Ukwandiswa kwezixeko ezikhulu kunye nokwakhiwa kwee-agglomerations yenye yeendlela ezibalulekileyo kuphuhliso loluntu namhlanje. I-Moscow yodwa kufuneka ikhulise nge-2019 yezigidi zeemitha ze-square yezindlu kwi-4 (kwaye oku akubali iindawo zokuhlala ze-15 eziza kongezwa ngo-2020). Kuwo wonke lo mmandla mkhulu, abaqhubi bee-telecom kuya kufuneka banike abasebenzisi ithuba lokufikelela kwi-Intanethi. Ezi zinokuba zii-microdistrict zasezidolophini ezinezakhiwo ezixineneyo ezinemigangatho emininzi, okanye ngaphezulu βkukhutshiweβ kwiilali zasekottage. Kwezi meko, iimfuno zehardware zahluke kancinane. Sihlalutye nganye kwezi meko kwaye senza imodeli yokutshintsha kwe-universal optical - T2600G-28SQ. Kule post siza kuhlalutya ngokweenkcukacha amandla esixhobo esiya kuba nomdla kubaqhubi be-telecom kulo lonke elaseRashiya.
Beka kwinethiwekhi
I-T2600G-28SQ iswitshi yenzelwe zombini ukusebenza kwinqanaba lokufikelela kwinethiwekhi kunye nokudibanisa amakhonkco ukusuka kwezinye iiswitshi zokufikelela kwinqanaba. Lo ngumaleko we-2600 otshintshayo owenza utshintsho kunye nomzila omileyo. Ukuba umqhubi utshintshe zombini ukudibanisa kunye nokufikelela (umzila kuphela kwi-core network), i-T28G-XNUMXSQ iya kungena kuwo nawaphi na amanqanaba. Kwimeko yodityaniso oluguquguqukayo, kusafuneka uthathele ingqalelo ezinye izithintelo kwiimeko zokusebenzisa.
Imodeli ye-T2600G-28SQ yinguqu epheleleyo esebenzayo ye-Ethernet ngaphandle kwezithintelo ezongezelelweyo ezivela xa usebenzisa i-xPON okanye iteknoloji efanayo. Ngokomzekelo, ngaphandle kwesoyikiso sokuhla ngokukhawuleza kwesantya kunye nokunyuka kwenani labasebenzisi okanye ukungahambi kakuhle phakathi kwezixhobo ezivela kubathengisi abahlukeneyo kunye ne-firmware. Bobabini abasebenzisi bokugqibela kunye nokutshintsha okungaphantsi kokufikelela kunye ne-optical uplinks, umzekelo, imodeli ye-T2600G-28TS, inokuxhuma kwi-interfaces yesixhobo. Umzobo ongezantsi ubonisa eyona mizekelo ixhaphakileyo yoqhagamshelwano olunjalo.
Ukufikelela kwinethiwekhi yomsebenzisi wokugqibela, i-fiber optical okanye i-twisted pair cable ingasetyenziswa. Kwicala lomrhumo, i-fiber optical inokupheliswa okanye isebenzisa i-media converter (i-media converter), umzekelo, i-TP-Link MC220L; kunye nokusebenzisa ujongano lwe-optical kwi-router ye-SOHO.
Ukuqhagamshela umxhasi okufutshane, ungasebenzisa izibuko ezine ze-RJ-45 ezisebenza ngesantya se-10/100/1000 Mbit/s. Ukuba ngenxa yesizathu esithile oku akwanelanga, umqhubi uno "ukuguqula" i-switch interfaces optical interfaces kubhedu. Oku kunokwenziwa ngokusebenzisa ii-SFP ezikhethekileyo "zethusi" kunye ne-RJ-45 isixhumi. Kodwa isisombululo esinjalo asinakubizwa ngokuba sisiqhelo.
Eminye imizekelo eyenziwayo
Ukugqiba umfanekiso, siya kunika imizekelo emininzi yokusebenzisa iiswitshi ze-T2600G-28SQ.
umboneleli wengingqi yaseMoscow , leyo, ngaphezu kwe-Intanethi, inikezela ngeenkonzo ze-telephony kunye ne-cable TV, isebenzisa i-T2600G-28SQ kwinqanaba lokufikelela xa kwakhiwa amanethiwekhi kwicandelo labucala (ii-cottages kunye ne-townhouses). Kwicala lomxhasi, uxhulumaniso lwenziwa kwii-routers ezine-port ye-SFP, kunye nabaguquleli beendaba. Okwangoku, ii-router ze-SOHO ezinechweba le-SFP aziveliswa ngobuninzi kwilizwe lethu, kodwa, ngokuqinisekileyo, sicinga ngayo.
Umsebenzisi wonxibelelwano ukusuka kwingingqi yePavlovo-Posad isebenzisa i-T2600G-28SQ ukutshintsha njenge "aggregation encinci", usebenzisa iinguqu ze-T2600G-28TS kunye ne-T2500G-10TS yokufikelela kwiimodeli.
Iqela lenkampani ukunika ukufikelela kwi-Intanethi, iTV, umnxeba, kunye neenkqubo zokucupha iividiyo kumzantsi-mpuma wengingqi yaseMoscow (Kolomna, Lukhovitsy, Zaraysk, Serebryanye Prudy, Ozyory). I-topology eqikelelweyo apha iyafana ne-ISS: T2600G-28SQ kwinqanaba lokudibanisa, kunye ne-T2600G-28TS kunye ne-T2500G-10TS kwinqanaba lokufikelela.
ISP ukusuka eKrasnoznamensk inikezela ukufikelela kwi-Intanethi usebenzisa inethiwekhi enokungena okunzulu optical. Ikwasekelwe kwi-T2600G-28SQ.
Kula macandelo alandelayo siza kuchaza ngokufutshane ezinye zeempawu ze-T2600G-28SQ. Ukuze singabhubhisi izinto eziphathekayo, sishiye inani leenketho: QinQ (VLAN VPN), umzila, QoS, njl. Sicinga ukuba sinokubuyela kubo kwenye yezi zithuba zilandelayo.
Guqula izakhono
Ugcino-STP
I-STP β iProtokholi yoMthi eNabileyo. Iprotocol yomthi ejikelezayo yaziwa ixesha elide kakhulu, enkosi kuRadya Perlman ohlonitshwayo ngale nto. Kuthungelwano lwangoku, abalawuli bazama ngandlela zonke ukunqanda ukusebenzisa le protocol. Ewe, i-STP ayikho ngaphandle kwayo. Kwaye kuhle kakhulu ukuba kukho enye indlela kuyo. Nangona kunjalo, njengoko kuhlala kunjalo, enye indlela kule protocol iya kuxhomekeka kakhulu kumthengisi. Ke ngoko, ukuza kuthi ga namhlanje, iProtocol yeSpanning Tree ihlala iphantse ibe sisisombululo esixhaswa phantse ngabo bonke abavelisi kwaye yaziwa kubo bonke abalawuli benethiwekhi.
Ukutshintsha kwe-TP-Link T2600G-28SQ ixhasa iinguqulelo ezintathu ze-STP: i-STP yakudala (IEEE 802.1D), i-RSTP (802.1W) kunye ne-MSTP (802.1S).
Kolu khetho, i-RSTP eqhelekileyo ifanelekile kuninzi lwababoneleli be-Intanethi abancinci eRashiya, enenzuzo enye engenakuphikiswa ngaphezu kwenguqulo yeklasikhi - ixesha elifutshane kakhulu lokudibanisa.
Eyona protocol iguquguqukayo namhlanje yiMSTP, exhasa uthungelwano lwenyani (VLANs) kwaye ivumela imithi emininzi eyahlukeneyo, ekuvumela ukuba usebenzise zonke iindlela ezikhoyo zogcino. Umlawuli udala imizekelo emininzi yemithi eyahlukeneyo (ukuya kuthi ga kwisibhozo), nganye isebenze iseti ethile yothungelwano lwenyani.
Izinto ezifihlakeleyo zeMSTPAbalawuli abaqalayo kufuneka balumke kakhulu xa usebenzisa i-MSTP. Oku kungenxa yokuba ukuziphatha kweprothokholi kwahluka ngaphakathi kwingingqi naphakathi kwemimandla. Ngoko ke, xa uqwalasela utshintsho, kuyafaneleka ukuba uqiniseke ukuba uhlala ngaphakathi kwendawo enye.
Uyintoni lo mmandla udume kakubi? Kwimigaqo ye-MSTP, ummandla yiseti yokutshintsha okudityanisiweyo enye kwenye eneempawu ezifanayo: igama lommandla, inombolo yohlaziyo, kunye nokusasazwa kweenethiwekhi zenyani (VLANs) phakathi kweemeko zeprotocol (umzekelo).
Kakade ke, iSpanning Tree protocol (nayiphi na inguqulelo) ikuvumela ukuba ungajongani kuphela nezirhintyela ezivelayo xa uqhagamshela amajelo ogcino, kodwa nokukhusela kwiimpazamo zokutshintsha intambo xa injineli ngabom okanye ngempazamo idibanisa amazibuko angalunganga, idala iluphu neyakhe. izenzo.
Abalawuli benethiwekhi abanamava ngakumbi bakhetha ukusebenzisa iindlela ezahlukeneyo ezongezelelweyo ukukhusela iprotocol ye-STP ekuhlaselweni okanye kwiimeko zeentlekele ezinzima. Imodeli ye-T2600G-28SQ inikeza uluhlu olupheleleyo lwezakhono ezinjalo: I-Loop Protect kunye ne-Root Protect, i-TC Guard, i-BPDU Protect kunye ne-BPDU Filter.
Ukusetyenziswa ngokufanelekileyo kolu khetho ludweliswe ngasentla ngokubambisana nezinye iindlela zokukhusela ezixhaswayo ziya kuzinzisa uthungelwano lwengingqi kwaye luqikelele ngakumbi.
Ugcino-LAG
LAG β Link Aggregation Group. Le yitekhnoloji ekuvumela ukuba udibanise itshaneli ezininzi zomzimba zibe zinengqondo enye. Zonke ezinye iiprothokholi ziyeka ukusebenzisa itshaneli ezibonakalayo ezibandakanyiweyo kwi-LAG ngokwahlukeneyo kwaye ziqale "ukubona" ββujongano olunye olunengqiqo. Umzekelo wendlela yomthetho enjalo yi-STP.
I-traffic yomsebenzisi ilungelelaniswa phakathi kweetshaneli ezibonakalayo ngaphakathi kweetshaneli ezinengqiqo ngokusekelwe kwi-hash sum. Ukuyibala, iidilesi ze-MAC zomthumeli, umamkeli, okanye isibini sazo zingasetyenziswa; kunye needilesi ze-IP zomthumeli, umamkeli, okanye isibini sazo. Ulwazi lweprotocol ye-4 (i-TCP / UDP port) ayithathelwa ngqalelo.
I-T2600G-28SQ iswitshi ixhasa ii-LAG ezizinzileyo kunye neziguquguqukayo.
Ukuxoxisana neeparamitha zokusebenza zeqela eliguqukayo, iprotocol ye-LACP isetyenziswa.
Ukhuseleko-Uluhlu lokuFikelela (ACLs)
I-T2600G-28SQ yethu yokutshintsha ikuvumela ukuba ucofe i-traffic yomsebenzisi usebenzisa uluhlu lokufikelela (ACL - ULuhlu loLawulo lokuFikelela).
Uluhlu lokufikelela oluxhaswayo lunokuba ziindidi ezininzi ezahlukeneyo: i-MAC ne-IP (IPv4/IPv6), idityanisiwe, kunye nokwenza ukuhluzwa komxholo. Inani loluhlu ngalunye lokufikelela kuhlobo oluxhaswayo luxhomekeke kwithempleyithi yeSDM esetyenziswayo ngoku, esiyichaze kwelinye icandelo.
Umsebenzisi unokusebenzisa olu khetho ukubhloka iindlela ezahlukeneyo zetrafikhi ezingafunwayo kumsebenzi womnatha. Umzekelo wendlela enjalo iya kuba yi-IPv6 ipakethe (usebenzisa indawo ye-EtherType) ukuba inkonzo ehambelanayo ayibonelelwanga; okanye uvimbele i-SMB kwi-port 445. Kwinethiwekhi enedilesi ye-static, i-DHCP / BOOTP i-traffic ayifuni, ngoko usebenzisa i-ACL, umlawuli unokucoca ii-datagram ze-UDP kwii-ports 67 kunye ne-68. Unokuvala kwakhona i-IPoE traffic yendawo usebenzisa i-ACL. Ukuvimba okunjalo kunokuba yimfuneko kwiinethiwekhi zabaqhubi usebenzisa iPPPoE.
Inkqubo yokusebenzisa uluhlu lofikelelo ilula kakhulu. Emva kokudala uluhlu ngokwalo, kufuneka ungeze inani elifunekayo leerekhodi kuyo, uhlobo oluxhomekeke ngokuthe ngqo kwiphepha elenziwe ngokwezifiso.
Ukuseta uluhlu lofikelelo
Kuyafaneleka ukuba uqaphele ukuba uluhlu lokufikelela alunakwenza kuphela imisebenzi eqhelekileyo yokuvumela okanye ukukhanyela i-traffic, kodwa kwakhona ukuyiqondisa, ukuyibonisa, kunye nokwenza ukuphawula okanye ukunciphisa izinga.
Xa zonke ii-ACL ezifunekayo zidalwe, umlawuli unokuzifaka. Kuyenzeka ukuba uncamathisele uluhlu lofikelelo kuzo zombini izibuko ebonakalayo kunye nenethiwekhi ethile yenyani.
Ukhuseleko - inani leedilesi ze-MAC
Ngamanye amaxesha abaqhubi kufuneka banciphise inani leedilesi ze-MAC ukuba iswitshi iya kufunda kwizibuko elithile. Uluhlu lokufikelela lukuvumela ukuba ufezekise umphumo ochaziweyo, kodwa kwangaxeshanye ufuna isalathiso esicacileyo seedilesi ze-MAC ngokwazo. Ukuba ufuna kuphela ukunciphisa inani leedilesi zetshaneli, kodwa ungazicacisi ngokucacileyo, ukhuseleko lwezibuko luya kuhlangula.
Isithintelo esinjalo sinokufuneka, umzekelo, ukukhusela ngokuchasene nokudibanisa inethiwekhi yendawo yonke kwi-interface yokutshintsha umnikezeli omnye. Kufanelekile ukukhankanya apha ukuba sithetha ngoqhagamshelwano lwe-dial-up, kuba xa udibanisa usebenzisa i-router kwicala lomxhasi, i-T2600G-28SQ iya kufunda idilesi enye kuphela - le yi-MAC ye-WAN port yomzila womxhasi. .
Kukho iklasi yonke yokuhlaselwa okujoliswe kwitafile yokutshintsha. Oku kunokuba yitafile ephuphumayo okanye i-MAC spoofing. Ukhetho lokhuseleko lwezibuko luya kukuvumela ukuba ukhusele ukuphuphuma kwetafile yebhulorho kunye nohlaselo olujolise ekuqeqesheni kwakhona ukutshintshwa kunye nokutyhefa kwitafile yebhulorho.
Akunakwenzeka ukuba singakhankanywa ngokulula izixhobo zabaxumi. Kukho iimeko ezininzi xa ikhadi lenethiwekhi yekhompyutheni engasebenzi kakuhle okanye i-router idala umlambo weefreyimu ezinomthumeli ongekho mthethweni kunye needilesi zomamkeli. Ukuhamba okunjalo kunokukhupha kalula i-CAM.
Enye indlela yokunciphisa inani lamangeniso etafile yebhulorho esetyenzisiweyo sisixhobo soKhuseleko se-MAC VLAN, esivumela umlawuli ukuba achaze inani eliphezulu lamangeno kuthungelwano oluthile lwenyani.
Ukongeza ekulawuleni amangeno aguquguqukayo kwitafile yokutshintsha, umlawuli unokudala ezimileyo.
Itheyibhile ephezulu yebhuloho yemodeli ye-T2600G-28SQ ingakwazi ukufikelela kwiirekhodi ze-16K.
Enye inketho eyenzelwe ukucoca ukuhanjiswa kwetrafikhi yomsebenzisi ngumsebenzi we-Port Isolation, okuvumela ukuba uchaze ngokucacileyo ukuba ukuhanjiswa kwesikhokelo kuvunyelwe.
Ukhuseleko β IMPB
Kwi-expanses enkulu yelizwe lethu elikhulu, indlela yabaqhubi be-telecom kwimiba yokuqinisekisa ukhuseleko lwenethiwekhi iyahluka ukusuka ekungazini ngokupheleleyo ukuya kusetyenziso oluphezulu olunokwenzeka kuzo zonke iinketho ezixhaswa zizixhobo.
IPv4 IMPB (IP-MAC-Port Binding) kunye ne IPv6 IMPB imisebenzi ikuvumela ukuba ukhusele kuluhlu olupheleleyo lohlaselo olunxulumene nokuphangwa kwe-IP kunye needilesi ze-MAC kwicala lababhalisi ngokubophelela i-IP kunye needilesi ze-MAC zezixhobo zabathengi ujongano lokutshintsha lomboneleli. Oku kubophelela kunokwenziwa ngesandla okanye ngokusebenzisa i-ARP Scanning kunye ne-DHCP Snooping imisebenzi.
Useto olusisiseko lwe-IMMB
Ukulunga, kufuneka kuthiwe umsebenzi okhethekileyo ungasetyenziselwa ukukhusela iprotocol yeDHCP - iDHCP Filter.
Ukusebenzisa lo msebenzi, umlawuli wothungelwano angakwazi ukukhankanya ngesandla ezo ndawo zojongano apho iiseva zokwenyani zeDHCP ziqhagamshelwe. Oku kuya kuthintela iiseva ze-DHCP ezikhohlakeleyo ukuba ziphazamise inkqubo yothethathethwano lwe-IP.
Ukhuseleko-DoS Khusela
Imodeli ephantsi koqwalaselo ivumela ukuba sikhusele abasebenzisi kuhlaselo lweDoS olwaziwayo noluxhaphakileyo ngaphambili.
Uninzi lohlaselo oludwelisiweyo aluseyongozi kwaphela kwizixhobo ezinenkqubo yokusebenza yale mihla, kodwa uthungelwano lwethu lusenokudibana nezo uhlaziyo lokugqibela lwesoftware lwenzelwe iminyaka emininzi eyadlulayo.
Inkxaso yeDHCP
Ukutshintsha kwe-TP-Link T2600G-28SQ kunokusebenza zombini njengeseva ye-DHCP okanye i-relay, kwaye yenze ukuhluzwa okuhlukeneyo kwemiyalezo ye-DHCP ukuba esinye isixhobo sisebenza njengomncedisi.
Eyona ndlela ilula yokubonelela abasebenzisi ngeeparamitha ze-IP ekufuneka basebenze kukusebenzisa iseva ye-DHCP eyakhelweyo. Ngoncedo lwayo, iiparitha ezisisiseko zinokuthi zinikwe ababhalisi.
Siqhagamshele i-Archer C6 SOHO router yethu kwenye ye-interfaces yokutshintsha kwaye saqinisekisa ukuba isixhobo somthengi sifumene idilesi ngempumelelo.
Ijongeka ngolu hlobo
Umncedisi we-DHCP owakhelwe kwi-switch mhlawumbi ayisona isisombululo esiphezulu kunye nesiguquguqukayo: akukho nkxaso kwiinketho ezingezona eziqhelekileyo, kwaye akukho nxu lumano kunye ne-IPAM. Ukuba umqhubi ufuna ukulawula ngakumbi inkqubo yokusabalalisa idilesi ye-IP, ngoko iseva ye-DHCP ezinikeleyo iya kusetyenziswa.
I-T2600G-28SQ ikuvumela ukuba uchaze umncedisi we-DHCP ozinikeleyo we-subnet yomsebenzisi ngamnye apho imiyalezo yeprotocol ephantsi kwengxoxo iya kuthunyelwa kwakhona. I-subnet ikhethwa ngokukhankanya ujongano olufanelekileyo lwe-L3: VLAN (SVI), izibuko elihamba ngeendlela okanye i-port-channel.
Ukuvavanya ukusebenza kwe-relay, silungiselele i-router eyahlukileyo ukusuka komnye umthengisi ukuba asebenze njengomncedisi we-DHCP, izicwangciso zazo ezichazwe ngezantsi.
R1#sho run | s pool
ip dhcp pool test
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
dns-server 8.8.8.8Umzila womxhasi ufumene idilesi ye-IP ngempumelelo kwakhona.
R1#sho ip dhcp binding
Bindings from all pools not associated with VRF:
IP address Client-ID/ Lease expiration Type
Hardware address/
User name
192.168.0.2 010c.8063.f0c2.6a May 24 2019 05:07 PM AutomaticNgaphantsi kwe-spoiler - imixholo yepakethe edibeneyo phakathi kokutshintsha kunye nomncedisi we-DHCP ozinikeleyo.
Umxholo wepakethi
Kufuneka kuqatshelwe ukuba iswitshi ixhasa uKhetho lwama-82. Xa yenziwe yasebenza, iswitshi iyakongeza ulwazi malunga nojongano lomsebenzisi apho umyalezo we-DHCP Discover ufunyenwe. Ukongeza, imodeli ye-T2600G-28SQ ikuvumela ukuba uqwalasele umgaqo-nkqubo wokucubungula ulwazi olongezelelweyo xa ufaka ukhetho lwe-82. Ubukho benkxaso yolu khetho lunokuba luncedo kwimeko apho umrhumi kufuneka anikwe idilesi ye-IP efanayo, kungakhathaliseki ukuba yiyiphi i-client-id umxhasi obika ngayo.
Umzobo ongezantsi ubonisa umyalezo we-DHCP Discover (othunyelwe nge-relay) kunye nenketho ye-82 eyongeziweyo.
Umyalezo onenketho enguNombolo 82
Ngokuqinisekileyo, unokulawula ukhetho lwe-82 ngaphandle kokumisela i-relay ye-DHCP epheleleyo, izicwangciso ezihambelanayo zinikezelwa kwi-"DHCP L2 Relay".
Ngoku makhe sitshintshe izicwangciso zeseva ye-DHCP ukubonisa indlela inketho ye-82 isebenza ngayo.
R1#sho run | s dhcp
ip dhcp pool test
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
dns-server 8.8.8.8
class option82_test
address range 192.168.0.222 192.168.0.222
ip dhcp class option82_test
relay agent information
relay-information hex 010e010c74702d6c696e6b5f746573740208000668ff7b66f675
R1#sho ip dhcp binding
Bindings from all pools not associated with VRF:
IP address Client-ID/ Lease expiration Type
Hardware address/
User name
192.168.0.222 010c.8063.f0c2.6a May 24 2019 05:33 PM AutomaticInto efana nale
Umsebenzi we-DHCP we-relay we-interface uya kuba luncedo kwimeko apho utshintsho lungenayo i-L3 interface eqhagamshelwe kwinethiwekhi ethile, kodwa le interface nayo inedilesi ye-IP. Ukuba akukho dilesi kwi-interface enjalo, umsebenzi we-DHCP VLAN relay uza kuhlangula. Ulwazi malunga ne-subnet kulo mzekelo ithathwa kujongano olungagqibekanga, oko kukuthi, izithuba zeedilesi kuthungelwano oluninzi lwenyani ziya kufana (ukugqithelana).
Ngokuqhelekileyo, abaqhubi nabo kufuneka bakhusele ababhalisi kwimpazamo okanye ekusebenziseni kakubi iseva ye-DHCP kwisixhobo somthengi. Sigqibe kwelokuba sixoxe ngalo msebenzi kwelinye lamacandelo anikezelwe kwimiba yokhuseleko.
IEEE 802.1X
Enye indlela yokuqinisekisa abasebenzisi kwinethiwekhi kukusebenzisa i-IEEE 802.1X protocol. Ukuthandwa kwale protokoli kuthungelwano lwabaqhubi be-telecom eRashiya sele kuncipha; Ukutshintsha kwe-T2600G-28SQ kunenkxaso ye-802.1X, ngoko umboneleli unokuyisebenzisa ngokulula xa kuyimfuneko.
Ukuze iprotocol ye-IEEE 802.1X isebenze, kufuneka abathathi-nxaxheba abathathu: izixhobo zabaxhasi (umfaki-sicelo), umnikezeli wokufikelela kwi-switch (i-authenticator) kunye neeseva zokuqinisekisa (ngokuqhelekileyo iiseva ze-RADIUS).
Ubumbeko olusisiseko kwicala lomsebenzisi lulula kakhulu. Udinga kuphela ukucacisa idilesi ye-IP ye-RADIUS iseva esetyenzisiweyo, apho i-database yomsebenzisi iya kugcinwa khona, kwaye ukhethe kwakhona ujongano olufunekayo ukuqinisekiswa.
Isiseko se-802.1X sokumisela
Ubumbeko oluncinci luyafuneka kwicala lomxhasi. Zonke iisistim zokusebenza zanamhlanje sele zinesoftware eyimfuneko. Kodwa ukuba kuyimfuneko, ungafaka kwaye usebenzise i-TP-Link 802.1x Client - isicelo esikuvumela ukuba uqinisekise umxhasi kwinethiwekhi.
Xa uqhagamshela iPC yomsebenzisi ngokuthe ngqo kwinethiwekhi yomboneleli, useto lokuqinisekisa kufuneka luvulwe kwikhadi lenethiwekhi elisetyenziselwa uqhagamshelwano.
Nangona kunjalo, okwangoku, akusiyo ikhompyutha yomsebenzisi edla ngokuxhunywa kwinethiwekhi yomsebenzisi ngokuthe ngqo, kodwa i-SOHO i-router eqinisekisa ukusebenza kwenethiwekhi yendawo yomrhumeli (zombini iisegment ze-wire and wireless). Kule meko, zonke izicwangciso zeprotocol ze-802.1X kufuneka zenziwe ngokuthe ngqo kwi-router.
Kubonakala ngathi le ndlela yokuqinisekisa ilityelwe ngokungafanelekanga kuthungelwano lomsebenzisi. Ewe, ukubophelela ngokungqongqo umrhumi kwizibuko lokutshintsha kunokuba sisisombululo esilula ukusuka kwindawo yokujonga useto lwezixhobo zomsebenzisi. Kodwa ukuba ukusetyenziswa kwegama lokungena kunye negama lokugqitha kuyimfuneko, ngoko i-802.1X ayiyi kuba yiprotocol enzima xa kuthelekiswa noqhagamshelwano olusetyenzisiweyo ngokusekelwe kwiitonela zePPTP/L2TP/PPPoE.
Ukufakwa kwesazisi sePPPoE
Abasebenzisi abaninzi kungekuphela nje kwilizwe lethu, kodwa kwihlabathi liphela bakhetha ukusebenzisa amagama ayimfihlo alula kakhulu. Kwaye amatyala okubiwa kweziqinisekiso, yeha, awaqhelekanga. Ukuba umqhubi usebenzisa i-PPPoE protocol kwinethiwekhi yayo ukuze aqinisekise abasebenzisi, ngoko i-TP-Link T2600G-28SQ iswitshi iya kunceda ukuxazulula ingxaki ehambelana nokuvuza kweziqinisekiso. Oku kuphunyezwa ngokongeza ileyibhile ekhethekileyo kwi-PPPoE Active Discovery message. Ngale ndlela, umboneleli unokuqinisekisa umrhumi kungekuphela nje ngokungena kunye negama lokugqitha, kodwa nangedatha eyongezelelweyo. Le datha eyongezelelweyo iquka idilesi ye-MAC yesixhobo somthengi, kunye ne-interface yokutshintsha apho idibaniswe khona.
Abanye abaqhubi, ngokomgaqo, bafuna ukukhanyela umrhumi (isibini sokungena kunye negama lokugqitha) ukukwazi ukuhamba kwinethiwekhi. Umsebenzi woFakelo lwe-ID yePPPoE uya kunceda kule meko.
IGMP
I-IGMP (iProtocol yoLawulo lweQela le-Intanethi) sele ikhona amashumi eminyaka. Ukuthandwa kwayo kuyaqondakala kwaye kulula ukucacisa. Kodwa kukho amaqela amabini abandakanyekayo kwintsebenziswano ye-IGMP: i-PC yomsebenzisi (okanye nayiphi na enye idivaysi, umzekelo, i-STB) kunye ne-IP router ekhonza icandelo elithile lenethiwekhi. Utshintsho aluthathi nxaxheba kolu tshintshiselwano nangayiphi na indlela. Enyanisweni, ingxelo yokugqibela ayiyonyani ngokupheleleyo. Okanye kuthungelwano lwangoku akuyonyani konke konke. Iiswitshi zixhasa i-IGMP ukwandisa ukuhanjiswa kwetrafikhi ezininzi. Ukumamela i-traffic yomsebenzisi, umtshintshi ufumanisa imiyalezo yeNgxelo ye-IGMP kuyo, ngoncedo apho imisela amachweba okuhambisa i-traffic multicast. Ukhetho oluchaziweyo lubizwa ngokuba yi-IGMP Snooping.
Inkxaso ye-protocol ye-IGMP ingasetyenziselwa nje ukwandisa i-traffic njengoko kunjalo, kodwa kunye nokumisela ababhalisi abanokunikezelwa ngenkonzo ethile, umzekelo, IPTV. Ungafikelela usukelo olunqwenelekayo nokuba ngokuseta ngesandla iiparamitha zokucoca okanye ngokusebenzisa uqinisekiso.
Inkxaso yetrafikhi ye-multicast kwi-TP-Link switch iphunyezwa ngokuguquguqukayo. Umzekelo, zonke iiparamitha zinokusetwa kuthungelwano lwenyani nganye ngokwahlukeneyo.
Ukuba ii-subnets ezininzi eziqulethe abamkeli be-traffic be-multicast baqhagamshelwe kwi-interface ye-router enye, ngoko loo router iya kunyanzeleka ukuba ithumele iikopi ezininzi zeepakethi ngaphaya kojongano (enye yenethiwekhi nganye yenyani).
Kule meko, unokwandisa inkqubo yokuthumela i-traffic multicast usebenzisa iteknoloji ye-MVR-Ukubhaliswa kweVLAN ye-Multicast.
Undoqo wesisombululo kukuba uthungelwano olulodwa lwenyani lwenziwe oludibanisa bonke abamkeli. Nangona kunjalo, le nethiwekhi yenyani isetyenziselwa kuphela ukuhanjiswa kwezinto ezininzi. Le ndlela ivumela i-router ukuba ithumele ikopi enye kuphela yetrafikhi ye-multicast nge-interface.
I-DDM, i-OAM kunye ne-DLDP
I-DDM β iDigital Diagnostic Monitoring. Ngethuba lokusebenza kweemodyuli ze-optical, kudla ngokuyimfuneko ukubeka iliso imeko yemodyuli ngokwayo, kunye nejeneli ye-optical apho ixhunyiwe khona. Umsebenzi weDDM uya kukunceda ukujamelana nalo msebenzi. Ngoncedo lwayo, iinjineli zabaqhubi ziya kukwazi ukujonga ubushushu bemodyuli nganye exhasa lo msebenzi, i-voltage yayo kunye nekhoyo ngoku, kunye namandla okuthunyelwa kunye nokufunyanwa kwemiqondiso ye-optical.
Ukucwangcisa imigangatho yeeparamitha ezichazwe ngaphambili kuya kukuvumela ukuba uvelise isiganeko ukuba ziwela ngaphandle koluhlu olwamkelekileyo.
Ukuseta imida yokuphendula yeDDM
Ngokwemvelo, umlawuli unokujonga amaxabiso angoku eeparamitha ezikhankanyiweyo.
I-TP-Link T2600G-28SQ iswitshi inenkqubo esebenzayo yokupholisa umoya. Ngaphezu koko, asizange sihlangabezane nokushisa kweemodyuli ze-SFP kwiitshintshi zethu ngenxa yobuninzi bezibuko. Nangona kunjalo, ukuba, ngokuthe ngqo kwithiyori, oko kunokwenzeka kuvunyelwe (umzekelo, ngenxa yengxaki ethile ngaphakathi kwimodyuli ye-SFP), ngoko ngoncedo lweDDM umlawuli uya kwaziswa ngokukhawuleza malunga nemeko enokuba yingozi. Ingozi apha, ngokucacileyo, ayikho i-switch ngokwayo, kodwa i-diode / laser ngaphakathi kwe-SFP, ekubeni njengoko ukushisa kwayo kukhula, amandla omqondiso okhutshiweyo we-optical anganciphisa, okuya kubangela ukuhla kwebhajethi ye-optical.
Kuyafaneleka ukuba uqaphele apha ukuba i-TP-Link switch ayinayo "umsebenzi" wokutshixa umthengisi, oko kukuthi, naziphi na iimodyuli ze-SFP ezihambelanayo zixhaswa, ngokuqinisekileyo, ziya kuba zilungele kakhulu kubalawuli benethiwekhi.
I-OAM - Ukusebenza, uLawulo, kunye noLondolozo (IEEE 802.3ah). I-OAM yiprotocol yomgangatho wesibini wemodeli yeOSI eyenzelwe ukubeka iliso kunye nokulungisa iingxaki kwiinethiwekhi ze-Ethernet. Ukusebenzisa le protocol, umtshintshi unokubeka iliso ekusebenzeni koqhagamshelwano oluthile kunye neempazamo, kwaye uvelise izilumkiso ukwenzela ukuba umlawuli wenethiwekhi akwazi ukulawula inethiwekhi ngokufanelekileyo.
Ukuseta i-OAM esisiseko
OAM Iinkcukacha eziSebenzayoIzixhobo ezibini ezingabamelwane ezisebenzisa i-OAM zitshintshana imiyalezo ngamaxesha athile ngokuthumela ii-OAMPDU, eziza kwiindidi ezintathu: Ulwazi, Isaziso soMsitho, kunye noLawulo lweLoopback. Ukusebenzisa ulwazi lwe-OAMPDUs, iiswitshi ezingabamelwane zithumelana iinkcukacha zamanani kunye nedatha echazwe ngumlawuli. Olu hlobo lomyalezo lukwasetyenziselwa ukugcina uxhulumaniso nge-OAM protocol. Imiyalezo yeSaziso soMsitho isetyenziswa ngumsebenzi wokuqwalasela umdibaniso ukwazisa elinye iqela ukuba ukusilela kwenzeke. Imiyalezo yoLawulo lweLoopback isetyenziselwa ukubona iluphu emgceni.
Ngezantsi sigqibe kwelokuba sidwelise ezona mpawu ziphambili zibonelelwa yi-OAM protocol:
- ukubeka iliso kokusingqongileyo (ukubona nokubalwa kwezakhelo ezaphukileyo),
- I-RFI - Isalathisi sokungaphumeleli kude (ukuthumela isaziso sokungaphumeleli kwitshaneli),
- I-Loopback ekude (uvavanyo lwetshaneli ukulinganisa ukubambezeleka kwexesha elide, ukulibaziseka kokutshintsha (ijitha), inani lezakhelo ezilahlekileyo).
Olunye ukhetho oluyimfuneko ekutshintsheni optical kukukwazi ukubona iingxaki kwijelo lonxibelelwano, elikhokelela ekubeni umjelo ube simplex, oko kukuthi, idatha ingathunyelwa kuphela kwicala elinye. Ukutshintsha kwethu kusebenzisa i-DLDP - iProtokholi yokuHlola iDivaysi yeDivaysi ukufumana izixhumanisi ezingabonakaliyo. Ukulunga, kuyafaneleka ukuba uqaphele ukuba iprotocol ye-DLDP ixhaswa kwi-interfaces ye-optical kunye nobhedu, kodwa ngokombono wethu, iya kuba yinto ethandwa kakhulu xa usebenzisa imigca ye-fiber optic.
Xa ikhonkco elingabonakaliyo lifunyenwe, umtshintshi unokuvala ngokuzenzekelayo ujongano oluyingxaki, oluya kukhokelela ekwakhiweni kwakhona komthi we-STP kunye nokusetyenziswa kweendlela zokunxibelelana zokulondoloza.
Kwi-arsenal yethu kukho iimodyuli ze-SFP ezifumana kwaye zidlulise iimpawu ngefiber enye. Basebenza ngokukodwa ngababini kwaye basebenzisa imiqondiso ye-optical kubude bamaza ahlukeneyo ukuze basasazeke phakathi kwesibini. Umzekelo yi-TL-SM321A kunye ne-TL-SM321B. Xa usebenzisa iimodyuli ezinjalo, umonakalo kwifiber enye iya kubangela ukungasebenzi ngokupheleleyo kweshaneli yonke ye-optical. Nangona kunjalo, nakwimijelo enjalo iprotocol ye-DLDP iya kuba yimfuno, kuba, nangona oku kwenzeka kunqabile kakhulu, umjelo unokuba neempawu ezicacileyo ezahlukeneyo zobude bamaza ahlukeneyo. Eyona ngxaki inokwenzeka kukuba ukukhanya kwejelo kuyahluka ngokuxhomekeke kwicala losasazo lokukhanya. I-reflectogram iya kunceda ukufumanisa ezi ngxaki, kodwa libali elahluke ngokupheleleyo.
I-LLDP
Kwiinethiwekhi ezinkulu zenkampani okanye zabaqhubi, iingxaki zivela ngamaxesha athile kunye nokuphelelwa yisikhathi kwamaxwebhu womnatha okanye ukungachaneki ekulungiseleleni. Umlawuli wothungelwano unokujongana nemeko apho kuyimfuneko ukufumanisa ukuba yeyiphi isixhobo somqhubi esidityaniswe ngokwenene kujongano oluthile lokutshintsha. I-LLDP β i-Link Layer Discovery Protocol (IEEE 802.1AB) iya kuhlangula.
IiParamitha zokuSebenza kweLLDP
Iiswitshi zethu zixhasa i-LLDP kungekuphela nje ekufumaneni iiswitshi ezingabamelwane okanye ezinye izixhobo zenethiwekhi, kodwa kwanokumisela amandla azo.
Amaqabane ethu obhedu okutshintsha angasebenzisa i-LLDP-MED ukwenza lula inkqubo yokuqhagamshela iifowuni ze-IP. Kwakhona, usebenzisa olu khetho, ukutshintshela kwe-PoE kunokuthethathethana ngeeparamitha zamandla ngesixhobo esinamandla. Sele sithethile ngale nto kwiinkcukacha ezithile kwenye yethu .
I-SDM kunye nobhaliso olungaphezulu
Phantse zonke iiswitshi zangoku zenza iifreyimu ezidlulayo kunye neepakethi ngaphandle kokusebenzisa iprosesa esembindini. Ukucubungula (ukubala i-checksums, ukusebenzisa uluhlu lokufikelela kunye nokwenza ezinye iisheke zokhuseleko, kunye nokwenza izigqibo zokutshintsha / umzila) kuqhutyelwa ngokusebenzisa ii-chips ezikhethekileyo, ezivumela ukuhanjiswa kwesantya esiphezulu sokuhamba komsebenzisi. Ukutshintshela phantsi kwengxoxo kuvumela ukucubungula i-traffic kwisantya semidiya. Oku kuthetha ukuba ukusebenza kwesixhobo kwanele ukuthumela idatha ngesantya esiphezulu kunokwenzeka kuwo onke amazibuko ngexesha elinye. Imodeli ye-T2600G-28SQ inamachweba angama-24 e-downlink (ukubhekisa kubasebenzisi), esebenza ngesantya se-1 Gbit / s, kunye ne-4 uplink port (ukuya kwi-network core) ye-10 Gbit / s. Ngexesha elifanayo, ukusebenza kwe-switch cross-bus yi-128 Gbit / s, eyaneleyo ukucubungula ubuninzi bezithuthi ezingenayo.
Ukulunga, kuyafaneleka ukuba uqaphele ukuba ukusebenza kwe-matrix yokutshintsha iipakethi zezigidi ezingama-95,2 ngomzuzwana. Oko kukuthi, xa usebenzisa ubuncinci bezakhelo ezinobude obungama-byte angama-64 kuphela, ukusebenza ngokupheleleyo kwesixhobo kuya kuba yi-97,5 Gbit / s. Nangona kunjalo, iprofayile yetrafikhi iphantse ingenzeki kwiinethiwekhi ze-telecom.
Yintoni umrhumo ongaphezuluOmnye umba obalulekileyo ngumlinganiselo wezantya zemijelo enyukayo nesezantsi (ukubhaliswa ngokugqithisileyo). Apha, ngokucacileyo, yonke into ixhomekeke kwi-topology. Ukuba umlawuli usebenzisa zonke ezine 10 GE ujongano ukudibanisa undoqo womnatha kwaye idibanise usebenzisa LAG (Link Aggregation Group) okanye Port-Channel iteknoloji, ngoko ke isantya efunyenwe manani ukuya core iya kuba 40 Gbit / s, nto leyo eya kuba ngaphezulu. kunokwanela ukwanelisa iimfuno zabo bonke ababhalisi abaqhagamshelweyo. Ngaphezu koko, akuyimfuneko ukuba zonke ii-uplinks ezine zidibanise kwisixhobo esinye somzimba. Ukudibanisa kunokwenziwa kwi-stack of switches, okanye kwizixhobo ezibini ezidityanisiweyo zibe yimbumba (usebenzisa iteknoloji ye-vPC okanye efanayo). Kule meko akukho mrhumo ongaphezulu.
Ungasebenzisa zonke uplinks ezine ngaxeshanye hayi kuphela ngokudibanisa usebenzisa LAG. Isiphumo esifanayo sinokufezekiswa ngokuqwalasela kakuhle i-MSTP, kodwa libali elahluke ngokupheleleyo elo.
Indlela yesibini esetyenziswa ngokuqhelekileyo ye-L2 kukusebenzisa i-LAGs ezimbini ezizimeleyo (enye kwiswitshi nganye yokudibanisa). Kule meko, kunokwenzeka ukuba, enye yeekhonkco zenyani iya kuvalelwa yiSTP protocol (xa usebenzisa i-STP okanye i-RSTP). Umrhumo ongaphezulu uya kuba sisi-5:6.
Imeko enqabileyo, kodwa isenokwenzeka: i-T2600G-28SQ iqhagamshelwe ngamatshaneli azimeleyo kwiswitshi ephezulu okanye iiswitshi. Iprothokholi ye-STP/RSTP iyakushiya ikhonkco elinye kuphela elilolo hlobo kwimeko ingavalwanga. Umrhumo ongaphezulu uya kuba ngu-5:12.
Umsebenzi kunye neenkwenkwezi: bala ukubhaliswa ngokugqithisileyo kweemeko ezichazwe kwicandelo le-STP, apho sijonge umzekelo we-topology xa iiswitshi ezimbini zokufikelela zixhunyiwe kwisixhobo esifanayo sokudibanisa kunye nokudityaniswa.
Iitshiphusi ezicwangcisiweyo ezenza isantya esiphezulu esinjalo sisixhobo esibiza imali eninzi, ke sizama ukukhulisa ukusetyenziswa kwazo ngokusasaza ngokufanelekileyo izixhobo phakathi kwemisebenzi eyahlukeneyo. I-SDM - Ulawulo lweDatha yoTshintsho lunoxanduva lokusasaza.
Ukuhanjiswa kwenziwa kusetyenziswa iprofayili yeSDM. Ngoku kukho iiprofayili ezintathu ezikhoyo ukuba zisetyenziswe, zidweliswe ngezantsi.
- Ukungagqibeki kunika isisombululo esilungeleleneyo sokusebenzisa uluhlu lofikelelo lwe-MAC kunye ne-IP, kunye nokungeniswa kwe-ARP.
- I-EnterpriseV4 ikuvumela ukuba wandise izibonelelo ezikhoyo ukuze zisetyenziswe yi-MAC kunye noluhlu lokufikelela kwe-IP.
- I-EnterpriseV6 yabela izixhobo ezithile ukuze zisetyenziswe luluhlu lofikelelo lwe-IPv6.
Ukutshintsha kufuneka kuqalwe ngokutsha ukuze kufakwe inkangeleko entsha.
isiphelo
Ngokuhambelana nokumiswa kokuqala, olu tshintsho lufaneleke kakhulu kubaqhubi be-telecom abajongene nomsebenzi wokubonelela ukufikelela kwinethiwekhi kumgama omde. Isixhobo sinokusetyenziswa zombini kwinqanaba lokufikelela, umzekelo, kwiindawo zokuhlala ze-cottage kunye nezindlu zasedolophini, kunye nokuhlanganiswa kwamatshaneli avela kwiinguqu zokufikelela ezifumaneka kwizakhiwo zokuhlala; oko kukuthi, naphi na apho udibaniso lwezinto ezikude lufuneka khona. Xa usebenzisa amajelo onxibelelwano optical, umrhumi oqhagamshelweyo unokufumaneka kumgama ongangeekhilomitha eziliqela.
Kwicala lomxhasi, amakhonkco okukhanya anokupheliswa kwiiswitshi ezincinci ezinojongano lwe-optical okanye kwiziguquli zemidiya.
Inani elikhulu leeprotokholi ezixhaswayo kunye neenketho ziya kuvumela i-T2600G-28SQ ukuba isetyenziswe kwinethiwekhi ye-Ethernet yomsebenzisi kunye nayiphi na i-topology kunye naluphi na isethi yobuchwepheshe obusetyenzisiweyo kunye neenkonzo ezinikezelweyo. Utshintsho lulawulwa ukude usebenzisa ujongano lwewebhu okanye umgca womyalelo. Ukuba ukucwangciswa kwendawo kuyimfuneko, ungasebenzisa i-console port imodeli ye-T2600G-28SQ inezimbini zazo: i-RJ-45 kunye ne-micro-USB. Njengempukane encinci kwi-ointment, siqaphela ukungabikho kwenkxaso ye-stacking kunye nokunikezelwa kwamandla okwesibini. Enyanisweni, ngokuqhelekileyo ngaphandle kwamaziko edatha yababoneleli, ubukho bomgca wesibini wombane buya kuba bunqabileyo.
Iinzuzo zayo ziquka ixabiso eliphantsi, inani elikhulu lamachweba optical optical, ubukho be-10 GE optical uplinks, kunye namachweba amane adibeneyo kunye nokuhanjiswa kwezithuthi kwisantya esiphakathi.
umthombo: www.habr.com