华为交换机SEP双半环设计方案及配置详细步骤

华为交换机SEP双半环设计方案及配置步骤

SEP双半环设计方案拓扑图

SEP双半环设计方案思路

1.客户的业务vlan 10是2层流量，6台交换机组成的链路为2层链路，为了防环，设计两个sep半环，

sep 1半环:-MSW1-eth-trunk2链路-MSW2-
sep 2半环:-MSW2-eth-trunk3链路-MSW2-

2.端口角色：

MSW1：
eth-trunk1为sep环1的无邻居主边缘端口，
eth-trunk4为sep环2的无邻居主边缘端口；
MSW2:
eth-trunk1为sep环1的无邻居副边缘端口，
eth-trunk4为sep环2的无邻居副边缘端口；

sep环1中阻塞MSW2的eth-trunk1口，sep环2中阻塞MSW2的eth-trunk4口；sep环1环2均配置延迟抢占；

3.为了产生自环，MSW1和MSW2的之间互连的eth-trunk2和eth-trunk3链路，只有一条互连链路需要放通业务vlan10，另一条不需要放通；

4.正常情况下二层流量走CSW1-eth-trunk1 of MSW1-eth-trunk4 of MSW1-NSW1；当有链路中断的时候，阻塞端口就会放开，这里会出现一个情况，即当MSW1-MSW2之间互连的两根链路中有一根出现故障时(比如eth-trunk3链路)，MSW2的eth-trunk4口会放开，这时会出现一个新的环，路径为MSW1-NSM1-NSW2-MSW2-eth-trunk2链路-MSW1,这时候为了进一步破环，需要在MSW2 eth-trunk4上配置环回口检测机制和MAC地址漂移惩罚机制，当端口检测到有环路和地址漂移时，让eth-trunk4口继续down,来进一步破环，同理，MSW2的eth-trunk4口也需要配置配置环回口检测机制和MAC地址漂移惩罚机制；

华为交换机MSW1,MSW2配置详细步骤

MSW1配置

//关闭该vlan10的MAC地址学习功能,避免mac学习过程中导致的流量中断
#
vlan 10mac-address learning disable
#//配置stp保护实例
#
stp region-configurationregion-name Huaweiprotected-instance allactive region-configuration
#//配置stp半环，抢占延迟为300秒，sep环1阻断Eth-trunk1口，sep环2阻断Eth-trunk4口
#
sep segment 1control-vlan 4092block port sysname MSW2 interface Eth-Trunk1preempt delay 300protected-instance 0 to 4094
sep segment 2control-vlan 4090                        block port sysname MSW2 interface Eth-Trunk4preempt delay 300protected-instance 0 to 4094
#//Eth-trunk1口放通sep环1，并为无邻居主边缘端口,并且disable stp
#
interface Eth-Trunk1description ***Connected_to_CSW1***port link-type trunkundo port trunk allow-pass vlan 1port trunk allow-pass vlan 10  4092stp disablesep segment 1 edge no-neighbor primarymode lacp
#//Eth-trunk2口放通sep环1，，并且disable stp
#
interface Eth-Trunk2description ***connected_to_MSW2_eth-trunk2***port link-type trunkundo port trunk allow-pass vlan 1port trunk allow-pass vlan 10 4092stp disablesep segment 1  mode lacp
#//Eth-trunk3口放通sep环2，并且disable stp,不需要放通vlan10
#
interface Eth-Trunk3description ***connected_to_MSW2_eth-trunk3***port link-type trunkport trunk allow-pass vlan 4090stp disablesep segment 2mode lacp
#//Eth-trunk4口放通sep环2，并为无邻居主边缘端口，并且disable stp
#
interface Eth-Trunk4description ***To_NSW1***port link-type trunkport trunk pvid vlan 4094undo port trunk allow-pass vlan 1port trunk allow-pass vlan 10 4094stp disablesep segment 2 edge no-neighbor primarymode lacp
#

MSW2配置

//配置接口的环回检测报文发送周期为1秒
#
loopback-detect packet-interval 1
#
//配置VLAN 10的MAC漂移检测安全级别为高，即MAC地址发生3次迁移后，系统认为发生了MAC地址漂移
#
mac-address flapping detection vlan 10 security-level high
#
//配置由于发生了MAC地址漂移而导致变为error-down的端口延迟300秒后自动变为up状态
#
error-down auto-recovery cause mac-address-flapping interval 300
#//关闭该vlan10的MAC地址学习功能,避免mac学习过程中导致的流量中断
#
vlan 10mac-address learning disable
#//配置stp保护实例
#
stp region-configurationregion-name Huaweiprotected-instance allactive region-configuration
#//配置stp半环
#
sep segment 1                             control-vlan 4092protected-instance 0 to 4094
sep segment 2control-vlan 4090protected-instance 0 to 4094
#//Eth-trunk1口放通sep环1，并为无邻居副边缘端口，并且disable stp,并且配置环回口检测和MAC地址漂移惩罚来进一步防环
#
interface Eth-Trunk1description ***Connect_to_CSW2***port link-type trunkundo port trunk allow-pass vlan 1port trunk allow-pass vlan 10 4092loopback-detect recovery-time 300loopback-detect packet vlan 10loopback-detect enableloopback-detect action blockstp disablesep segment 1 edge no-neighbor secondarymode lacpmac-address flapping action error-down
#//Eth-trunk2口放通sep环1，并且disable stp
#
interface Eth-Trunk2description ***connected_to_MSW1_eth-trunk2***port link-type trunkundo port trunk allow-pass vlan 1port trunk allow-pass vlan 10 4092stp disablesep segment 1mode lacp
#//Eth-trunk3口放通sep环2，并且disable stp,不需要放通vlan10
#
interface Eth-Trunk3description ***connected_to_MSW1_eth-trunk3***port link-type trunkport trunk allow-pass vlan 4090stp disablesep segment 2mode lacp
#//Eth-trunk4口放通sep环2，并为无邻居副边缘端口，并且disable stp，并且配置环回口检测和MAC地址漂移惩罚来进一步防环
#
interface Eth-Trunk4description ***connected_to_NSW2***port link-type trunkport trunk pvid vlan 4094undo port trunk allow-pass vlan 1port trunk allow-pass vlan 10 4090loopback-detect recovery-time 300loopback-detect packet vlan 10loopback-detect enableloopback-detect action blockstp disablesep segment 2 edge no-neighbor secondarymode lacpmac-address flapping action error-downtrust dscp
#