router_on_a_stick
什么是单臂路由，为什么要用到单臂路由？在网络管理实践中，通过在交换机上划分适当数目的vlan，不仅能有效隔离广播风暴，还能提高网络安全系数及网络带宽的利用效率。划分vlan之后，vlan与vlan之间是不能通信的，只能通过路由或三层交换来实现。我们知道路由器实现路由功能通常是数据报从一个接口进来然后另一个接口出来，现在，路由器与交换机之间只通过一条主干线路，来实现通信或数据转发，（负责多个vlan之间的的通信），因为是一条线路，在逻辑上分开，所以形象地叫单臂，也就是说路由器仅用一个接口实现数据的进与出，因为我们形象地称它为单臂路由。单臂路由是解决vlan间通信的一种廉价而实用的解决方案。
那么什么时候要用到单臂路由呢?如果在企业内部网络中划分了不同VLAN，当不同VLAN之间有部分主机需要通信,但你的交换机又不支持三层交换功能（你又无资金购买三层交换机），如果你有一台支持802.1Q的路由器，或者购买一台这样的路由器，我们用该路由器做单臂路由就可实现VLAN的互通。我们只需要在该路由器的以太口上建立子接口，并分配IP地址作为该VLAN的网关，同时启动802.1Q协议即可。
提示:
一个物理接口当成多个逻辑接口来使用时，往往需要在该接口上启用子接口。通过一个个的逻辑子接口实现物理端口以一当多的功能。
拓扑图如下：
一、配置交换机
接入交换机，创建vlan 10，20 ，30，并将接口分配到vlan中，在交换机中设置与路由器相连的接口为trunk接口
Switch>enable
Switch#configure terminal
Switch(config)#hostname jieru
jieru(config)#interface f0/1
jieru(config-if)#switchport mode access
jieru(config-if)#switchport access vlan 10
jieru(config-if)#no shutdown
jieru(config-if)#exit
jieru(config)#interface f0/2
jieru(config-if)#switchport mode access
jieru(config-if)#switchport access vlan 10
jieru(config-if)#no shutdown
jieru(config-if)#exit
jieru(config)#interface f0/3
jieru(config-if)#switchport mode access
jieru(config-if)#switchport access vlan 20
jieru(config-if)#no shutdown
jieru(config-if)#exit
jieru(config)#interface f0/5
jieru(config-if)#switchport mode access
jieru(config-if)#switchport access vlan 30
jieru(config-if)#no shutdown
jieru(config-if)#exit
jieru(config)#interface f0/4
jieru(config-if)#switchport mode access
jieru(config-if)#switchport access vlan 30
jieru(config-if)#no shutdown
jieru(config-if)#exit
jieru(config)#interface f0/6
jieru(config-if)#switchport mode trunk
jieru(config-if)#no shutdown
jieru(config-if)#
jieru(config-if)#exit
jieru(config)#end
jieru#
显示实验配置结果
jieru#show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/6, Fa0/7, Fa0/8, Fa0/9
Fa0/10, Fa0/11, Fa0/12, Fa0/13
Fa0/14, Fa0/15, Fa0/16, Fa0/17
Fa0/18, Fa0/19, Fa0/20, Fa0/21
Fa0/22, Fa0/23, Fa0/24, Gig1/1
Gig1/2
10 VLAN0010 active Fa0/1, Fa0/2
20 VLAN0020 active Fa0/3
30 VLAN0030 active Fa0/4, Fa0/5
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active
jieru#
二、配置路由器
单臂路由器
Router#configure terminal
Router(config)#hostname danbi
danbi(config)#interface f0/0
danbi(config-if)#no shutdown //激活f0/0接口
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
danbi(config-if)#exit
配置子接口
danbi(config)#interface f0/0.1 //配置子接口，注意后面有.1，这是配置单臂路由关键步骤
danbi(config-subif)#ip address 192.168.1.254 255.255.255.0 //为该接口分配ip，该ip应该和该子接口配置的vlan号网段相对应
% Configuring IP routing on a LAN subinterface is only allowed if that
subinterface is already configured as part of an IEEE 802.10, IEEE 802.1Q,
or ISL vLAN.
danbi(config-subif)#no shutdown //激活子接口
danbi(config-subif)#encapsulation dot1Q 10 //为子接口封装802.1Q协议，10代表vlan id，即vlan 10
danbi(config-subif)#exit
danbi(config)#interface f0/0.2 //配置第二个子接口，
%LINK-5-CHANGED: Interface FastEthernet0/0.2, changed state to up
danbi(config-subif)#ip address 192.168.2.254 255.255.255.0
% Configuring IP routing on a LAN subinterface is only allowed if that
subinterface is already configured as part of an IEEE 802.10, IEEE 802.1Q,
or ISL vLAN.
danbi(config-subif)#no shutdown
danbi(config-subif)#encapsulation dot1Q 20
danbi(config-subif)#exit
danbi(config)#interface f0/0.3
danbi(config-subif)#ip address 192.168.3.254 255.255.255.0
% Configuring IP routing on a LAN subinterface is only allowed if that
subinterface is already configured as part of an IEEE 802.10, IEEE 802.1Q,
or ISL vLAN.
danbi(config-subif)#no shutdown
danbi(config-subif)#encapsulation dot1Q 30
danbi(config-subif)#exit
danbi(config)#end
验证接口配置
danbi#show ip interface brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 unassigned YES manual up up
FastEthernet0/0.1 192.168.1.254 YES manual up up
FastEthernet0/0.2 192.168.2.254 YES manual up up
FastEthernet0/0.3 192.168.3.254 YES manual up up
FastEthernet0/1 unassigned YES manual administratively down down
Ethernet0/3/0 unassigned YES manual administratively down down
FastEthernet1/0 unassigned YES manual administratively down down
FastEthernet1/1 unassigned YES manual administratively down down
FastEthernet1/2 unassigned YES manual administratively down down
FastEthernet1/3 unassigned YES manual administratively down down
FastEthernet1/4 unassigned YES manual administratively down down
FastEthernet1/5 unassigned YES manual administratively down down
FastEthernet1/6 unassigned YES manual administratively down down
FastEthernet1/7 unassigned YES manual administratively down down
FastEthernet1/8 unassigned YES manual administratively down down
FastEthernet1/9 unassigned YES manual administratively down down
FastEthernet1/10 unassigned YES manual administratively down down
FastEthernet1/11 unassigned YES manual administratively down down
FastEthernet1/12 unassigned YES manual administratively down down
FastEthernet1/13 unassigned YES manual administratively down down
FastEthernet1/14 unassigned YES manual administratively down down
FastEthernet1/15 unassigned YES manual administratively down down
Vlan1 unassigned YES manual administratively down down
danbi#
三、验证实验成功完成
A电脑应该可以ping同其他电脑
本文出自 “理想彼岸” 博客，转载请与作者联系！