Bubbawny's questions

我有两台 Cisco 3850 交换机（3850-1、3850-2）。我使用 3850-1 的内置 DHCP 设置了 VLAN 1、2、3、4、5（192.168.1.0 - 192.168.5.0）。

3850-1 是 192.168.1.3 3850-2 是 192.168.1.4

我在两者之间有一个以太通道设置。我目前将它们设置为允许所有 VLAN（稍后会限制）。

每个 VLAN 都配置了 HSRP，以便 VIP 作为每个 VLAN 子网的默认网关保持活动状态。

我有一个新的 Cisco 1852e WAP（MObility Express 模式）。它是 192.168.1.5 上的 Mobility Express Manager。

如果我将一个设备（比如 iPhone）连接到为 VLAN 3 设置的 SSID（客户），它工作得很好。Device 获得 IP 地址 192.168.3.51，D/G 192.168.3.1。我可以ping除一个以外的每个IP（我的3850-1交换机，ip 192.168.1.3）。

如果我将设备连接到 SSID 员工，为 VLAN 2 设置，该设备的 IP 地址为 192.168.2.54 d/g 192.168.2.1。除了 192.168.1.3 (3850-1) 之外，我可以 ping 通所有内容。

疯狂的事情：192.168.1.3 (3850-1) 可以 ping 任一设备的给定 IP，192.168.1.4 (3850-2) 也可以。如果我通过 SSH 连接到任何一个，它们都可以 ping 任何一个 SSID/子网/VLAN 上的设备。

但是两个设备都无法 ping 192.168.1.3 (3850-1)。

我想知道我的 Etherchannel 设置是否有问题？

它快把我逼疯了。我不是这方面的专家。让我们把它放在那里。到目前为止，我无法弄清楚为什么每个交换机都可以成功 ping 任何 SSID 上的任何设备，但这些设备只能 ping 192.168.1.3 (3850-1)。

这是我在 3850-1 的待命信息：

3850-1#show standby br
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl2         10   100 P Standby 192.168.2.3     local           192.168.2.1
Vl3         30   100 P Standby 192.168.3.3     local           192.168.3.1
Vl4         40   100 P Standby 192.168.4.3     local           192.168.4.1

这是从 3850-2 开始的：

3850-2#sho standby br
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl2         10   100 P Active  local           192.168.2.2     192.168.2.1
Vl3         30   100 P Active  local           192.168.3.2     192.168.3.1
Vl4         40   100 P Active  local           192.168.4.2     192.168.4.1

这是我来自 3850-1 的 vlan 中继信息：

3850-1#show int trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi1/0/5     on               802.1q         trunking      1
Gi1/0/23    on               802.1q         trunking      1
Gi1/0/24    on               802.1q         trunking      1

Port        Vlans allowed on trunk
Gi1/0/5     1-4094
Gi1/0/23    1-4094
Gi1/0/24    1-4094

Port        Vlans allowed and active in management domain
Gi1/0/5     1-5,13
Gi1/0/23    1-5,13
Gi1/0/24    1-5,13

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/5     1-5,13
Gi1/0/23    none
Gi1/0/24    1-5,13

从 3850-2 开始：

3850-2#show int trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi1/0/11    on               802.1q         trunking      1
Gi1/0/23    on               802.1q         trunking      1
Gi1/0/24    on               802.1q         trunking      1

Port        Vlans allowed on trunk
Gi1/0/11    1-4094
Gi1/0/23    1-4094
Gi1/0/24    1-4094

Port        Vlans allowed and active in management domain
Gi1/0/11    1-5,13
Gi1/0/23    1-5,13
Gi1/0/24    1-5,13

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/11    1-5,13
Gi1/0/23    1-5,13
Gi1/0/24    1

我的 1852e 在 3850-2 G1/0/11 上。根据 Cisco 的 MObility express 文档，它被设置为 TRUNK 端口，以方便在各种 VLAN 上使用 SSID。

我的以太通道在每个交换机上配置为 g1/0/23 和 g1/0/24。

这是我的配置（3850-1）：

!
! Last configuration change at 14:13:22 UTC Mon Jun 27 2016
!
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname 3850-1
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-vrf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
logging console emergencies
enable secret 4 h0Ne.6akbVdjXZ6DzRvN1DHQNFi/WK0h2CApUGBYEF2
!
no aaa new-model
clock timezone UTC -5 0
clock summer-time UTC recurring
switch 1 provision ws-c3850-24t
!
!
!
!
!
ip routing
!
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.1.1 192.168.1.50
ip dhcp excluded-address 192.168.2.1 192.168.2.50
ip dhcp excluded-address 192.168.3.1 192.168.3.50
ip dhcp excluded-address 192.168.4.1 192.168.4.50
!
ip dhcp pool 192.168.2.1
 network 192.168.2.0 255.255.255.0
 default-router 192.168.2.1 
 dns-server 192.168.13.250 8.8.8.8 192.168.13.251 
 netbios-name-server 192.168.13.250 192.168.13.251 
 netbios-node-type h-node
!
ip dhcp pool 192.168.1.0
 network 192.168.1.0 255.255.255.0
 dns-server 192.168.13.250 8.8.8.8 192.168.13.251 
 default-router 192.168.1.3 
 netbios-name-server 192.168.13.250 192.168.13.251 
 netbios-node-type h-node
!
ip dhcp pool 192.168.3.1
 network 192.168.3.0 255.255.255.0
 default-router 192.168.3.1 
 dns-server 192.168.13.250 8.8.8.8 
 netbios-name-server 192.168.13.250 192.168.13.251 
 netbios-node-type h-node
!
ip dhcp pool 192.168.4.1
 network 192.168.4.0 255.255.255.0
 dns-server 192.168.13.250 8.8.8.8 192.168.13.251 
 default-router 192.168.4.1 
 netbios-name-server 192.168.13.250 192.168.13.251 
 netbios-node-type h-node
!
!
qos wireless-default-untrust
qos queue-softmax-multiplier 100
!
crypto pki trustpoint TP-self-signed-1939811358
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1939811358
 revocation-check none
 rsakeypair TP-self-signed-1939811358
!
!
crypto pki certificate chain TP-self-signed-1939811358
 certificate self-signed 01
  3082023E 308201A7 A0030201 02020101 300D0609 2A864886 F70D0101 04050030 
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 
  69666963 6174652D 31393339 38313133 3538301E 170D3136 30353236 30383135 
  33355A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 39333938 
  31313335 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 
  8100E6B8 E8FF2963 DEE3DD17 10EE39CB F2CB7271 9E9AD651 97446D51 BDE3D7A7 
  76B97FE8 C2E04D64 10123FE4 D407301C 30CFFFBC E813B22C 7F2C0253 FD2890C5 
  46BA859E 6950720F 585E3D02 1BE7E7EB 1E450758 1E496631 2FF61BCD BEC5035F 
  FEBCB503 88E5D05B 2A0262F7 CE0471CD AA8E3027 487730E0 F78BE317 BBFB4B67 
  4C130203 010001A3 66306430 0F060355 1D130101 FF040530 030101FF 30110603 
  551D1104 0A300882 06537769 74636830 1F060355 1D230418 30168014 A195FE1A 
  E1181495 C0D78655 DE8FA75D 8EBBA017 301D0603 551D0E04 160414A1 95FE1AE1 
  181495C0 D78655DE 8FA75D8E BBA01730 0D06092A 864886F7 0D010104 05000381 
  8100D556 C2170C0D FDD8DE80 40B96CBF 7D63D893 A6480140 D1A16E36 FB10A6A8 
  C626DCC6 62066503 002CD936 573C6A08 0F618DAF 5791F89A 0759E261 6E4E2E6F 
  062430D8 E6B7D922 1EADA08E 4BB3D45E E9744A8C 74F2CEBC AA442D6A EDEB7446 
  B05C4335 A8E40C8B E8175A36 6A11A057 9D8323BA 42F7214E C93A16F4 EED8C496 3D90
    quit
diagnostic bootup level minimal
spanning-tree mode pvst
spanning-tree extend system-id
hw-switch switch 1 logging onboard message level 3
!
redundancy
 mode sso
!
!
!
class-map match-any non-client-nrt-class
!
policy-map port_child_policy
 class non-client-nrt-class
  bandwidth remaining ratio 10
!
! 
!
!
!
!
!
!
!
!
!
!
!
!
interface Port-channel1
!
interface GigabitEthernet0/0
 vrf forwarding Mgmt-vrf
 ip address 192.168.1.2 255.255.255.0
 negotiation auto
!
interface GigabitEthernet1/0/1
 description Uplink to Firewall to TimeWarner
 switchport mode access
!
interface GigabitEthernet1/0/2
!
interface GigabitEthernet1/0/3
 description was to fiber transceiver in room west of W1
!
interface GigabitEthernet1/0/4
!
interface GigabitEthernet1/0/5
 description long haul to box room (west) into 5 port switch
 switchport mode trunk
!
interface GigabitEthernet1/0/6
!
interface GigabitEthernet1/0/7
!
interface GigabitEthernet1/0/8
!
interface GigabitEthernet1/0/9
 switchport mode access
!
interface GigabitEthernet1/0/10
!
interface GigabitEthernet1/0/11
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/0/13
 switchport mode access
!
interface GigabitEthernet1/0/14
!
interface GigabitEthernet1/0/15
!
interface GigabitEthernet1/0/16
!
interface GigabitEthernet1/0/17
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
!
interface GigabitEthernet1/0/20
!
interface GigabitEthernet1/0/21
!
interface GigabitEthernet1/0/22
!
interface GigabitEthernet1/0/23
 switchport mode trunk
 channel-group 1 mode auto
!
interface GigabitEthernet1/0/24
 switchport mode trunk
 channel-group 1 mode auto
!
interface GigabitEthernet1/1/1
!
interface GigabitEthernet1/1/2
!
interface GigabitEthernet1/1/3
!
interface GigabitEthernet1/1/4
!
interface TenGigabitEthernet1/1/1
!
interface TenGigabitEthernet1/1/2
!
interface TenGigabitEthernet1/1/3
!
interface TenGigabitEthernet1/1/4
!
interface Vlan1
 ip address 192.168.1.3 255.255.255.0
 ip helper-address 192.168.1.3
!
interface Vlan2
 ip address 192.168.2.2 255.255.255.0
 ip helper-address 192.168.2.1
 standby 10 ip 192.168.2.1
 standby 10 timers msec 200 msec 750
 standby 10 preempt delay minimum 300
!
interface Vlan3
 ip address 192.168.3.2 255.255.255.0
 ip helper-address 192.168.3.1
 standby 30 ip 192.168.3.1
 standby 30 timers msec 200 msec 750
 standby 30 preempt delay minimum 300
!
interface Vlan4
 ip address 192.168.4.2 255.255.255.0
 ip helper-address 192.168.4.1
 standby 40 ip 192.168.4.1
 standby 40 timers msec 200 msec 750
 standby 40 preempt delay minimum 300
!
interface Vlan5
 ip address 192.168.5.1 255.255.255.0
!
interface Vlan13
 ip address 192.168.13.1 255.255.255.0
!
ip forward-protocol nd
no ip http server
ip http secure-server
ip route 0.0.0.0 0.0.0.0 192.168.1.1
ip route 192.168.1.0 255.255.255.0 Vlan1
ip route 192.168.2.0 255.255.255.0 Vlan2
ip route 192.168.3.0 255.255.255.0 Vlan3
ip route 192.168.4.0 255.255.255.0 Vlan4
!
!
!
!
!
line con 0
 exec-timeout 0 0
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 password 275woodward
 login
line vty 5 15
 password 275woodward
 login
!
wsma agent exec
 profile httplistener
 profile httpslistener
!
wsma agent config
 profile httplistener
 profile httpslistener
!
wsma agent filesys
 profile httplistener
 profile httpslistener
!
wsma agent notify
 profile httplistener
 profile httpslistener
!
!
wsma profile listener httplistener
 transport http
!
wsma profile listener httpslistener
 transport https
!
ap group default-group
end

最后，这是 3850-2 的配置：

!
! Last configuration change at 14:13:22 UTC Mon Jun 27 2016
!
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname 3850-1
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-vrf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
logging console emergencies
enable secret 4 h0Ne.6akbVdjXZ6DzRvN1DHQNFi/WK0h2CApUGBYEF2
!
no aaa new-model
clock timezone UTC -5 0
clock summer-time UTC recurring
switch 1 provision ws-c3850-24t
!
!
!
!
!
ip routing
!
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.1.1 192.168.1.50
ip dhcp excluded-address 192.168.2.1 192.168.2.50
ip dhcp excluded-address 192.168.3.1 192.168.3.50
ip dhcp excluded-address 192.168.4.1 192.168.4.50
!
ip dhcp pool 192.168.2.1
 network 192.168.2.0 255.255.255.0
 default-router 192.168.2.1 
 dns-server 192.168.13.250 8.8.8.8 192.168.13.251 
 netbios-name-server 192.168.13.250 192.168.13.251 
 netbios-node-type h-node
!
ip dhcp pool 192.168.1.0
 network 192.168.1.0 255.255.255.0
 dns-server 192.168.13.250 8.8.8.8 192.168.13.251 
 default-router 192.168.1.3 
 netbios-name-server 192.168.13.250 192.168.13.251 
 netbios-node-type h-node
!
ip dhcp pool 192.168.3.1
 network 192.168.3.0 255.255.255.0
 default-router 192.168.3.1 
 dns-server 192.168.13.250 8.8.8.8 
 netbios-name-server 192.168.13.250 192.168.13.251 
 netbios-node-type h-node
!
ip dhcp pool 192.168.4.1
 network 192.168.4.0 255.255.255.0
 dns-server 192.168.13.250 8.8.8.8 192.168.13.251 
 default-router 192.168.4.1 
 netbios-name-server 192.168.13.250 192.168.13.251 
 netbios-node-type h-node
!
!
qos wireless-default-untrust
qos queue-softmax-multiplier 100
!
crypto pki trustpoint TP-self-signed-1939811358
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1939811358
 revocation-check none
 rsakeypair TP-self-signed-1939811358
!
!
crypto pki certificate chain TP-self-signed-1939811358
 certificate self-signed 01
  3082023E 308201A7 A0030201 02020101 300D0609 2A864886 F70D0101 04050030 
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 
  69666963 6174652D 31393339 38313133 3538301E 170D3136 30353236 30383135 
  33355A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 39333938 
  31313335 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 
  8100E6B8 E8FF2963 DEE3DD17 10EE39CB F2CB7271 9E9AD651 97446D51 BDE3D7A7 
  76B97FE8 C2E04D64 10123FE4 D407301C 30CFFFBC E813B22C 7F2C0253 FD2890C5 
  46BA859E 6950720F 585E3D02 1BE7E7EB 1E450758 1E496631 2FF61BCD BEC5035F 
  FEBCB503 88E5D05B 2A0262F7 CE0471CD AA8E3027 487730E0 F78BE317 BBFB4B67 
  4C130203 010001A3 66306430 0F060355 1D130101 FF040530 030101FF 30110603 
  551D1104 0A300882 06537769 74636830 1F060355 1D230418 30168014 A195FE1A 
  E1181495 C0D78655 DE8FA75D 8EBBA017 301D0603 551D0E04 160414A1 95FE1AE1 
  181495C0 D78655DE 8FA75D8E BBA01730 0D06092A 864886F7 0D010104 05000381 
  8100D556 C2170C0D FDD8DE80 40B96CBF 7D63D893 A6480140 D1A16E36 FB10A6A8 
  C626DCC6 62066503 002CD936 573C6A08 0F618DAF 5791F89A 0759E261 6E4E2E6F 
  062430D8 E6B7D922 1EADA08E 4BB3D45E E9744A8C 74F2CEBC AA442D6A EDEB7446 
  B05C4335 A8E40C8B E8175A36 6A11A057 9D8323BA 42F7214E C93A16F4 EED8C496 3D90
    quit
diagnostic bootup level minimal
spanning-tree mode pvst
spanning-tree extend system-id
hw-switch switch 1 logging onboard message level 3
!
redundancy
 mode sso
!
!
!
class-map match-any non-client-nrt-class
!
policy-map port_child_policy
 class non-client-nrt-class
  bandwidth remaining ratio 10
!
! 
!
!
!
!
!
!
!
!
!
!
!
!
interface Port-channel1
!
interface GigabitEthernet0/0
 vrf forwarding Mgmt-vrf
 ip address 192.168.1.2 255.255.255.0
 negotiation auto
!
interface GigabitEthernet1/0/1
 description Uplink to Firewall to TimeWarner
 switchport mode access
!
interface GigabitEthernet1/0/2
!
interface GigabitEthernet1/0/3
 description was to fiber transceiver in room west of W1
!
interface GigabitEthernet1/0/4
!
interface GigabitEthernet1/0/5
 description long haul to box room (west) into 5 port switch
 switchport mode trunk
!
interface GigabitEthernet1/0/6
!
interface GigabitEthernet1/0/7
!
interface GigabitEthernet1/0/8
!
interface GigabitEthernet1/0/9
 switchport mode access
!
interface GigabitEthernet1/0/10
!
interface GigabitEthernet1/0/11
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/0/13
 switchport mode access
!
interface GigabitEthernet1/0/14
!
interface GigabitEthernet1/0/15
!
interface GigabitEthernet1/0/16
!
interface GigabitEthernet1/0/17
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
!
interface GigabitEthernet1/0/20
!
interface GigabitEthernet1/0/21
!
interface GigabitEthernet1/0/22
!
interface GigabitEthernet1/0/23
 switchport mode trunk
 channel-group 1 mode auto
!
interface GigabitEthernet1/0/24
 switchport mode trunk
 channel-group 1 mode auto
!
interface GigabitEthernet1/1/1
!
interface GigabitEthernet1/1/2
!
interface GigabitEthernet1/1/3
!
interface GigabitEthernet1/1/4
!
interface TenGigabitEthernet1/1/1
!
interface TenGigabitEthernet1/1/2
!
interface TenGigabitEthernet1/1/3
!
interface TenGigabitEthernet1/1/4
!
interface Vlan1
 ip address 192.168.1.3 255.255.255.0
 ip helper-address 192.168.1.3
!
interface Vlan2
 ip address 192.168.2.2 255.255.255.0
 ip helper-address 192.168.2.1
 standby 10 ip 192.168.2.1
 standby 10 timers msec 200 msec 750
 standby 10 preempt delay minimum 300
!
interface Vlan3
 ip address 192.168.3.2 255.255.255.0
 ip helper-address 192.168.3.1
 standby 30 ip 192.168.3.1
 standby 30 timers msec 200 msec 750
 standby 30 preempt delay minimum 300
!
interface Vlan4
 ip address 192.168.4.2 255.255.255.0
 ip helper-address 192.168.4.1
 standby 40 ip 192.168.4.1
 standby 40 timers msec 200 msec 750
 standby 40 preempt delay minimum 300
!
interface Vlan5
 ip address 192.168.5.1 255.255.255.0
!
interface Vlan13
 ip address 192.168.13.1 255.255.255.0
!
ip forward-protocol nd
no ip http server
ip http secure-server
ip route 0.0.0.0 0.0.0.0 192.168.1.1
ip route 192.168.1.0 255.255.255.0 Vlan1
ip route 192.168.2.0 255.255.255.0 Vlan2
ip route 192.168.3.0 255.255.255.0 Vlan3
ip route 192.168.4.0 255.255.255.0 Vlan4
!
!
!
!
!
line con 0
 exec-timeout 0 0
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 password 275woodward
 login
line vty 5 15
 password 275woodward
 login
!
wsma agent exec
 profile httplistener
 profile httpslistener
!
wsma agent config
 profile httplistener
 profile httpslistener
!
wsma agent filesys
 profile httplistener
 profile httpslistener
!
wsma agent notify
 profile httplistener
 profile httpslistener
!
!
wsma profile listener httplistener
 transport http
!
wsma profile listener httpslistener
 transport https
!
ap group default-group
end

我有两个新的 3850 24 端口千兆交换机。我把一个放在我们仓库前面的接线柜里，另一个放在后面。

有没有办法让这些成为使用 VSS 的第 2 层/第 3 层虚拟交换机？

我正在考虑创建一个跨堆栈的以太通道。但不知道关于第 2 层/第 3 层冗余（如果有的话）的真正作用。我配置了 DHCP、几个 VLAN 和 VLAN 间路由。

希望有某种方法可以做到这一点，以便如果一台交换机发生故障，另一台仍将提供 VLAN 间路由。

假设我有 VLAN 2。我在 VLAN 2 中为 3850-1 分配了一个 IP 为 192.168.1.1 的端口。

假设我有 3850-2，我有一个以太通道。

如果 3850-1 出现故障，我希望 3850-2 仍然能够路由 VLAN 2 作为该 VLAN 的默认网关。

这几乎就像为每个 VLAN 的默认网关 IP 设置一个虚拟 IP，并让一个交换机在其上扮演主动角色，如果该交换机出现故障，则让另一台交换机接管该 VIP 并继续提供基本的 intervlan 路由。

也许换一种说法，我怎样才能让两台交换机提供 VLAN 间路由冗余？