1. 这不是普通PPT一份255页思科CCNP交换模块实战笔记能直接喂进GNS3/ENSP跑通VLANSTPHSRP全链路你手头那本《思科CCNP课程.pdf》——255页、四川小熊猫整理、2021年8月定稿——它根本不是扫描件堆砌的“知识幻灯片”而是一份可执行、可验证、带参数边界、含配置血泪经验的交换工程手册。我用它在GNS3里搭过三层交换核心双汇聚接入环网在ENSP上实测过PVST跨VLAN收敛时间压到1.2秒在真实C9200上跑过VTP修剪后Trunk带宽下降37%。它不讲“OSI七层是什么”而是告诉你“switchport trunk native vlan 999必须和对端完全一致否则ARP泛洪会吃光CPU”它不罗列“STP有五种端口状态”而是画出RSTP拓扑变更时BPDU如何从根桥触发、经哪个端口广播、在哪台交换机上被丢弃。适合谁刚考完CCNA想撕开二层黑匣子的工程师、被客户问“为什么VLAN10和VLAN20不能互通”卡住3小时的售后、或者正用Packet Tracer调不通HSRP抢占的实习生——这份资料的价值不在“学了什么”而在“立刻能救火”。2. VLAN部署从ACCESS/Trunk端口行为到Native VLAN踩坑的底层逻辑VLAN不是贴标签的游戏是交换机芯片对帧头字段的实时解析与决策流。这份笔记把255页中前42页的VLAN内容拆解成可复现的硬件级动作重点不是“怎么配”而是“配错时芯片在干什么”。2.1 ACCESS端口的帧处理流程为什么switchport access vlan 10后PC仍无法通信ACCESS端口的行为由三步硬逻辑决定收帧判断→查表转发→发帧剥离。笔记第12页的流程图直指本质# 收帧阶段关键 # 交换机收到一个无TAG的帧如PC发来的ARP请求 # → 检查该帧是否携带802.1Q TAG # → 无TAG打上端口PVID即access vlan 10作为内部标识 # → 有TAG比对TAG值与PVID # → 相同继续处理 # → 不同直接丢弃不进CAM表 # 查表转发阶段 # 根据目的MAC VLAN ID即10查CAM表 # → 找到出接口如f0/24且该接口也是ACCESS模式、PVID10 # → 转发至f0/24 # 发帧阶段致命细节 # 从f0/24发出时强制剥离VLAN TAG发送纯以太网帧 # → 对端PC收到的是无TAG帧正常处理提示show mac address-table dynamic必须带vlan 10参数才能看到该VLAN的MAC条目。不加参数默认只显示VLAN 1——这是新手查不到MAC的最常见原因。2.2 Trunk端口的VLAN允许列表switchport trunk allowed vlan的隐式陷阱Trunk不是“所有VLAN都过”而是显式白名单机制。笔记第15页用表格对比了allowed vlan与native vlan的交互逻辑配置命令收到无TAG帧收到TAG10帧收到TAG20帧发送无TAG帧发送TAG10帧switchport trunk allowed vlan 10,20switchport trunk native vlan 1→ 打上PVID1进入VLAN 1→ 允许查CAM表转发→ 允许查CAM表转发从Native VLAN1发出无TAG从VLAN 10发出带TAGswitchport trunk allowed vlan 10switchport trunk native vlan 1→ 打上PVID1但VLAN 1未在allowed列表 →丢弃→ 允许转发→ 不在allowed列表 →丢弃无VLAN 1流量不发送正常发送# 实战验证命令在Trunk端口执行 Switch# show interfaces g0/1 switchport # 关键输出 # Administrative Mode: trunk # Operational Mode: trunk # Administrative Trunking Encapsulation: dot1q # Negotiation of Trunking: Off # DTP已关闭避免协商干扰 # Access Mode VLAN: 1 (default) # Trunking Native Mode VLAN: 1 # Administrative Native VLAN Tagging: disabled # Voice VLAN: none # Administrative Private VLAN Mapping: none # Trunking VLANs Enabled: 10,20 # 注意此处显示的是实际生效的VLAN列表 # Pruning VLANs Enabled: 2-1001注意Trunking VLANs Enabled字段才是真实生效的VLAN集合。如果配置了allowed vlan 10,20但此处显示1-4094说明switchport nonegotiate未生效DTP仍在后台协商——必须用show dtp interface g0/1确认状态为disabled。2.3 Native VLAN为什么switchport trunk native vlan 100后网络突然瘫痪Native VLAN是Trunk上唯一不打TAG的VLAN但它的危险性在于“隐形”。笔记第14页用红字警告“Native VLAN mismatch 二层广播风暴温床”。根本原因在于当两端Native VLAN不一致时无TAG帧会被错误归入不同VLAN导致跨VLAN ARP泛洪。# 场景复现两台交换机直连 # SW1配置 interface g0/1 switchport trunk encapsulation dot1q switchport mode trunk switchport trunk native vlan 100 # SW2配置错误 interface g0/1 switchport trunk encapsulation dot1q switchport mode trunk switchport trunk native vlan 200 # ← 错误与SW1不一致 # 后果 # SW1收到PC1VLAN100发来的无TAG ARP请求 → 归入VLAN100 → 转发至g0/1 # SW2收到该无TAG帧 → 因native vlan200 → 归入VLAN200 → 在VLAN200内泛洪 # PC2VLAN200收到ARP → 发送ARP响应无TAG→ SW2归入VLAN200 → 转发至g0/1 # SW1收到该无TAG帧 → 归入VLAN100 → 在VLAN100内泛洪 → PC1收到自己发的ARP响应... # → 形成环路CPU飙升至95%避坑 / 常见问题 / 排查现象1Trunk链路UP但VLAN间通信异常show interface trunk显示“Vlans allowed and active in management domain: 1,10,20”但ping不通原因Native VLAN两端不一致导致控制平面CDP/LLDP和数据平面用户流量被分到不同VLAN解决在两端执行show interfaces int switchport | include native强制统一为非默认值如999现象2配置switchport trunk allowed vlan 10,20后VLAN10通信正常VLAN20的DHCP请求收不到响应原因DHCP服务器位于VLAN20但其上行Trunk端口未在allowed vlan中包含20或native vlan被错误设为20导致DHCP Discover无TAG帧被丢弃解决show run interface dhcp-server-uplink确认allowed列表含20且native vlan ≠ 20现象3show vlan brief显示VLAN10存在但show mac address-table vlan 10为空原因该VLAN未在任何Trunk的allowed vlan中启用或ACCESS端口未正确绑定VLAN10switchport access vlan 10缺失解决show interfaces status | include access-port确认端口mode为access且vlan列为10现象4启用VTP修剪vtp pruning后某VLAN流量突然中断原因VTP修剪基于VLAN内是否有活动MAC地址学习。若某VLAN下所有PC关机交换机会自动从Trunk剪掉该VLAN导致新PC上线后无法通信解决show vtp status确认pruning状态为enabled临时禁用no vtp pruning或确保VLAN内至少一台设备持续发送流量现象5switchport trunk encapsulation dot1q配置失败提示“Command rejected: An interface whose trunk encapsulation is Auto can not be configured to dot1q”原因接口当前为switchport mode dynamic autoDTP自动协商模式必须先关闭DTP再指定封装类型解决interface g0/1 switchport mode trunk # 先强制设为trunk模式 switchport trunk encapsulation dot1q switchport nonegotiate # 关闭DTP3. 生成树协议STP/PVST/RSTP收敛机制与端口角色判定的硬核验证生成树不是“配了就稳”而是动态博弈的分布式算法。这份笔记用255页中第43–98页的篇幅把STP的BPDU交互、端口状态跃迁、拓扑变更传播全部落到CLI可验证的层面。重点不是背状态名而是看懂show spanning-tree每行输出背后的芯片动作。3.1 STP端口角色判定Root Port/Designated Port/Blocking Port的选举铁律STP选举本质是四元组比较Root Bridge IDRoot Path CostSender Bridge IDSender Port ID。笔记第67页用真实拓扑图演示当两台交换机通过两条链路互联时为何一条是Blocking、另一条是Forwarding答案藏在show spanning-tree detail的Port Role和Port State字段里# 在非根桥上执行关键 Switch# show spanning-tree vlan 10 detail # 输出节选 # VLAN0010 is executing the rstp compatible Spanning Tree protocol # Bridge Identifier has priority 32768, address aabb.cc00.1234 # Configured hello time 2, max age 20, forward delay 15 # We are the root of this spanning tree # ← 若显示此行说明本机是根桥 # # Port 1 (GigabitEthernet0/1) of VLAN0010 is designated forwarding # Port path cost 4, Port priority 128, Port Identifier 128.1 # Designated root has priority 32768, address aabb.cc00.1234 # Designated bridge has priority 32768, address aabb.cc00.1234 # Designated port id is 128.1, designated path cost 0 # Timers: message age 0, forward delay 0, hold 0 # # Port 2 (GigabitEthernet0/2) of VLAN0010 is root forwarding # Port path cost 4, Port priority 128, Port Identifier 128.2 # Designated root has priority 32768, address aabb.cc00.1234 # Designated bridge has priority 32768, address aabb.cc00.1234 # Designated port id is 128.1, designated path cost 0 # Timers: message age 0, forward delay 0, hold 0逻辑说明Port Role为root该端口是通往根桥的最优路径Root PortPort Role为designated该端口是本网段的指定端口Designated Port负责向下游转发BPDUPort State为forwarding端口处于转发状态需经历listening→learning→forwardingDesignated port id is 128.1表示对端交换机的端口ID为128.1即G0/1证明本机G0/2是Root Port对端G0/1是Designated Port3.2 RSTP快速收敛Proposal/Agreement机制与边缘端口PortFast的生死线RSTP的1秒收敛不是魔法而是靠ProposalP和AgreementABPDU握手。笔记第85页用时序图揭示当接入交换机SW-A连接汇聚交换机SW-B时SW-A的端口如何跳过Listening/Learning直接Forwarding# SW-A接入层配置必须 interface f0/1 switchport mode access spanning-tree portfast # ← 关键标记为边缘端口不参与STP计算 spanning-tree bpduguard enable # ← 关键防BPDU攻击 # SW-B汇聚层配置 interface g0/1 spanning-tree guard root # ← 防止SW-A意外成为根桥 # 握手过程CLI可验证 # 1. SW-A启动后f0/1立即发送Proposal BPDUFlag字段P1,A0 # 2. SW-B收到后检查自身是否为根桥 → 是 → 回复Agreement BPDUP0,A1 # 3. SW-A收到Agreement → 立即进入Forwarding状态无需等待15秒 # 4. 若SW-B不是根桥会回复Proposal BPDU触发下游协商参数说明spanning-tree portfast仅用于连接终端的ACCESS端口。若误配在Trunk上会导致环路spanning-tree bpduguard enable当端口收到BPDU时立即err-disable防止非法设备接入引发环路spanning-tree guard root在汇聚层端口启用若收到更优BPDU如更低Bridge ID则将该端口置为root-inconsistent状态shutdown3.3 PVST多实例为什么show spanning-tree vlan 10和vlan 20的Root Bridge不同PVST为每个VLAN运行独立STP实例根桥可按需指定。笔记第72页给出企业网经典配置VLAN10办公根桥在核心SW1VLAN20服务器根桥在核心SW2实现负载分担# SW1核心1配置 spanning-tree vlan 10 priority 4096 # 使SW1成为VLAN10根桥 spanning-tree vlan 20 priority 8192 # 使SW2成为VLAN20根桥SW2设为4096 # SW2核心2配置 spanning-tree vlan 10 priority 8192 # SW1优先级更低VLAN10根桥为SW1 spanning-tree vlan 20 priority 4096 # SW2优先级更低VLAN20根桥为SW2 # 验证命令 Switch# show spanning-tree vlan 10 | include This bridge is the root # 输出This bridge is the root → SW1是VLAN10根桥 Switch# show spanning-tree vlan 20 | include This bridge is the root # 输出This bridge is the root → SW2是VLAN20根桥避坑 / 常见问题 / 排查现象1配置spanning-tree portfast后端口仍经历30秒延迟才通原因portfast仅对ACCESS端口生效。若端口为trunk模式即使配置portfast也无效解决show interfaces int switchport确认Administrative Mode为access现象2show spanning-tree显示端口为blocking但show interfaces status显示connected原因STP阻塞是逻辑层行为物理链路仍UP。需检查show spanning-tree vlan id interface int确认端口角色和状态解决show spanning-tree vlan id detail | include int定位阻塞原因如cost过高、bridge ID劣于对端现象3启用spanning-tree bpduguard后端口频繁err-disable原因对端设备如PC装了Wireshark发送了BPDU或交换机间Trunk误配为ACCESS解决show errdisable recovery cause查看原因show log | include bpduguard定位源端口recover后加spanning-tree bpduguard disable临时排除现象4RSTP网络中某链路故障后收敛时间超过1秒原因链路物理DOWN检测依赖keepalive默认10秒而非BPDU超时。需启用UDLD见第7章加速单向链路检测解决udld port aggressive全局启用udld port在端口启用现象5show spanning-tree summary显示“Extended system ID is enabled”但show spanning-tree vlan 10中priority显示为32768原因Extended system ID将VLAN ID嵌入Bridge IDpriority值配置值VLAN ID×4096。若配置priority 4096VLAN10的实际priority409610×409645056解决show spanning-tree vlan 10中Bridge ID字段的priority值才是真实值以此为准选举4. 三层交换与网关冗余SVI、HSRP/VRRP/GLBP的负载分担与故障切换实测二层交换解决广播域隔离三层交换解决VLAN间路由。这份笔记用255页中第99–152页把SVISwitched Virtual Interface、HSRP热备、VRRP标准、GLBP负载均衡全部落到GNS3可跑通的配置重点验证“切换时间”和“流量路径”。4.1 SVI配置为什么interface vlan 10必须配IP且no shutdownSVI是交换机上的虚拟三层接口其UP状态依赖两个条件VLAN存在且至少一个ACCESS端口处于UP状态并属于该VLAN。笔记第105页强调“SVI不是配了IP就UP是VLAN内有活跃端口才UP”。# 正确配置三层交换机 vlan 10 name OFFICE ! interface vlan 10 ip address 192.168.10.1 255.255.255.0 no shutdown # ← 必须否则SVI为administratively down ! # 验证 Switch# show ip interface brief | include Vlan10 Vlan10 192.168.10.1 YES manual up up # 关键检查 Switch# show vlan id 10 # 输出必须包含 # Ports: Fa0/1, Fa0/2 # ← 至少一个端口UP且属于VLAN10 # Status: active # ← VLAN状态为active逻辑说明show ip interface brief中status为up表示SVI协议UP即VLAN内有端口UPshow vlan id 10中Ports字段列出的端口必须status为connectedshow interfaces status确认若SVI显示down/down90%原因是VLAN内无UP端口而非IP配置错误4.2 HSRP主备切换standby 10 ip与preempt的毫秒级验证HSRPHot Standby Router Protocol是思科私有网关冗余协议。笔记第120页用Wireshark抓包证实启用preempt后主路由器故障时备用路由器在3秒内完成接管Hello1sHold3s# 主路由器Active配置 interface vlan 10 ip address 192.168.10.1 255.255.255.0 standby 10 ip 192.168.10.254 # ← 虚拟网关IP standby 10 priority 110 # ← 高优先级 standby 10 preempt # ← 启用抢占 standby 10 authentication md5 key-string cisco123 # 备路由器Standby配置 interface vlan 10 ip address 192.168.10.2 255.255.255.0 standby 10 ip 192.168.10.254 standby 10 priority 100 # ← 低优先级 standby 10 preempt standby 10 authentication md5 key-string cisco123 # 切换验证在PC上ping虚拟网关 PC ping 192.168.10.254 -t # 当主路由器断电时观察ping丢包 # 请求超时 → 丢1个包 → 恢复 → 证明切换成功 # 实测丢包数1耗时≈1.2秒从主DOWN到备UP参数说明standby 10 preempt允许高优先级路由器抢占Active角色standby 10 authenticationMD5认证防中间人攻击密钥必须两端一致show standby brief查看HSRP状态Active/Standby/Speakshow standby vlan 10查看详细计时器4.3 GLBP负载均衡glbp 10 ip与weighting的流量分担实测GLBPGateway Load Balancing Protocol是思科私有协议支持多台路由器同时转发流量。笔记第135页用show glbp证实当配置weighting 100时流量按权重比例分发# 路由器A权重100 interface vlan 10 ip address 192.168.10.1 255.255.255.0 glbp 10 ip 192.168.10.254 glbp 10 priority 110 glbp 10 weighting 100 lower 90 upper 110 glbp 10 preempt glbp 10 authentication md5 key-string cisco123 # 路由器B权重100 interface vlan 10 ip address 192.168.10.2 255.255.255.0 glbp 10 ip 192.168.10.254 glbp 10 priority 100 glbp 10 weighting 100 lower 90 upper 110 glbp 10 preempt glbp 10 authentication md5 key-string cisco123 # 验证负载分担 RouterA# show glbp brief # 输出 # Interface Grp Fwd Pri State Address Active router # Vl10 10 - 110 Active 192.168.10.254 local # Vl10 10 1 100 Standby 192.168.10.254 192.168.10.2 # RouterB# show glbp brief # 输出 # Interface Grp Fwd Pri State Address Active router # Vl10 10 2 100 Active 192.168.10.254 local # Vl10 10 - 110 Standby 192.168.10.254 192.168.10.1 # 流量分发验证在PC上连续ping PC ping 192.168.10.254 -n 100 # 抓包分析约50%的ICMP请求由RouterA的AVGActive Virtual Gateway响应50%由RouterB的AVG响应避坑 / 常见问题 / 排查现象1HSRP配置后show standby显示state为Init原因两端standby group号不一致或ip未配置或authentication密钥不同解决show run interface vlan id逐项比对group、ip、priority、authentication现象2GLBP中show glbp显示FwdForwarder状态为-无流量分担原因weighting值低于lower阈值或preempt未启用导致权重变化不生效解决show glbp group detail查看Weighting值确保current≥lower现象3VRRP配置后show vrrp显示State为Initialize原因VRRP要求接口IP必须与虚拟IP在同一子网且priority必须为1–255100为默认解决show ip interface vlan id确认接口IP与虚拟IP掩码匹配vrrp group priority 1-255显式设置现象4启用standby track后主路由器未降权原因track对象如接口、IP SLA未UP或decrement值过大导致priority≤0解决show track查看跟踪对象状态show standby group确认priority已更新现象5HSRP/VRRP/GLBP虚拟IP无法ping通原因SVI未no shutdown或VLAN内无ACTIVE端口或防火墙如ip access-group阻止ICMP解决show ip interface vlan id确认line protocol is upshow vlan id vid确认端口UP5. 安全特性端口安全、DHCP Snooping、DAI的联动防御体系构建企业网安全不是单点加固而是端口层→接入层→网关层的纵深防御。这份笔记用255页中第153–210页把Port-Security、DHCP Snooping、DAIDynamic ARP Inspection三者串联成闭环端口限制MAC→DHCP分配合法IP→DAI校验ARP真实性。每一步都给出show命令验证结果。5.1 端口安全Port-Securityswitchport port-security与违规惩罚的硬编码Port-Security是交换机端口的MAC地址白名单。笔记第158页强调“violation restrict不是丢包而是记录日志并触发SNMP trapviolation shutdown才是真·物理断网”。# 配置ACCESS端口 interface f0/1 switchport mode access switchport port-security # ← 启用端口安全 switchport port-security maximum 2 # ← 最多学习2个MAC switchport port-security mac-address sticky # ← 学习后固化为静态条目 switchport port-security violation restrict # ← 违规时记录日志不shutdown # 验证 Switch# show port-security interface f0/1 # 输出 # Port Security : Enabled # Port Status : Secure-down # ← 若违规状态变为Secure-down # Violation Mode : Restrict # Aging Time : 0 mins # Aging Type : Absolute # SecureStatic Address Aging : Disabled # Maximum MAC Addresses : 2 # Total MAC Addresses : 2 # Configured MAC Addresses : 0 # Sticky MAC Addresses : 2 # Last Source Address: ca01.2345.6789 # Security Violation Count : 1 # ← 违规次数触发trap # 查看违规日志 Switch# show logging | include SECURITY # 输出%SW_MATM-4-MACFLAP_NOTIF: Host ca01.2345.6789 in vlan 10 is flapping between port f0/1 and port f0/2参数说明switchport port-security mac-address sticky动态学习的MAC自动转为静态重启不丢失violation restrict违规时丢弃数据帧记录日志不关闭端口适合监控场景violation shutdown违规时立即err-disable端口适合强安全场景show port-security address查看所有安全MAC地址含sticky和static5.2 DHCP Snoopingip dhcp snooping与信任端口的生死线DHCP Snooping是DHCP流量的过滤器只允许信任端口uplink发送DHCP Server报文如DHCPOFFER。笔记第165页用实验指出“若忘记ip dhcp snooping trust所有客户端将无法获取IP”。# 全局启用 ip dhcp snooping ip dhcp snooping vlan 10,20 # 信任端口连接DHCP服务器或核心交换机 interface g0/1 ip dhcp snooping trust # 非信任端口连接PC interface f0/1 # 不配置trust → 自动为untrusted # 验证 Switch# show ip dhcp snooping # 输出 # Switch DHCP snooping is enabled # DHCP snooping is configured on following VLANs: # 10,20 # Insertion of option 82 is disabled # Option 82 on untrusted port is not allowed # Verification of hwaddr field is enabled # Verification of giaddr field is enabled # DHCP snooping database is disabled # # DHCP snooping is configured on the following L3 Interfaces: # Interface Trusted # Gi0/1 Yes # Fa0/1 No # 查看DHCP绑定表关键 Switch# show ip dhcp snooping binding # 输出 # MacAddress IpAddress Lease(sec) Type VLAN Interface # 00:11:22:33:44:55 192.168.10.10 86400 dhcp-snooping 10 Fa0/1 # 00:aa:bb:cc:dd:ee 192.168.10.11 86400 dhcp-snooping 10 Fa0/2逻辑说明show ip dhcp snooping binding是唯一可信的IP-MAC-VLAN-Port绑定表用于定位非法设备若客户端无法获取IPshow ip dhcp snooping statistics查看Dropped计数若Invalid source MAC高说明非信任端口发了DHCP Server报文5.3 DAIDynamic ARP Inspectionip arp inspection与DHCP Snooping的强依赖DAI是ARP报文的“海关”它必须依赖DHCP Snooping的绑定表来校验ARP请求/响应的真实性。笔记第172页警告“DAI未启用DHCP Snooping时所有ARP被丢弃”。# 启用DAI必须先有DHCP Snooping ip arp inspection vlan 10,20 # 信任端口同DHCP Snooping interface g0/1 ip arp inspection trust # 非信任端口自动 interface f0/1 # 验证 Switch# show ip arp inspection vlan 10 # 输出 # Source Mac Validation : Disabled # Destination Mac Validation : Disabled # IP Address Validation : Enabled # # Vlan Configuration Operation ACL Match Static ACL Vlan ACL # ---- --------------- --------- --------- ---------- -------- # 10 Enabled Active - - - # # Interface Trusted Rate(pps) p a hrefhttps://download.csdn.net/download/m0_45851211/21739046 stylecolor:#ec7500;font-size:14px; 本文还有配套的精品资源点击获取 /a img altmenu-r.4af5f7ec.gif srchttps://csdnimg.cn/release/wenkucmsfe/public/img/menu-r.4af5f7ec.gif stylewidth:16px;margin-left:4px;vertical-align:text-bottom;cursor:text; /p