我有两台 Cisco 3850 交换机 (3850-1、3850-2)。我使用 3850-1 内置的 DHCP 设置了 VLAN 1、2、3、4、5 (192.168.1.0 - 192.168.5.0)。
3850-1 是 192.168.1.3 3850-2 是 192.168.1.4
我在两者之间设置了以太网通道。我目前已将它们设置为允许所有 VLAN（稍后将进行限制）。
每个 VLAN 都配置了 HSRP，以便 VIP 作为每个 VLAN 子网的默认网关保持活跃。
我有一个新的 Cisco 1852e WAP（MObility Express 模式）。它是 192.168.1.5 上的 Mobility Express 管理器。
如果我将设备（例如 iPhone）连接到为 VLAN 3 设置的 SSID（客户），效果很好。设备获取 IP 地址 192.168.3.51，D/G 192.168.3.1。我可以 ping 除一个 IP（我的 3850-1 交换机，IP 192.168.1.3）之外的所有 IP。
如果我将设备连接到 SSID Employees，并设置为 VLAN 2，则该设备的 IP 地址为 192.168.2.54 d/g 192.168.2.1。我可以 ping 除 192.168.1.3 (3850-1) 之外的所有设备。
疯狂的事情：192.168.1.3 (3850-1) 可以 ping 任一设备的指定 IP，192.168.1.4 (3850-2) 也可以。如果我通过 SSH 进入任一设备，它们都可以 ping 任一 SSID/子网/VLAN 上的设备。
但两台设备都无法 ping 通 192.168.1.3 (3850-1)。
我想知道我的以太网通道设置是否有什么错误？
这让我很抓狂。我不是这方面的专家。我们就把这个问题说出来吧。到目前为止，我还无法弄清楚为什么每个交换机都可以成功 ping 通任何 SSID 上的任何设备，但设备却无法 ping 通 192.168.1.3 (3850-1)。
这是我的 3850-1 的待机信息：
3850-1#show standby br
P indicates configured to preempt.
|
Interface Grp Pri P State Active Standby Virtual IP
Vl2 10 100 P Standby 192.168.2.3 local 192.168.2.1
Vl3 30 100 P Standby 192.168.3.3 local 192.168.3.1
Vl4 40 100 P Standby 192.168.4.3 local 192.168.4.1
这是来自 3850-2 的：
3850-2#sho standby br
P indicates configured to preempt.
|
Interface Grp Pri P State Active Standby Virtual IP
Vl2 10 100 P Active local 192.168.2.2 192.168.2.1
Vl3 30 100 P Active local 192.168.3.2 192.168.3.1
Vl4 40 100 P Active local 192.168.4.2 192.168.4.1
这是我的 3850-1 的 VLAN 中继信息：
3850-1#show int trunk
Port Mode Encapsulation Status Native vlan
Gi1/0/5 on 802.1q trunking 1
Gi1/0/23 on 802.1q trunking 1
Gi1/0/24 on 802.1q trunking 1
Port Vlans allowed on trunk
Gi1/0/5 1-4094
Gi1/0/23 1-4094
Gi1/0/24 1-4094
Port Vlans allowed and active in management domain
Gi1/0/5 1-5,13
Gi1/0/23 1-5,13
Gi1/0/24 1-5,13
Port Vlans in spanning tree forwarding state and not pruned
Gi1/0/5 1-5,13
Gi1/0/23 none
Gi1/0/24 1-5,13
从 3850-2 开始：
3850-2#show int trunk
Port Mode Encapsulation Status Native vlan
Gi1/0/11 on 802.1q trunking 1
Gi1/0/23 on 802.1q trunking 1
Gi1/0/24 on 802.1q trunking 1
Port Vlans allowed on trunk
Gi1/0/11 1-4094
Gi1/0/23 1-4094
Gi1/0/24 1-4094
Port Vlans allowed and active in management domain
Gi1/0/11 1-5,13
Gi1/0/23 1-5,13
Gi1/0/24 1-5,13
Port Vlans in spanning tree forwarding state and not pruned
Gi1/0/11 1-5,13
Gi1/0/23 1-5,13
Gi1/0/24 1
我的 1852e 位于 3850-2 G1/0/11 上。根据 Cisco 的 MObility Express 文档，它被设置为 TRUNK 端口，以方便在各种 VLAN 上拥有 SSID。
我的以太通道配置为每个交换机上的 g1/0/23 和 g1/0/24。
这是我的配置（3850-1）：
!
! Last configuration change at 14:13:22 UTC Mon Jun 27 2016
!
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname 3850-1
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-vrf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
logging console emergencies
enable secret 4 h0Ne.6akbVdjXZ6DzRvN1DHQNFi/WK0h2CApUGBYEF2
!
no aaa new-model
clock timezone UTC -5 0
clock summer-time UTC recurring
switch 1 provision ws-c3850-24t
!
!
!
!
!
ip routing
!
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.1.1 192.168.1.50
ip dhcp excluded-address 192.168.2.1 192.168.2.50
ip dhcp excluded-address 192.168.3.1 192.168.3.50
ip dhcp excluded-address 192.168.4.1 192.168.4.50
!
ip dhcp pool 192.168.2.1
network 192.168.2.0 255.255.255.0
default-router 192.168.2.1
dns-server 192.168.13.250 8.8.8.8 192.168.13.251
netbios-name-server 192.168.13.250 192.168.13.251
netbios-node-type h-node
!
ip dhcp pool 192.168.1.0
network 192.168.1.0 255.255.255.0
dns-server 192.168.13.250 8.8.8.8 192.168.13.251
default-router 192.168.1.3
netbios-name-server 192.168.13.250 192.168.13.251
netbios-node-type h-node
!
ip dhcp pool 192.168.3.1
network 192.168.3.0 255.255.255.0
default-router 192.168.3.1
dns-server 192.168.13.250 8.8.8.8
netbios-name-server 192.168.13.250 192.168.13.251
netbios-node-type h-node
!
ip dhcp pool 192.168.4.1
network 192.168.4.0 255.255.255.0
dns-server 192.168.13.250 8.8.8.8 192.168.13.251
default-router 192.168.4.1
netbios-name-server 192.168.13.250 192.168.13.251
netbios-node-type h-node
!
!
qos wireless-default-untrust
qos queue-softmax-multiplier 100
!
crypto pki trustpoint TP-self-signed-1939811358
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1939811358
revocation-check none
rsakeypair TP-self-signed-1939811358
!
!
crypto pki certificate chain TP-self-signed-1939811358
certificate self-signed 01
3082023E 308201A7 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31393339 38313133 3538301E 170D3136 30353236 30383135
33355A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 39333938
31313335 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100E6B8 E8FF2963 DEE3DD17 10EE39CB F2CB7271 9E9AD651 97446D51 BDE3D7A7
76B97FE8 C2E04D64 10123FE4 D407301C 30CFFFBC E813B22C 7F2C0253 FD2890C5
46BA859E 6950720F 585E3D02 1BE7E7EB 1E450758 1E496631 2FF61BCD BEC5035F
FEBCB503 88E5D05B 2A0262F7 CE0471CD AA8E3027 487730E0 F78BE317 BBFB4B67
4C130203 010001A3 66306430 0F060355 1D130101 FF040530 030101FF 30110603
551D1104 0A300882 06537769 74636830 1F060355 1D230418 30168014 A195FE1A
E1181495 C0D78655 DE8FA75D 8EBBA017 301D0603 551D0E04 160414A1 95FE1AE1
181495C0 D78655DE 8FA75D8E BBA01730 0D06092A 864886F7 0D010104 05000381
8100D556 C2170C0D FDD8DE80 40B96CBF 7D63D893 A6480140 D1A16E36 FB10A6A8
C626DCC6 62066503 002CD936 573C6A08 0F618DAF 5791F89A 0759E261 6E4E2E6F
062430D8 E6B7D922 1EADA08E 4BB3D45E E9744A8C 74F2CEBC AA442D6A EDEB7446
B05C4335 A8E40C8B E8175A36 6A11A057 9D8323BA 42F7214E C93A16F4 EED8C496 3D90
quit
diagnostic bootup level minimal
spanning-tree mode pvst
spanning-tree extend system-id
hw-switch switch 1 logging onboard message level 3
!
redundancy
mode sso
!
!
!
class-map match-any non-client-nrt-class
!
policy-map port_child_policy
class non-client-nrt-class
bandwidth remaining ratio 10
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Port-channel1
!
interface GigabitEthernet0/0
vrf forwarding Mgmt-vrf
ip address 192.168.1.2 255.255.255.0
negotiation auto
!
interface GigabitEthernet1/0/1
description Uplink to Firewall to TimeWarner
switchport mode access
!
interface GigabitEthernet1/0/2
!
interface GigabitEthernet1/0/3
description was to fiber transceiver in room west of W1
!
interface GigabitEthernet1/0/4
!
interface GigabitEthernet1/0/5
description long haul to box room (west) into 5 port switch
switchport mode trunk
!
interface GigabitEthernet1/0/6
!
interface GigabitEthernet1/0/7
!
interface GigabitEthernet1/0/8
!
interface GigabitEthernet1/0/9
switchport mode access
!
interface GigabitEthernet1/0/10
!
interface GigabitEthernet1/0/11
switchport access vlan 3
switchport mode access
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/0/13
switchport mode access
!
interface GigabitEthernet1/0/14
!
interface GigabitEthernet1/0/15
!
interface GigabitEthernet1/0/16
!
interface GigabitEthernet1/0/17
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
!
interface GigabitEthernet1/0/20
!
interface GigabitEthernet1/0/21
!
interface GigabitEthernet1/0/22
!
interface GigabitEthernet1/0/23
switchport mode trunk
channel-group 1 mode auto
!
interface GigabitEthernet1/0/24
switchport mode trunk
channel-group 1 mode auto
!
interface GigabitEthernet1/1/1
!
interface GigabitEthernet1/1/2
!
interface GigabitEthernet1/1/3
!
interface GigabitEthernet1/1/4
!
interface TenGigabitEthernet1/1/1
!
interface TenGigabitEthernet1/1/2
!
interface TenGigabitEthernet1/1/3
!
interface TenGigabitEthernet1/1/4
!
interface Vlan1
ip address 192.168.1.3 255.255.255.0
ip helper-address 192.168.1.3
!
interface Vlan2
ip address 192.168.2.2 255.255.255.0
ip helper-address 192.168.2.1
standby 10 ip 192.168.2.1
standby 10 timers msec 200 msec 750
standby 10 preempt delay minimum 300
!
interface Vlan3
ip address 192.168.3.2 255.255.255.0
ip helper-address 192.168.3.1
standby 30 ip 192.168.3.1
standby 30 timers msec 200 msec 750
standby 30 preempt delay minimum 300
!
interface Vlan4
ip address 192.168.4.2 255.255.255.0
ip helper-address 192.168.4.1
standby 40 ip 192.168.4.1
standby 40 timers msec 200 msec 750
standby 40 preempt delay minimum 300
!
interface Vlan5
ip address 192.168.5.1 255.255.255.0
!
interface Vlan13
ip address 192.168.13.1 255.255.255.0
!
ip forward-protocol nd
no ip http server
ip http secure-server
ip route 0.0.0.0 0.0.0.0 192.168.1.1
ip route 192.168.1.0 255.255.255.0 Vlan1
ip route 192.168.2.0 255.255.255.0 Vlan2
ip route 192.168.3.0 255.255.255.0 Vlan3
ip route 192.168.4.0 255.255.255.0 Vlan4
!
!
!
!
!
line con 0
exec-timeout 0 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
password 275woodward
login
line vty 5 15
password 275woodward
login
!
wsma agent exec
profile httplistener
profile httpslistener
!
wsma agent config
profile httplistener
profile httpslistener
!
wsma agent filesys
profile httplistener
profile httpslistener
!
wsma agent notify
profile httplistener
profile httpslistener
!
!
wsma profile listener httplistener
transport http
!
wsma profile listener httpslistener
transport https
!
ap group default-group
end
最后，这是 3850-2 的配置：
!
! Last configuration change at 14:13:22 UTC Mon Jun 27 2016
!
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname 3850-1
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-vrf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
logging console emergencies
enable secret 4 h0Ne.6akbVdjXZ6DzRvN1DHQNFi/WK0h2CApUGBYEF2
!
no aaa new-model
clock timezone UTC -5 0
clock summer-time UTC recurring
switch 1 provision ws-c3850-24t
!
!
!
!
!
ip routing
!
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.1.1 192.168.1.50
ip dhcp excluded-address 192.168.2.1 192.168.2.50
ip dhcp excluded-address 192.168.3.1 192.168.3.50
ip dhcp excluded-address 192.168.4.1 192.168.4.50
!
ip dhcp pool 192.168.2.1
network 192.168.2.0 255.255.255.0
default-router 192.168.2.1
dns-server 192.168.13.250 8.8.8.8 192.168.13.251
netbios-name-server 192.168.13.250 192.168.13.251
netbios-node-type h-node
!
ip dhcp pool 192.168.1.0
network 192.168.1.0 255.255.255.0
dns-server 192.168.13.250 8.8.8.8 192.168.13.251
default-router 192.168.1.3
netbios-name-server 192.168.13.250 192.168.13.251
netbios-node-type h-node
!
ip dhcp pool 192.168.3.1
network 192.168.3.0 255.255.255.0
default-router 192.168.3.1
dns-server 192.168.13.250 8.8.8.8
netbios-name-server 192.168.13.250 192.168.13.251
netbios-node-type h-node
!
ip dhcp pool 192.168.4.1
network 192.168.4.0 255.255.255.0
dns-server 192.168.13.250 8.8.8.8 192.168.13.251
default-router 192.168.4.1
netbios-name-server 192.168.13.250 192.168.13.251
netbios-node-type h-node
!
!
qos wireless-default-untrust
qos queue-softmax-multiplier 100
!
crypto pki trustpoint TP-self-signed-1939811358
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1939811358
revocation-check none
rsakeypair TP-self-signed-1939811358
!
!
crypto pki certificate chain TP-self-signed-1939811358
certificate self-signed 01
3082023E 308201A7 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31393339 38313133 3538301E 170D3136 30353236 30383135
33355A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 39333938
31313335 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100E6B8 E8FF2963 DEE3DD17 10EE39CB F2CB7271 9E9AD651 97446D51 BDE3D7A7
76B97FE8 C2E04D64 10123FE4 D407301C 30CFFFBC E813B22C 7F2C0253 FD2890C5
46BA859E 6950720F 585E3D02 1BE7E7EB 1E450758 1E496631 2FF61BCD BEC5035F
FEBCB503 88E5D05B 2A0262F7 CE0471CD AA8E3027 487730E0 F78BE317 BBFB4B67
4C130203 010001A3 66306430 0F060355 1D130101 FF040530 030101FF 30110603
551D1104 0A300882 06537769 74636830 1F060355 1D230418 30168014 A195FE1A
E1181495 C0D78655 DE8FA75D 8EBBA017 301D0603 551D0E04 160414A1 95FE1AE1
181495C0 D78655DE 8FA75D8E BBA01730 0D06092A 864886F7 0D010104 05000381
8100D556 C2170C0D FDD8DE80 40B96CBF 7D63D893 A6480140 D1A16E36 FB10A6A8
C626DCC6 62066503 002CD936 573C6A08 0F618DAF 5791F89A 0759E261 6E4E2E6F
062430D8 E6B7D922 1EADA08E 4BB3D45E E9744A8C 74F2CEBC AA442D6A EDEB7446
B05C4335 A8E40C8B E8175A36 6A11A057 9D8323BA 42F7214E C93A16F4 EED8C496 3D90
quit
diagnostic bootup level minimal
spanning-tree mode pvst
spanning-tree extend system-id
hw-switch switch 1 logging onboard message level 3
!
redundancy
mode sso
!
!
!
class-map match-any non-client-nrt-class
!
policy-map port_child_policy
class non-client-nrt-class
bandwidth remaining ratio 10
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Port-channel1
!
interface GigabitEthernet0/0
vrf forwarding Mgmt-vrf
ip address 192.168.1.2 255.255.255.0
negotiation auto
!
interface GigabitEthernet1/0/1
description Uplink to Firewall to TimeWarner
switchport mode access
!
interface GigabitEthernet1/0/2
!
interface GigabitEthernet1/0/3
description was to fiber transceiver in room west of W1
!
interface GigabitEthernet1/0/4
!
interface GigabitEthernet1/0/5
description long haul to box room (west) into 5 port switch
switchport mode trunk
!
interface GigabitEthernet1/0/6
!
interface GigabitEthernet1/0/7
!
interface GigabitEthernet1/0/8
!
interface GigabitEthernet1/0/9
switchport mode access
!
interface GigabitEthernet1/0/10
!
interface GigabitEthernet1/0/11
switchport access vlan 3
switchport mode access
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/0/13
switchport mode access
!
interface GigabitEthernet1/0/14
!
interface GigabitEthernet1/0/15
!
interface GigabitEthernet1/0/16
!
interface GigabitEthernet1/0/17
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
!
interface GigabitEthernet1/0/20
!
interface GigabitEthernet1/0/21
!
interface GigabitEthernet1/0/22
!
interface GigabitEthernet1/0/23
switchport mode trunk
channel-group 1 mode auto
!
interface GigabitEthernet1/0/24
switchport mode trunk
channel-group 1 mode auto
!
interface GigabitEthernet1/1/1
!
interface GigabitEthernet1/1/2
!
interface GigabitEthernet1/1/3
!
interface GigabitEthernet1/1/4
!
interface TenGigabitEthernet1/1/1
!
interface TenGigabitEthernet1/1/2
!
interface TenGigabitEthernet1/1/3
!
interface TenGigabitEthernet1/1/4
!
interface Vlan1
ip address 192.168.1.3 255.255.255.0
ip helper-address 192.168.1.3
!
interface Vlan2
ip address 192.168.2.2 255.255.255.0
ip helper-address 192.168.2.1
standby 10 ip 192.168.2.1
standby 10 timers msec 200 msec 750
standby 10 preempt delay minimum 300
!
interface Vlan3
ip address 192.168.3.2 255.255.255.0
ip helper-address 192.168.3.1
standby 30 ip 192.168.3.1
standby 30 timers msec 200 msec 750
standby 30 preempt delay minimum 300
!
interface Vlan4
ip address 192.168.4.2 255.255.255.0
ip helper-address 192.168.4.1
standby 40 ip 192.168.4.1
standby 40 timers msec 200 msec 750
standby 40 preempt delay minimum 300
!
interface Vlan5
ip address 192.168.5.1 255.255.255.0
!
interface Vlan13
ip address 192.168.13.1 255.255.255.0
!
ip forward-protocol nd
no ip http server
ip http secure-server
ip route 0.0.0.0 0.0.0.0 192.168.1.1
ip route 192.168.1.0 255.255.255.0 Vlan1
ip route 192.168.2.0 255.255.255.0 Vlan2
ip route 192.168.3.0 255.255.255.0 Vlan3
ip route 192.168.4.0 255.255.255.0 Vlan4
!
!
!
!
!
line con 0
exec-timeout 0 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
password 275woodward
login
line vty 5 15
password 275woodward
login
!
wsma agent exec
profile httplistener
profile httpslistener
!
wsma agent config
profile httplistener
profile httpslistener
!
wsma agent filesys
profile httplistener
profile httpslistener
!
wsma agent notify
profile httplistener
profile httpslistener
!
!
wsma profile listener httplistener
transport http
!
wsma profile listener httpslistener
transport https
!
ap group default-group
end
答案1
以太网通道设置不完整。从 PAgP 切换到 LACP。此链接有帮助。
本质上，我的一端配置不完整。检查并重建每个交换机上的 int PO1（使用 LACP 而不是 PAgP）解决了这个问题。效果很好。