I-TP-Link T2600G-28SQ switch yokubona yabahlinzeki besevisi: ukubuyekezwa okuningiliziwe 

Ukwandiswa kwamadolobha amakhulu kanye nokwakhiwa kwama-agglomerations kungenye yezindlela ezibalulekile ekuthuthukisweni komphakathi namuhla. I-Moscow kuphela kufanele ikhulise ngamamitha-skwele angu-2019 million wezindlu ngo-4 (futhi lokhu akubali izindawo zokuhlala ezingu-15 ezizokwengezwa ngo-2020). Kuyo yonke le ndawo enkulukazi, opharetha bezingcingo kuzodingeka banikeze abasebenzisi ukufinyelela ku-inthanethi. Lawa angaba ama-microdistrict asemadolobheni anezakhiwo eziminyene ezinezitezi, noma amadolobhana amaningi “akhishiwe”. Kulezi zimo, izidingo ze-hardware zihluke kancane. Sihlaziye ngayinye yalezi zimo futhi sakha imodeli ye-universal optical switch - T2600G-28SQ. Kulokhu okuthunyelwe sizohlaziya ngokuningiliziwe amakhono edivayisi azoba nentshisekelo kuwo ama-telecom opharetha kulo lonke elaseRussia.

Beka kunethiwekhi

Iswishi ye-T2600G-28SQ yakhelwe kokubili ukusebenza ezingeni lokufinyelela kunethiwekhi kanye nokuhlanganisa izixhumanisi ezivela kwamanye amaswishi ezingeni lokufinyelela. Lena iswishi yesendlalelo sesi-2600 eyenza ukushintsha kanye nomzila omile. Uma u-opharetha eshintshe kokubili ukuhlanganisa nokufinyelela (umzila kuphela kumongo wenethiwekhi), i-T28G-XNUMXSQ izongena kunoma yimaphi amaleveli. Esimeni sokuhlanganisa okuguquguqukayo, kusamele ucabangele imikhawulo ethile ezimweni zokusetshenziswa.

Imodeli ye-T2600G-28SQ iyiswishi ye-Ethernet esebenza ngokugcwele ngaphandle kwemikhawulo eyengeziwe evelayo lapho usebenzisa i-xPON noma ubuchwepheshe obufanayo. Isibonelo, ngaphandle kosongo lokwehla okubukhali kwejubane ngokukhuphuka kwenani labasebenzisi noma ukungahambisani kahle phakathi kwezinto zokusebenza ezivela kubathengisi abahlukene kanye ne-firmware. Kokubili abasebenzisi bokugcina kanye namaswishi okufinyelela angaphansi anama-optical uplinks, isibonelo, imodeli ye-T2600G-28TS, ingaxhumeka kuzixhumi ezibonakalayo zedivayisi. Umdwebo ongezansi ubonisa izibonelo ezivame kakhulu zokuxhuma okunjalo.

Ukuze ufinyelele inethiwekhi yomsebenzisi wokugcina, i-optical fibre noma ikhebula elisontekile lingasetshenziswa. Ohlangothini lwababhalisile, i-fiber optical ingaqedwa noma kusetshenziswa isiguquli semidiya (i-media converter), isibonelo, i-TP-Link MC220L; nokusebenzisa i-optical interface kumzila we-SOHO.

Ukuze uxhume iklayenti eliseduze, ungasebenzisa izimbobo ezine ze-RJ-45 ezisebenza ngesivinini esingu-10/100/1000 Mbit/s. Uma ngasizathu simbe lokhu kungenele, opharetha angakwazi "ukuguqula" izixhumi ezibonakalayo zokushintsha zibe ithusi. Lokhu kungenziwa kusetshenziswa ama-SFP "ethusi" akhethekile ngesixhumi se-RJ-45. Kodwa isixazululo esinjalo asikwazi ukubizwa ngokuthi sijwayelekile.

Ezinye izibonelo ezivela ekusebenzeni

Ukuqedela isithombe, sizonikeza izibonelo ezimbalwa zokusebenzisa amaswishi e-T2600G-28SQ.

Umhlinzeki wesifunda saseMoscow "DIVO", okuyinto, ngaphezu kwe-intanethi, ehlinzeka ngezinsizakalo ze-TV ye-telephony nekhebula, isebenzisa i-T2600G-28SQ ezingeni lokufinyelela lapho kwakhiwa amanethiwekhi emkhakheni wangasese (ama-cottages nama-townhouses). Ohlangothini lweklayenti, uxhumano lwenziwa kuma-routers anembobo ye-SFP, kanye neziguquli zemidiya. Okwamanje, ama-SOHO routers anechweba le-SFP awakhiqizwa ngobuningi ezweni lakithi, kodwa, kunjalo, sicabanga ngakho.

U-opharetha wezokuxhumana ISS kusukela esifundeni sase-Pavlovo-Posad sisebenzisa ama-switch e-T2600G-28SQ “njengenhlanganisela encane”, kusetshenziswa ukushintsha kwamamodeli we-T2600G-28TS kanye ne-T2500G-10TS ukuze ufinyelele.

Iqembu lezinkampani "Isiqinisekiso" hlinzeka nge-inthanethi, i-TV, ucingo, nezinhlelo zokugada amavidiyo eningizimu-mpumalanga yesifunda saseMoscow (Kolomna, Lukhovitsy, Zaraysk, Serebryanye Prudy, Ozyory). I-topology elinganiselwe lapha iyafana naleyo ye-ISS: T2600G-28SQ ezingeni lokuhlanganisa, kanye ne-T2600G-28TS ne-T2500G-10TS ezingeni lokufinyelela.

Umhlinzeki I-SKTV kusuka e-Krasnoznamensk inikeza ukufinyelela kwe-inthanethi usebenzisa inethiwekhi enokungena okujulile kwe-optical. Iphinde isekelwe ku-T2600G-28SQ.

Ezigabeni ezilandelayo sizochaza kafushane ezinye zezici ze-T2600G-28SQ. Ukuze singavimbi izinto, sishiye inombolo yezinketho: QinQ (VLAN VPN), umzila, QoS, njll. Sicabanga ukuthi singabuyela kubo kokunye kokuthunyelwe okulandelayo.

Shintsha Amakhono

Ukubhuka – STP

I-STP – Iphrothokholi Yesihlahla Enwetshiwe. Iphrothokholi yesihlahla enwetshiwe yaziwa isikhathi eside kakhulu, sibonga u-Radya Perlman ohlonishwayo ngalokhu. Kumanethiwekhi esimanje, abalawuli bazama ngazo zonke izindlela ukugwema ukusebenzisa le mithetho yomthetho. Yebo, i-STP ayinazo izihibe zayo. Futhi kuhle kakhulu uma kukhona okuhlukile kukho. Kodwa-ke, njengoba kuvame ukuba njalo, enye indlela yale protocol izoncika kakhulu kumthengisi. Ngakho-ke, kuze kube yilolu suku, i-Spanning Tree Protocol isalokhu iyisixazululo kuphela esisekelwa cishe yibo bonke abakhiqizi futhi saziwa kubo bonke abaphathi benethiwekhi.

Iswishi ye-TP-Link T2600G-28SQ isekela izinguqulo ezintathu ze-STP: i-STP yakudala (IEEE 802.1D), RSTP (802.1W) ne-MSTP (802.1S).

Kulezi zinketho, i-RSTP evamile ifaneleka kakhulu kubahlinzeki be-inthanethi abaningi abaseRussia, enenzuzo eyodwa engenakuphikwa ngaphezu kwenguqulo yakudala - isikhathi sokuhlangana esifushane kakhulu.

Iphrothokholi evumelana nezimo kakhulu namuhla i-MSTP, esekela amanethiwekhi abonakalayo (ama-VLAN) futhi ivumela izihlahla ezimbalwa ezihlukene, ezikuvumela ukuthi usebenzise zonke izindlela ezikhona zokusekelayo. Umlawuli udala izimo zesihlahla eziningana (kufika kweziyisishiyagalombili), ngasinye sazo esinikeza isethi ethile yamanethiwekhi abonakalayo.

Imininingwane ye-MSTPAbaphathi be-Novice badinga ukuqaphela kakhulu lapho usebenzisa i-MSTP. Lokhu kungenxa yokuthi ukuziphatha kwephrothokholi kuyehluka phakathi kwesifunda naphakathi kwezifunda. Ngakho-ke, lapho ulungiselela ukushintshwa, kufanelekile ukwenza isiqiniseko sokuthi uhlala endaweni efanayo.

Siyini lesi sifunda esinedumela elibi? Ngemibandela ye-MSTP, isifunda siyisethi yamaswishi axhunywe kwamanye anezici ezifanayo: igama lesifunda, inombolo yokubuyekeza, nokusatshalaliswa kwamanethiwekhi abonakalayo (ama-VLAN) phakathi kwezenzakalo zephrothokholi (izenzakalo).

Vele, i-Spanning Tree protocol (noma iyiphi inguqulo) ikuvumela ukuthi ungagcini nje ngokubhekana nezihibe eziphakamayo lapho uxhuma iziteshi eziyisipele, kodwa futhi nokuvikela kumaphutha okushintsha ikhebula lapho unjiniyela exhuma amachweba angalungile ngamabomu noma ngokungenhloso, enza iluphu neyakhe. izenzo.

Abaphathi benethiwekhi abanolwazi oluthe xaxa bakhetha ukusebenzisa izinhlobonhlobo zezinketho ezengeziwe ukuze bavikele iphrothokholi ye-STP ekuhlaselweni noma ezimeni eziyinkimbinkimbi zenhlekelele. Imodeli ye-T2600G-28SQ inikeza lonke uhla lwamakhono anjalo: I-Loop Protect ne-Root Protect, i-TC Guard, i-BPDU Protect kanye nesihlungi se-BPDU.

Ukusetshenziswa okufanele kwezinketho ezibalwe ngenhla ngokuhambisana nezinye izindlela zokuvikela ezisekelwayo kuzozinzisa inethiwekhi yendawo futhi kuyenze ibikezeleke kakhudlwana.

Ukubhuka - LAG

I-LAG - I-Link Aggregation Group. Lobu ubuchwepheshe obukuvumela ukuthi uhlanganise iziteshi zomzimba ezimbalwa zibe munye onengqondo. Zonke ezinye izivumelwano ziyeka ukusebenzisa iziteshi ezibonakalayo ezifakwe ku-LAG ngokwehlukana futhi ziqala “ukubona” isikhombimsebenzisi esisodwa esinengqondo. Isibonelo sephrothokholi enjalo yi-STP.

Ithrafikhi yabasebenzisi ibhalansiswa phakathi kwamashaneli angokoqobo ngaphakathi kwamashaneli anengqondo ngokusekelwe enanini le-hash. Ukuze uyibale, amakheli e-MAC omthumeli, umamukeli, noma ipheya yawo angasetshenziswa; kanye namakheli e-IP womthumeli, umamukeli, noma ipheya yawo. Ulwazi lwephrothokholi yesendlalelo sesi-XNUMX (izimbobo ze-TCP/UDP) azinakwa.

Iswishi ye-T2600G-28SQ isekela ama-LAG amile futhi aguquguqukayo.

Ukuxoxisana ngemingcele yokusebenza yeqembu eliguqukayo, iphrothokholi ye-LACP isetshenziswa.

Ukuphepha - Uhlu Lokufinyelela (ACLs)

Iswishi yethu ye-T2600G-28SQ ikuvumela ukuthi uhlunge ithrafikhi yabasebenzisi usebenzisa izinhlu zokufinyelela (ACL - Uhlu Lokulawula Ukufinyelela).

Uhlu lokufinyelela olusekelwe lungaba lwezinhlobo ezimbalwa ezihlukene: i-MAC ne-IP (IPv4/IPv6), kuhlangene, kanye nokwenza ukuhlunga okuqukethwe. Inombolo yohlu ngalunye lokufinyelela olusekelwayo incike kusifanekiso se-SDM esisetshenziswayo njengamanje, esisichaze kwesinye isigaba.

Umsebenzisi angasebenzisa le nketho ukuvimba ithrafikhi ehlukahlukene engadingeki kunethiwekhi. Isibonelo sethrafikhi enjalo kungaba amaphakethe e-IPv6 (esebenzisa inkambu ye-EtherType) uma isevisi ehambisanayo inganikezwanga; noma uvimbele i-SMB ku-port 445. Kunethiwekhi enekheli elimile, ithrafikhi ye-DHCP/BOOTP ayidingeki, ngakho-ke usebenzisa i-ACL, umlawuli angahlunga ama-datagram e-UDP kuzimbobo 67 no-68. Ungakwazi futhi ukuvimba ithrafikhi yendawo ye-IPoE usebenzisa i-ACL. Ukuvinjwa okunjalo kungase kudingeke kumanethiwekhi opharetha asebenzisa i-PPPoE.

Inqubo yokusebenzisa izinhlu zokufinyelela ilula kakhulu. Ngemva kokudala uhlu ngokwalo, udinga ukwengeza inombolo edingekayo yamarekhodi kulo, uhlobo oluncike ngokuqondile eshidini elenziwe ngokwezifiso.

Ukusetha izinhlu zokufinyelela






Kuyaqapheleka ukuthi izinhlu zokufinyelela azikwazi ukwenza imisebenzi evamile yokuvumela noma ukuphika ithrafikhi, kodwa futhi ukuyiqondisa kabusha, ukuyibuka njengesibuko, futhi yenze ukuphawula noma ukukhawulela isilinganiso.
Uma wonke ama-ACL adingekayo esedaliwe, umlawuli angawafaka. Kungenzeka ukunamathisela uhlu lokufinyelela kukho kokubili imbobo eqondile ebonakalayo kanye nenethiwekhi ethile ebonakalayo.

Ukuphepha - inombolo yamakheli e-MAC

Kwesinye isikhathi ama-opharetha adinga ukukhawulela inani lamakheli e-MAC lawo iswishi azoyifunda embotsheni ethile. Uhlu lokufinyelela lukuvumela ukuthi ufinyelele umphumela oshiwo, kodwa ngesikhathi esifanayo ludinga inkomba ecacile yamakheli e-MAC ngokwawo. Uma udinga kuphela ukukhawulela inani lamakheli esiteshi, kodwa ungawacacisi ngokucacile, ukuphepha kwechweba kuyokusiza.

Ukuvinjelwa okunjalo kungase kudingeke, isibonelo, ukuvikela ekuxhumeni yonke inethiwekhi yendawo kusixhumi esibonakalayo sokushintsha umhlinzeki. Kuhle ukusho lapha ukuthi sikhuluma ngoxhumano lokudayela, ngoba lapho uxhuma usebenzisa i-router ohlangothini lweklayenti, i-T2600G-28SQ izofunda ikheli elilodwa kuphela - lena i-MAC engeyechweba le-WAN le-router yeklayenti. .

Kukhona ikilasi lonke lokuhlaselwa okuqondiswe kuthebula lokushintsha. Lokhu kungaba ukuchichima kwetafula noma i-MAC spoofing. Inketho yokuphepha yechweba izokuvumela ukuthi uvikele ekuchichimeni kwetafula lebhuloho kanye nokuhlasela okuhloselwe ukuqeqesha kabusha ngamabomu iswishi kanye nokufaka ushevu etafuleni layo lebhuloho.

Akunakwenzeka ukuthi singasaphathwa emishinini yeklayenti enephutha. Kuvame ukuba nezimo lapho ikhadi lenethiwekhi yekhompyutha engasebenzi kahle noma umzila udala ukusakazwa kwamafreyimu anamakheli omthumeli nomamukeli angenangqondo ngokuphelele. Ukugeleza okunjalo kungakhipha kalula i-CAM.

Enye indlela yokukhawulela inani lokufakiwe kwethebula lebhuloho elisetshenzisiwe ithuluzi Lokuphepha le-MAC VLAN, elivumela umlawuli ukuthi acacise inani eliphezulu lokufakiwe kwenethiwekhi ethile ebonakalayo.

Ngokungeziwe ekuphatheni okufakiwe okuguquguqukayo kuthebula lokushintsha, umlawuli angakwazi futhi ukudala ezimile.

Ithebula lebhuloho eliphezulu lemodeli ye-T2600G-28SQ lingafaka amarekhodi angafika ku-16K.
Enye inketho eklanyelwe ukuhlunga ukudluliswa kwethrafikhi yomsebenzisi umsebenzi we-Port Isolation, okuvumela ukuthi ucacise ngokucacile ukuthi yikuphi ukudlulisela phambili okuvunyelwe.

Ezokuphepha – IMPB

Ezingxenyeni ezibanzi zezwe lethu elikhulukazi, indlela yabasebenzi bezingcingo ezindabeni zokuqinisekisa ukuvikeleka kwenethiwekhi iyahlukahluka kusukela ekungazini okuphelele kuye ekusetshenzisweni okuphezulu okungenzeka kwazo zonke izinketho ezisekelwa imishini.

I-IPv4 IMPB (IP-MAC-Port Binding) kanye nemisebenzi ye-IPv6 IMPB ikuvumela ukuthi uvikele ekuhlaselweni okuhlukahlukene okuhlobene nokukhohlakala kwamakheli e-IP nawe-MAC ngababhalisi ngokubophezela amakheli e-IP kanye ne-MAC emishini yamaklayenti ukuze isibonisi sokushintsha somhlinzeki. Lokhu kubophezela kungenziwa mathupha noma kusetshenziswa Ukuskena kwe-ARP kanye nemisebenzi ye-DHCP Snooping.

Izilungiselelo eziyisisekelo ze-IMPB

Ukuze kube nobulungisa, kufanele kushiwo ukuthi umsebenzi okhethekile ungasetshenziswa ukuvikela iphrothokholi ye-DHCP - Isihlungi se-DHCP.

Ngokusebenzisa lo msebenzi, umlawuli wenethiwekhi angakwazi ukucacisa ngokuzenzela lezo zindawo lapho amaseva wangempela e-DHCP axhumeke khona. Lokhu kuzovimbela amaseva e-DHCP akhohlakele ukuthi aphazamise inqubo yezingxoxo ze-IP.

Ukuphepha - I-DoS Vikela

Imodeli ecatshangelwayo isivumela ukuthi sivikele abasebenzisi ekuhlaselweni okumbalwa kwe-DoS okwaziwayo nokwakusakazeke ngaphambilini.

Ukuhlaselwa okuningi okusohlwini akuseyona ingozi nhlobo kumadivayisi anezinhlelo zokusebenza zesimanje, kodwa amanethiwekhi ethu asengahlangabezana nalawo okwakwenzelwa wona ukubuyekezwa kokugcina kwesofthiwe eminyakeni eminingi edlule.

Ukusekelwa kwe-DHCP

Iswishi ye-TP-Link T2600G-28SQ ingasebenza kokubili njengeseva ye-DHCP noma idlulise, futhi yenze ukuhlunga okuhlukahlukene kwemilayezo ye-DHCP uma enye idivayisi isebenza njengeseva.

Indlela elula yokuhlinzeka abasebenzisi ngamapharamitha we-IP okudingeka bawasebenzise ukusebenzisa iseva ye-DHCP eyakhelwe ngaphakathi. Ngosizo lwayo, imingcele eyisisekelo isivele inikezwe ababhalisile.

Sixhume irutha yethu ye-Archer C6 SOHO kwenye yezindawo zokushintsha futhi saqinisekisa ukuthi idivayisi yeklayenti ithole ikheli ngempumelelo.

Kubukeka kanje



Iseva ye-DHCP eyakhelwe ekushintsheni mhlawumbe akusona isisombululo esilula kakhulu nesivumelana nezimo: akukho ukusekelwa kwezinketho ezingajwayelekile, futhi akukho ukuxhumana ne-IPAM. Uma isisebenzisi sidinga ukulawula okwengeziwe phezu kwenqubo yokusabalalisa ikheli le-IP, kuzobese kusetshenziswa iseva ye-DHCP ezinikele.

I-T2600G-28SQ ikuvumela ukuthi ucacise iseva ehlukile ezinikele ye-DHCP ku-subnet yomsebenzisi ngamunye lapho imilayezo yephrothokholi okuxoxwa ngayo izoqondiswa kabusha. I-subnet ikhethwa ngokucacisa isixhumi esibonakalayo se-L3 esifanele: I-VLAN (SVI), imbobo ehanjiswa umzila noma isiteshi sembobo.

Ukuhlola ukusebenza kwe-relay, silungiselele irutha ehlukile komunye umthengisi ukuze isebenze njengeseva ye-DHCP, izilungiselelo zayo ezivezwa ngezansi.

R1#sho run | s pool
ip dhcp pool test
 network 192.168.0.0 255.255.255.0
 default-router 192.168.0.1
 dns-server 8.8.8.8

Irutha yeklayenti ithole ngempumelelo ikheli le-IP futhi.

R1#sho ip dhcp binding
Bindings from all pools not associated with VRF:
IP address          Client-ID/              Lease expiration        Type
                    Hardware address/
                    User name
192.168.0.2         010c.8063.f0c2.6a       May 24 2019 05:07 PM    Automatic

Ngaphansi kwe-spoiler - okuqukethwe kwephakethe elivinjiwe phakathi kweswishi neseva ye-DHCP ezinikezele.

Okuqukethwe kwephakheji
Kufanele kuqashelwe ukuthi iswishi isekela Option 82. Uma inikwe amandla, iswishi izongeza ulwazi olumayelana nomsebenzisi obonakalayo lapho umlayezo we-DHCP Discover wamukelwe khona. Ngaphezu kwalokho, imodeli ye-T2600G-28SQ ikuvumela ukuthi ulungiselele inqubomgomo yokucubungula ulwazi olungeziwe lapho ufaka inketho engunombolo 82. Ukuba khona kosekelo lwale nketho kungaba wusizo esimweni lapho obhalisile edinga ukunikezwa ikheli le-IP elifanayo, kungakhathaliseki ukuthi iklayenti libika yiphi i-id emayelana nalo.
Isibalo esingezansi sibonisa umlayezo we-DHCP Discover (othunyelwe nge-relay) enenketho engunombolo 82.

Umlayezo onenketho engunombolo 82
Yebo, ungaphatha inketho engunombolo 82 ngaphandle kokusetha i-DHCP edluliselwe ngokugcwele; izilungiselelo ezihambisanayo zethulwa esigatshaneni se-“DHCP L2 Relay”.

Manje ake siguqule izilungiselelo zeseva ye-DHCP ukuze sibonise ukuthi inketho No. 82 isebenza kanjani.

R1#sho run | s dhcp
ip dhcp pool test
 network 192.168.0.0 255.255.255.0
 default-router 192.168.0.1
 dns-server 8.8.8.8
 class option82_test
  address range 192.168.0.222 192.168.0.222
ip dhcp class option82_test
 relay agent information
      relay-information hex 010e010c74702d6c696e6b5f746573740208000668ff7b66f675
R1#sho ip dhcp binding
Bindings from all pools not associated with VRF:
IP address          Client-ID/              Lease expiration        Type
                    Hardware address/
                    User name
192.168.0.222       010c.8063.f0c2.6a       May 24 2019 05:33 PM    Automatic

Into efana nale
Umsebenzi wokudlulisa isikhombimsebenzisi se-DHCP uzoba usizo esimweni lapho ukushintshwa kungenayo kuphela isixhumi esibonakalayo se-L3 esixhunywe kunethiwekhi ethile, kodwa lesi sikhombimsebenzisi sinekheli le-IP. Uma lingekho ikheli kusixhumi esibonakalayo esinjalo, umsebenzi wokudluliselwa kwe-DHCP VLAN uzosiza. Ulwazi olumayelana ne-subnet kuleli cala luthathwe kusixhumi esibonakalayo esizenzakalelayo, okungukuthi, izikhala zamakheli kumanethiwekhi amaningana abonakalayo zizofana (ukugqagqana).

Ngokuvamile, o-opharetha nabo badinga ukuvikela ababhalisile ekwenzeni kusebenze okuyiphutha noma okunonya kweseva ye-DHCP kumishini yeklayenti. Sinqume ukuxoxa ngalo msebenzi kwesinye sezigaba eziphathelene nezindaba zokuphepha.

IEEE 802.1X

Enye indlela yokuqinisekisa abasebenzisi kunethiwekhi ukusebenzisa iphrothokholi ye-IEEE 802.1X. Ukuduma kwalesi simiso kumanethiwekhi opharetha bezingcingo eRussia sekwehlile kakade; sisasetshenziswa ikakhulukazi kumanethiwekhi endawo ezinkampani ezinkulu ukuze kuqinisekiswe abasebenzisi bangaphakathi benhlangano. Iswishi ye-T2600G-28SQ inokwesekwa okungu-802.1X, ngakho umhlinzeki angayisebenzisa kalula uma kunesidingo.

Ukuze iphrothokholi ye-IEEE 802.1X isebenze, abahlanganyeli abathathu bayadingeka: okokusebenza kweklayenti (umfakisicelo), ukushintshwa kokufinyelela komhlinzeki (isiqinisekisi) namaseva okuqinisekisa (ngokuvamile amaseva e-RADIUS).

Ukucushwa okuyisisekelo ohlangothini lwe-opharetha kulula kakhulu. Udinga kuphela ukucacisa ikheli le-IP leseva ye-RADIUS esetshenzisiwe, lapho isizindalwazi somsebenzisi sizogcinwa khona, futhi ukhethe nezindawo lapho ukuqinisekiswa kuyadingeka khona.

Ukusethwa okuyisisekelo kwe-802.1X





Ukucushwa okuncane nakho kuyadingeka ohlangothini lweklayenti. Wonke amasistimu wokusebenza esimanje asevele equkethe isofthiwe edingekayo. Kodwa uma kunesidingo, ungafaka futhi usebenzise i-TP-Link 802.1x Client - uhlelo lokusebenza olukuvumela ukuthi uqinisekise iklayenti kunethiwekhi.

Uma uxhuma i-PC yomsebenzisi ngqo kunethiwekhi yomhlinzeki, izilungiselelo zokuqinisekisa kufanele zenziwe zisebenze ekhadini lenethiwekhi elisetshenziselwa uxhumano.

Kodwa-ke, okwamanje, akuyona ikhompyutha yomsebenzisi evame ukuxhunywa kunethiwekhi yomqhubi ngokuqondile, kodwa i-SOHO router eqinisekisa ukusebenza kwenethiwekhi yendawo yobhalisile (zombili izingxenye ezinezintambo nezingenantambo). Kulokhu, zonke izilungiselelo zephrothokholi ye-802.1X kufanele zenziwe ngokuqondile kumzila.

Kithina kubonakala sengathi le ndlela yokuqinisekisa ikhohliwe ngokungafanele kumanethiwekhi o-opharetha. Yebo, ukubophezela obhalisile ngokuqinile endaweni yokushintsha kungase kube yisixazululo esilula ngokombono wezilungiselelo zemishini yomsebenzisi. Kodwa uma ukusetshenziswa kokungena nephasiwedi kudingekile, khona-ke i-802.1X ngeke ibe iphrothokholi esindayo uma kuqhathaniswa noxhumo olusetshenziswa ngokusekelwe kumigudu ye-PPTP/L2TP/PPPoE.

Ukufakwa kwe-ID ye-PPPoE

Abasebenzisi abaningi hhayi ezweni lakithi kuphela, kodwa emhlabeni wonke basakhetha ukusebenzisa amagama ayimfihlo alula kakhulu. Futhi amacala okwebiwa kwemininingwane, maye, awavamile. Uma opharetha esebenzisa iphrothokholi ye-PPPoE kunethiwekhi yakhe ukuze aqinisekise abasebenzisi, khona-ke ukushintshwa kwe-TP-Link T2600G-28SQ kuzosiza ukuxazulula inkinga ehambisana nokuvuza kweziqinisekiso. Lokhu kufinyelelwa ngokungeza ilebula ekhethekile kumlayezo we-PPPoE Active Discovery. Ngale ndlela, umhlinzeki angaqinisekisa obhalisile hhayi kuphela ngokungena ngemvume nephasiwedi, kodwa nangedatha eyengeziwe. Le datha eyengeziwe ihlanganisa ikheli le-MAC ledivayisi yeklayenti, kanye nesixhumi esibonakalayo sokushintsha lapho ixhunywe khona.

Abanye opharetha, empeleni, bafuna ukuphika obhalisile (i-pair of login nephasiwedi) ikhono lokuzulazula kunethiwekhi. Umsebenzi Wokufaka I-ID ye-PPPoE uzosiza nakulesi simo.

I-IGMP

I-IGMP (Internet Group Management Protocol) isineminyaka ikhona. Ukuthandwa kwayo kuyaqondakala futhi kuchazeka kalula. Kodwa kunezinhlangothi ezimbili ezihilelekile ekusebenzisaneni kwe-IGMP: i-PC yomsebenzisi (noma iyiphi enye idivayisi, isibonelo, i-STB) kanye nerutha ye-IP ekhonza ingxenye ethile yenethiwekhi. Ukushintsha akubambi iqhaza kulokhu kushintshana nganoma iyiphi indlela. Yiqiniso, isitatimende sokugcina asilona iqiniso ngokuphelele. Noma kumanethiwekhi esimanje lokhu akulona iqiniso nhlobo. Ukushintsha kusekela i-IGMP ukuze kuthuthukiswe ukudluliselwa kwethrafikhi eningi. Ukulalela ithrafikhi yomsebenzisi, iswishi ithola imilayezo Yombiko we-IGMP kuyo, ngosizo lapho inquma izimbobo zokudlulisa ithrafikhi yokusakaza okuningi. Inketho echaziwe ibizwa nge-IGMP Snooping.

Ukusekelwa kwephrothokholi ye-IGMP ngeke kusetshenziselwe hhayi nje ukuthuthukisa ithrafikhi kanjalo, kodwa futhi nokunquma ababhalisile abanganikezwa isevisi ethile, isibonelo, i-IPTV. Ungakwazi ukufeza umgomo owufunayo ngokuzibekela mathupha imingcele yokuhlunga noma ngokusebenzisa ukufakazela ubuqiniso.

Ukusekelwa kwethrafikhi ye-multicast kumaswishi e-TP-Link kusetshenziswa ngendlela eguquguqukayo. Isibonelo, wonke amapharamitha angasethwa kunethiwekhi ngayinye ebonakalayo ngokwehlukana.

Uma ama-subnet amaningi aqukethe abemukeli bethrafikhi yokusakaza okuningi exhunywe kusixhumi esibonakalayo serutha eyodwa, leyo rutha izophoqeleka ukuthi ithumele amakhophi amaningi amaphakethe ngaleyo ndlela yokuxhumana (elilodwa kunethiwekhi ngayinye ebonakalayo).
Kulokhu, ungakwazi ukuthuthukisa inqubo yokudlulisa ithrafikhi yokusakaza okuningi usebenzisa ubuchwepheshe be-MVR - Ukubhaliswa kwe-VLAN ye-Multicast.

Ingqikithi yesixazululo ukuthi kwakhiwa inethiwekhi eyodwa ebonakalayo ehlanganisa bonke abamukeli. Nokho, le nethiwekhi ebonakalayo isetshenziselwa ithrafikhi yokusakaza okuningi kuphela. Le ndlela ivumela irutha ukuthi ithumele ikhophi eyodwa kuphela yethrafikhi yokusakaza okuningi ngesixhumi esibonakalayo.

I-DDM, i-OAM ne-DLDP

I-DDM – I-Digital Diagnostic Monitoring. Ngesikhathi sokusebenza kwamamojula optical, ngokuvamile kuyadingeka ukuqapha isimo se-module ngokwayo, kanye nesiteshi se-optical esixhunywe kuso. Umsebenzi we-DDM uzokusiza ukuthi ubhekane nalo msebenzi. Ngosizo lwayo, onjiniyela be-opharetha bazokwazi ukuqapha izinga lokushisa lemojula ngayinye esekela lokhu kusebenza, i-voltage yayo kanye namanje, kanye namandla amasignali optical athunyelwe futhi awamukelwe.

Ukusetha amaleveli omkhawulo wamapharamitha achazwe ngaphambilini kuzokuvumela ukuthi ukhiqize umcimbi uma uwela ngaphandle kwebanga elamukelekayo.

Ukusetha imikhawulo yempendulo ye-DDM



Ngokwemvelo, umlawuli angabuka amanani amanje wamapharamitha acacisiwe.

Iswishi ye-TP-Link T2600G-28SQ inesistimu yokupholisa umoya esebenzayo. Ngaphezu kwalokho, asikaze sihlangabezane nokushisisa ngokweqile kwamamojula we-SFP ekushintsheni kwethu ngenxa yokuminyana kwechweba. Kodwa-ke, uma, ngombono nje, ithuba elinjalo livunyelwe (ngokwesibonelo, ngenxa yenkinga ethile ngaphakathi kwemojuli ye-SFP), khona-ke ngosizo lwe-DDM umlawuli uzokwaziswa ngokushesha ngesimo esingaba yingozi. Ingozi lapha, ngokusobala, akuyona yokuguqula ngokwayo, kodwa i-diode / laser ngaphakathi kwe-SFP, njengoba njengoba izinga lokushisa likhuphuka, amandla esignali ye-optical ekhishiwe angase ahlehlise, okuzoholela ekunciphiseni kwesabelomali se-optical.

Kuyafaneleka ukuqaphela lapha ukuthi ukushintshwa kwe-TP-Link akunawo "umsebenzi" wokukhiya umthengisi, okungukuthi, noma yimaphi amamojula ahambisanayo e-SFP asekelwayo, okuyiqiniso, azoba lula kakhulu kubaphathi benethiwekhi.

I-OAM - Ukusebenza, Ukuphatha, Nokunakekela (IEEE 802.3ah). I-OAM iyiphrothokholi yesendlalelo sesibili yemodeli ye-OSI eyenzelwe ukuqapha nokuxazulula izinkinga amanethiwekhi e-Ethernet. Ngokusebenzisa le phrothokholi, iswishi ingaqapha ukusebenza koxhumano oluthile namaphutha, futhi ikhiqize izexwayiso ukuze umlawuli wenethiwekhi akwazi ukuphatha inethiwekhi ngokuphumelelayo.

Ukusetha okuyisisekelo kwe-OAM




OAM Imininingwane YokusebenzaAmadivayisi amabili angomakhelwane asebenzisa i-OAM ashintshana ngezikhathi ezithile imilayezo ngokuthumela ama-OAMPDU, eza ngezinhlobo ezintathu: Ulwazi, Isaziso Somcimbi, kanye Nokulawula I-Loopback. Ngokusebenzisa ama-OAMPDU olwazi, amaswishi angomakhelwane athumelana ulwazi lwezibalo kanye nedatha echazwe umlawuli. Lolu hlobo lomlayezo futhi lusetshenziselwa ukugcina uxhumano ngephrothokholi ye-OAM. Imilayezo Yezaziso Zomcimbi isetshenziswa umsebenzi wokuqapha uxhumano ukwazisa elinye iqembu ukuthi ukwehluleka kwenzeke. Imilayezo yokulawula i-Loopback isetshenziselwa ukuthola iluphu emugqeni.

Ngezansi sinqume ukuklelisa izici eziyinhloko ezinikezwe iphrothokholi ye-OAM:

• ukuqapha imvelo (ukutholwa nokubalwa kwamafreyimu aphukile),

• I-RFI - Inkomba Yokungaphumeleli Okukude (ukuthumela isaziso sokwehluleka esiteshini),

• I-Loopback yesilawuli kude (ukuhlolwa kwesiteshi ukuze kukale ukubambezeleka, ukuhluka kokulibaziseka (i-jitter), inombolo yozimele abalahlekile).

Enye inketho edingekayo ekushintsheni kwe-optical yikhono lokubona izinkinga esiteshini sokuxhumana, okuholela ekutheni isiteshi sibe simplex, okungukuthi, idatha ingathunyelwa ohlangothini olulodwa kuphela. Amaswishi ethu asebenzisa i-DLDP - Iphrothokholi Yokutholwa Kwesixhumanisi Sedivayisi ukuze kutholwe izixhumanisi ezingaqondile. Ukuze kube nobulungisa, kufanele kuqashelwe ukuthi iphrothokholi ye-DLDP isekelwa kokubili optical kanye ne-copper interfaces, kodwa ngokubona kwethu, izothandwa kakhulu uma usebenzisa imigqa ye-fiber optic.

Uma isixhumanisi esingaqondile sitholwa, ukushintshwa kungavala ngokuzenzakalelayo isixhumi esibonakalayo esiyinkinga, okuzoholela ekwakhiweni kabusha kwesihlahla se-STP kanye nokusetshenziswa kweziteshi zokuxhumana eziyisipele.

Ku-arsenal yethu kukhona amamojula e-SFP athola futhi adlulise amasignali nge-fiber eyodwa. Asebenza ngamapheya kuphela futhi asebenzisa amasignali okubona kumaza wamaza ahlukene ukuze adluliselwe phakathi kokubhanqwa. Isibonelo i-TL-SM321A ne-TL-SM321B. Uma usebenzisa amamojula anjalo, ukulimala kwefayibha eyodwa kuzoholela ekungasebenzini okuphelele kwawo wonke isiteshi se-optical. Kodwa-ke, nakuzo iziteshi ezinjalo iphrothokholi ye-DLDP izodingeka, njengoba, nakuba lokhu kwenzeka ngokungajwayelekile, isiteshi singase sibe nezici ezihlukile zokubonisa obala zamaza ahlukene. Inkinga engenzeka kakhulu ukuthi ukukhanya kwesiteshi kuyahlukahluka kuye ngokuthi ikuphi ukusakazeka kokukhanya. I-reflectogram izosiza ukuthola lezi zinkinga, kodwa leyo indaba ehluke ngokuphelele.

I-LLDP

Kumanethiwekhi amakhulu ezinkampani noma opharetha, izinkinga zivela ngezikhathi ezithile ngokuphelelwa yisikhathi kwemibhalo yenethiwekhi noma ukunemba ekulungiseni kwayo. Umlawuli wenethiwekhi angase abhekane nesimo lapho kudingeka khona ukuthola ukuthi iyiphi impahla yomqhubi exhunywe ku-switch interface ethile. I-LLDP – Link Layer Discovery Protocol (IEEE 802.1AB) izosiza.

I-LLDP Operation Parameters






Amaswishi ethu asekela i-LLDP hhayi kuphela ukuthola amaswishi angomakhelwane noma amanye amadivaysi enethiwekhi, kodwa futhi nokunquma amandla awo.

Ozakwethu bethusi bokushintshwa bangasebenzisa i-LLDP-MED ukwenza lula inqubo yokuxhuma amafoni we-IP. Futhi, usebenzisa le nketho, ukushintshwa kwe-PoE kungaxoxisana ngamapharamitha wamandla ngedivayisi enikwe amandla. Sesike sakhuluma ngalokhu ngemininingwane ethile kwenye yethu izinto ezidlule.

I-SDM nokubhalisa ngokweqile

Cishe wonke amaswishi esimanje acubungula amafreyimu namaphakethe ngaphandle kokusebenzisa iphrosesa emaphakathi. Ukucutshungulwa (ukubala amanani okuhlola, ukusebenzisa izinhlu zokufinyelela kanye nokwenza okunye ukuhlola kokuphepha, kanye nokwenza izinqumo zokushintsha/umzila) kwenziwa kusetshenziswa ama-chips akhethekile, okuvumela isivinini esikhulu sokudlulisa sethrafikhi yomsebenzisi. Iswishi ngaphansi kwengxoxo ivumela ukucubungula ithrafikhi ngesivinini esimaphakathi. Lokhu kusho ukuthi ukusebenza kwedivayisi kwanele ukuthumela idatha ngesivinini esiphezulu esingakhona kuzo zonke izimbobo ngesikhathi esisodwa. Imodeli ye-T2600G-28SQ inamachweba we-downlink angu-24 (abheke kubasebenzisi), asebenza ngesivinini esingu-1 Gbit/s, kanye namachweba angu-4 akhuphukayo (ebheke kumgogodla wenethiwekhi) we-10 Gbit/s. Ngesikhathi esifanayo, ukusebenza kwe-switch cross-bus yi-128 Gbit / s, okwanele ukucubungula inani eliphezulu lethrafikhi engenayo.

Ngobulungisa, kuyaphawuleka ukuthi ukusebenza matrix ukushintsha - amaphakethe million 95,2 ngomzuzwana. Okusho ukuthi, uma usebenzisa ubuncane bozimele abangaba khona abanobude bamabhayithi angu-64 kuphela, ukusebenza okuphelele kwedivayisi kuzoba ngu-97,5 Gbit/s. Kodwa-ke, iphrofayili enjalo yethrafikhi cishe ayinakwenzeka kumanethiwekhi opharetha we-telecom.

Kuyini ukubhalisa ngokweqileEnye inkinga ebalulekile isilinganiso sesivinini seziteshi ezikhuphuka nomfula (ukubhalisa ngokweqile). Lapha, ngokusobala, konke kuncike ku-topology. Uma umlawuli esebenzisa zonke izixhumi ezibonakalayo ezine ze-10 GE ukuze axhume kumongo wenethiwekhi futhi azihlanganise zisebenzisa i-LAG (I-Link Aggregation Group) noma ubuchwepheshe be-Port-Channel, khona-ke isivinini esitholwe ngokwezibalo siya kumongo sizoba ngu-40 Gbit/s, okuzoba ngaphezulu. kunokwanele ukwanelisa izidingo zabo bonke ababhalisile abaxhunyiwe. Ngaphezu kwalokho, akudingekile ukuthi wonke ama-uplink amane axhume kudivayisi eyodwa ebonakalayo. Ukuxhumeka kungenziwa kunqwaba yokushintsha, noma kumadivayisi amabili ahlanganiswe abe yiqoqo (kusetshenziswa ubuchwepheshe be-vPC noma okufanayo). Kulokhu akukho ukubhalisa ngokweqile.

Ungasebenzisa wonke ama-uplinks amane ngasikhathi sinye hhayi nje ngokuwahlanganisa usebenzisa i-LAG. Umphumela ofanayo ungafinyelelwa ngokumisa kahle i-MSTP, kodwa leyo indaba ehluke ngokuphelele.

Eyesibili evame ukusetshenziswa L2 indlela yokuxhuma iwukusebenzisa LAGs ezimbili ezimele (eyodwa ukuhlanganisa switch ngayinye). Kulesi simo, cishe, enye yezixhumanisi ezibonakalayo izovinjelwa umthetho olandelwayo we-STP (uma usebenzisa i-STP noma i-RSTP). Ukubhalisa ngaphezulu kuzoba ngu-5:6.

Isimo esingavamile, kodwa esisengenzeka: i-T2600G-28SQ ixhunywe ngamashaneli azimele kuswishi noma amaswishi akhuphuka nomfula. Iphrothokholi ye-STP/RSTP izoshiya isixhumanisi esisodwa kuphela esimweni sokungavinjiwe. Ukubhalisa ngaphezulu kuzoba ngu-5:12.

Umsebenzi onenkanyezi: bala ukubhalisa ngokweqile kwezimo ezichazwe esigabeni se-STP, lapho sibheke khona isibonelo se-topology lapho amaswishi amabili okufinyelela exhunywe kudivayisi efanayo yokuhlanganisa futhi exhunywe.

Ama-chips ahlelekayo anika amandla isivinini esikhulu sokudlulisa ayisisetshenziswa esibiza kakhulu, ngakho-ke sizama ukukhulisa ukusetshenziswa kwawo ngokusabalalisa kahle izinsiza phakathi kwemisebenzi eyahlukene. I-SDM - Ukushintsha Ukuphathwa Kwesizindalwazi kunesibopho sokusabalalisa.

Ukusabalalisa kwenziwa kusetshenziswa iphrofayela ye-SDM. Njengamanje kunamaphrofayili amathathu atholakalayo ukuze asetshenziswe, abhalwe ngezansi.

• Okuzenzakalelayo kunikeza isixazululo esilinganisiwe sokusebenzisa uhlu lokufinyelela lwe-MAC ne-IP, kanye nokungenayo kokutholwa kwe-ARP.
• I-EnterpriseV4 ikuvumela ukuthi ukhulise izinsiza ezitholakalayo ukuze zisetshenziswe i-MAC nezinhlu zokufinyelela ze-IP.
• I-EnterpriseV6 yabela izinsiza ezithile ukuze zisetshenziswe uhlu lokufinyelela lwe-IPv6.

Iswishi kufanele iqaliswe kabusha ukuze usebenzise iphrofayela entsha.

isiphetho

Ngokuhambisana nokuma kokuqala, le swishi ifaneleka kakhulu kubaqhubi bezingcingo ababhekene nomsebenzi wokunikeza ukufinyelela kwenethiwekhi ezindaweni ezikude. Idivayisi ingasetshenziswa kokubili ezingeni lokufinyelela, isibonelo, emiphakathini yamakotishi nasezindlini zasemadolobheni, kanye nokuhlanganiswa kwamashaneli avela kumaswishi okufinyelela atholakala ezakhiweni zamafulethi; okungukuthi, noma kuphi lapho kudingeka khona ukuxhumana nezinto ezikude. Uma usebenzisa iziteshi zokuxhumana ezibonakalayo, obhalisile oxhunyiwe angatholakala ebangeni elingafika kumakhilomitha ambalwa.

Ohlangothini lweklayenti, izixhumanisi ezibonakalayo zinganqanyulwa kumaswishi amancane anezindawo zokusebenzelana ezibonakalayo noma kuziguquli zemidiya.

Inombolo enkulu yezivumelwano ezisekelwayo nezinketho zizovumela i-T2600G-28SQ ukuthi isetshenziswe kunethiwekhi ye-Ethernet yomqhubi nganoma iyiphi i-topology nanoma iyiphi isethi yobuchwepheshe obusetshenzisiwe kanye nezinsizakalo ezinikeziwe. Iswishi iphethwe ukude kusetshenziswa isixhumi esibonakalayo sewebhu noma umugqa womyalo. Uma ukucushwa kwendawo kudingekile, ungasebenzisa imbobo yekhonsoli; imodeli ye-T2600G-28SQ inalezi ezimbili: i-RJ-45 ne-micro-USB. Njengempukane encane emafutheni, siphawula ukuntuleka kokusekelwa kwe-stacking kanye nokunikezwa kwamandla kwesibili. Yiqiniso, ngokuvamile ngaphandle kwezikhungo zedatha zabahlinzeki, ukuba khona kolayini kagesi wesibili kuyoba yivelakancane.

Izinzuzo zayo zihlanganisa intengo ephansi, inombolo enkulu yamachweba optical obhalisile, ukuba khona kwe-10 GE optical uplinks, kanye namachweba amane ahlanganisiwe kanye nokudluliselwa kwethrafikhi ngesivinini esiphakathi.

Source: www.habr.com