| 某一公司内财务部、销售部的 PC 通过 2 台交换机实现通信；要求财务部和销售部的 PC 可以互通，但为了数据安全起见，销售部和财务部需要进行互相隔离，现要在交换机上做适当配置来实现这一目标。 |
技术原理
VLAN（Virtual Local Area Network）的中文名为"虚拟局域网"。
虚拟局域网（VLAN）是一组逻辑上的设备和用户，这些设备和用户并不受物理位置的限制，可以根据功能、部门及应用等因素将它们组织起来，相互之间的通信就好像它们在同一个网段中一样，由此得名虚拟局域网。VLAN是一种比较新的技术，工作在OSI参考模型的第2层和第3层，一个VLAN就是一个广播域，VLAN之间的通信是通过第3层的路由器来完成的。与传统的局域网技术相比较，VLAN技术更加灵活，它具有以下优点： 网络设备的移动、添加和修改的管理开销减少；可以控制广播活动；可提高网络的安全性。
VLAN 是指在一个物理网段内，进行逻辑的划分，划分成若干个虚拟局域网，VLAN做大的特性是不受物理位置的限制，可以进行灵活的划分。VLAN 具备了一个物理网段所具备的特性。相同 VLAN 内的主机可以相互直接通信，不同 VLAN 间的主机之间互相访问必须经路由设备进行转发，广播数据包只可以在本 VLAN 内进行广播，不能传输到其他 VLAN 中。
Port VLAN 是实现 VLAN 的方式之一，它利用交换机的端口进行 VALN 的划分，一个端口只能属于一个 VLAN。
Tag VLAN 是基于交换机端口的另一种类型，主要用于是交换机的相同 Vlan 内的主机之间可以直接访问，同时对不同 Vlan 的主机进行隔离。Tag VLAN 遵循IEEE802.1Q 协议的标准，在使用配置了 Tag VLAN 的端口进行数据传输时，需要在数据帧内添加 4 个字节的 8021.Q 标签信息，用于标示该数据帧属于哪个 VLAN,便于对端交换机接收到数据帧后进行准确的过滤。
实验步骤
新建 Packet Tracer 拓扑图； 
划分 VLAN；
将端口划分到相应 VLAN 中；
设置 Tag VLAN Trunk 属性；
测试
实验设备
Switch_2960 2 台；PC 4 台；直连线
PC1 IP: 192.168.1.2 Submark: 255.255.255.0 Gateway: 192.168.1.1 PC2 IP: 192.168.1.3 Submark: 255.255.255.0 Gateway: 192.168.1.1 PC3 IP: 192.168.1.4 Submark: 255.255.255.0 Gateway: 192.168.1.1 PC4 IP: 192.168.1.5 Submark: 255.255.255.0 Gateway: 192.168.1.1 Switch1 en conf t vlan 2 exit vlan 3 exit inter fa 0/1 switch access vlan 2 exit inter fa 0/2 switch access vlan 3 exit inter fa 0/24 switch mode trunk end show vlan Switch2 en conf t vlan 2 exit vlan 3 exit int fa 0/1 switch access vlan 2 exit int fa 0/2 switch access vlan 3 exit int fa 0/24 switch mode trunk end show vlan PC1 ping PC2 timeout PC1 ping PC3 Reply
实战演练
Switch1 Switch>en Switch#conf t Enter configuration commands, one per line. End with CNTL/Z. Switch(config)#vlan 2 Switch(config-vlan)#exit Switch(config)#vlan 3 Switch(config-vlan)#exit Switch(config)#inter fa 0/1 Switch(config-if)#switch access vlan 2 Switch(config-if)#exit Switch(config)#inter fa 0/2 Switch(config-if)#switch access vlan 3 Switch(config-if)#exit Switch(config)#inter fa 0/24 Switch(config-if)#switch mode trunk %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/24, changed state to down %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/24, changed state to up Switch(config-if)#end Switch# %SYS-5-CONFIG_I: Configured from console by console Switch#show vlan VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Fa0/3, Fa0/4, Fa0/5, Fa0/6 Fa0/7, Fa0/8, Fa0/9, Fa0/10 Fa0/11, Fa0/12, Fa0/13, Fa0/14 Fa0/15, Fa0/16, Fa0/17, Fa0/18 Fa0/19, Fa0/20, Fa0/21, Fa0/22 Fa0/23, Gig1/1, Gig1/2 2 VLAN0002 active Fa0/1 3 VLAN0003 active Fa0/2 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------ 1 enet 100001 1500 - - - - - 0 0 2 enet 100002 1500 - - - - - 0 0 3 enet 100003 1500 - - - - - 0 0 1002 fddi 101002 1500 - - - - - 0 0 --More-- Switch2 Switch>en Switch#conf t Enter configuration commands, one per line. End with CNTL/Z. Switch(config)#vlan 2 Switch(config-vlan)#exit Switch(config)#vlan 3 Switch(config-vlan)#exit Switch(config)#int fa 0/1 Switch(config-if)#switch access vlan 2 Switch(config-if)#exit Switch(config)#int fa 0/2 Switch(config-if)#switch access vlan 3 Switch(config-if)#exit Switch(config)#int fa 0/24 Switch(config-if)#switch mode trunk Switch(config-if)#end Switch# %SYS-5-CONFIG_I: Configured from console by console Switch#show vlan VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Fa0/3, Fa0/4, Fa0/5, Fa0/6 Fa0/7, Fa0/8, Fa0/9, Fa0/10 Fa0/11, Fa0/12, Fa0/13, Fa0/14 Fa0/15, Fa0/16, Fa0/17, Fa0/18 Fa0/19, Fa0/20, Fa0/21, Fa0/22 Fa0/23, Gig1/1, Gig1/2 2 VLAN0002 active Fa0/1 3 VLAN0003 active Fa0/2 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------ 1 enet 100001 1500 - - - - - 0 0 2 enet 100002 1500 - - - - - 0 0 3 enet 100003 1500 - - - - - 0 0 1002 fddi 101002 1500 - - - - - 0 0 --More--
测试
PC>ipconfig IP Address......................: 192.168.1.2 Subnet Mask.....................: 255.255.255.0 Default Gateway.................: 192.168.1.1 PC>ping 192.168.1.3 Pinging 192.168.1.3 with 32 bytes of data: Request timed out. Request timed out. Ping statistics for 192.168.1.3: Packets: Sent = 2, Received = 0, Lost = 2 (100% loss), Control-C ^C PC>ping 192.168.1.4 Pinging 192.168.1.4 with 32 bytes of data: Reply from 192.168.1.4: bytes=32 time=16ms TTL=128 Reply from 192.168.1.4: bytes=32 time=17ms TTL=128 Reply from 192.168.1.4: bytes=32 time=15ms TTL=128 Reply from 192.168.1.4: bytes=32 time=18ms TTL=128 Ping statistics for 192.168.1.4: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 15ms, Maximum = 18ms, Average = 16ms PC>ipconfig IP Address......................: 192.168.1.3 Subnet Mask.....................: 255.255.255.0 Default Gateway.................: 192.168.1.1 PC>ping 192.168.1.4 Pinging 192.168.1.4 with 32 bytes of data: Request timed out. Ping statistics for 192.168.1.4: Packets: Sent = 2, Received = 0, Lost = 2 (100% loss), Control-C ^C PC>ping 192.168.1.5 Pinging 192.168.1.5 with 32 bytes of data: Reply from 192.168.1.5: bytes=32 time=16ms TTL=128 Reply from 192.168.1.5: bytes=32 time=15ms TTL=128 Reply from 192.168.1.5: bytes=32 time=16ms TTL=128 Reply from 192.168.1.5: bytes=32 time=15ms TTL=128 Ping statistics for 192.168.1.5: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 15ms, Maximum = 16ms, Average = 15ms
原文地址： https://www.linuxprobe.com/switch-vlan-configuration.html