华为supervlan（聚合vlan）技术背景与组网实验
一 技术背景
1. Super VLAN技术产生背景
一般的三层交换机中，通常是采用一个VLAN对应一个vlanif接口的方式实现广播域之间的互通，这在某些情况下导致了IP地址的浪费。因为一个VLAN对应的子网中，子网号、子网定向广播地址、子网缺省网关地址不能用作VLAN内的主机IP地址，且子网中实际接入的主机可能少于编址数，多出来的IP地址也会因不能再被其他VLAN使用而浪费掉。
如下VLAN规划中，VLAN2预计未来有10个主机地址的需求，但按编址方式，至少需要给其分配一个掩码长度是28的子网10.1.1.0/28，其中10.1.1.0为子网号，10.1.1.15为子网定向广播地址，10.1.1.1为子网缺省网关地址，这三个地址都不能用作主机地址，剩下范围在10.1.1.2～10.1.1.14的地址可以被主机使用，共13个。VLAN2子网实际地址需求只有10个，剩余的3个也不能再被其他VLAN使用。网络中的VLAN越多，浪费的IP地址也就越多。
为了解决上述问题，VLAN聚合应运而生。它通过引入Super-VLAN和Sub-VLAN的概念，使每个Sub-VLAN对应一个广播域，并让多个Sub-VLAN和一个Super-VLAN关联，只给Super-VLAN分配一个IP子网，所有Sub-VLAN都使用Super-VLAN的IP子网和缺省网关进行三层通信。
这样，多个Sub-VLAN共享一个网关地址，节约了子网号、子网定向广播地址、子网缺省网关地址，且各Sub-VLAN间的界线也不再是从前的子网界线了，它们可以根据各自主机的需求数目在Super-VLAN对应子网段灵活的划分IP地址范围，从而保证了各个Sub-VLAN作为一个独立广播域实现广播隔离，又节省了IP地址资源，提高了编址的灵活性。
Super-VLAN技术主要目的是减少IP地址浪费。
2. Super VLAN概念
Super VLAN，也叫VLAN聚合（VLAN Aggregation）指在一个物理网络内，用多个VLAN（称为Sub-VLAN）隔离广播域，并将这些Sub-VLAN聚合成一个逻辑的VLAN（称为Super-VLAN）。Super VLAN可以配置三层接口，Sub VLAN不能配置三层接口。所有Sub-VLAN共用一个IP网段，要进行三层通信时，将使用Super VLAN三层接口的IP地址作为网关地址，使用同一个缺省网关，并且可以通过Super VLAN的VLANIF接口实现三层互通。
3. Super VLAN应用场景
Super VLAN适用于用户多，VLAN多，大量VLAN的IP地址在同一个网段，但是又要实现不同VLAN之间二层隔离的场景。VLAN之间如果有互访的需求，可以对Super VLAN开启ARP代理。常见的场景有宾馆酒店，小区宽带接入等。一个房间或者一户人家一个VLAN，彼此隔离，但是IP地址有限，无法给数量庞大的VLAN每个分一个网段IP，只能共用一个IP地址段。例如，VLAN 10的IP地址段是10.10.10.0/24，一户人家可能就使用了1个或2个IP，剩余200多个IP地址浪费了。Super VLAN可以使VLAN11-100共享10.10.10.0/24网段，节约了IP地址。
与MUX VLAN隔离功能相比，Super VLAN属于三层功能，需要三层交换机支持。MUX VLAN属于二层交换机功能。Super VLAN的配置较为简单，MUX VLAN配置较为复杂，但对用户间的访问控制灵活性不如MUX VLAN，Super VLAN内需要查询部分暂时离线的用户时，网关需要在每个子VLAN内广播发送报文，可能较大的消耗设备CPU资源。
4. Super VLAN工作原理
通过建立Super--VLAN和Sub-VLAN间的映射关系，把三层逻辑接口和物理接口结合起来，实现普通VLAN功能的同时，也达到节省P地址的目的。
一个Super-VLAN可以包含一个或多个Sub-VLAN。
Sub-VLAN要添加端口才能激活，只要有一个子VLAN是激活的,那么SUPER VLAN就是激活的。
Sub-VLAN不占用一个独立的网段。
同一个Super-VLAN中，无论终端属于哪一个Sub-VLAN，它的IP地址都在Super-VLAN对应的网段内。
Super-VLAN：
只建立三层VlanIf接口（IP地址与网关对应），不包含物理接口。与普通VLAN不同的是，它的VlanIf接口的Up不依赖于自身物理接口的Up，而是只要它所含Sub-VLAN中存在Up的物理接口就Up；
负责实现所有Sub-VLAN共享同一个三层接口的需求，使不同Sub-VLAN内的主机可以共用同一个网关。
VLAN 1不能配置为Super VLAN。
Sub-VLAN：
只包含物理接口，不建立三层VlanIf接口，隔离广播域（Sub-VLAN间相互隔离），每个Sub-VLAN内的主机与外部的三层通信是靠Super-VLAN的三层VLANIF接口来实现的；
不同Sub-VLAN下的终端默认不能互通，如果要通信，需要在Super-VLAN的VLANIF接口上开启Proxy ARP（代理ARP）。
二 网络拓扑
三 配置实现
sysname HX
#
vlan batch 10 20 30 100 1000
#
vlan 100//supervlan
aggregate-vlan
access-vlan 10 20 30
#
interface Vlanif100
ip address 192.168.100.254 255.255.255.0
#
interface Vlanif1000//上联vlan和互联地址
ip address 1.1.1.1 255.255.255.0
#
interface GigabitEthernet0/0/1//上联vlan和互联地址
port link-type access
port default vlan 1000
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 10
#
interface GigabitEthernet0/0/3
port link-type trunk
port trunk allow-pass vlan 20
#
interface GigabitEthernet0/0/4
port link-type trunk
port trunk allow-pass vlan 30
#
ip route-static 0.0.0.0 0.0.0.0 1.1.1.2
#
四 业务测试
4.1 PC1测试
可以ping通网关，出口，但是无法ping通其他subvlan地址
PC>ping 192.168.100.254
Ping 192.168.100.254: 32 data bytes, Press Ctrl_C to break
From 192.168.100.254: bytes=32 seq=1 ttl=255 time=78 ms
--- 192.168.100.254 ping statistics ---
1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 78/78/78 ms
PC>
PC>ping 202.1.1.1
Ping 202.1.1.1: 32 data bytes, Press Ctrl_C to break
From 202.1.1.1: bytes=32 seq=1 ttl=254 time=94 ms
--- 202.1.1.1 ping statistics ---
1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 94/94/94 ms
PC>
PC>ping 192.168.100.2
Ping 192.168.100.2: 32 data bytes, Press Ctrl_C to break
From 192.168.100.1: Destination host unreachable
PC>
PC>ping 192.168.100.3
Ping 192.168.100.3: 32 data bytes, Press Ctrl_C to break
From 192.168.100.1: Destination host unreachable
PC>
4.2 PC2测试
可以ping通网关，出口，但是无法ping通其他subvlan地址
PC>ping 192.168.100.254
Ping 192.168.100.254: 32 data bytes, Press Ctrl_C to break
From 192.168.100.254: bytes=32 seq=1 ttl=255 time=93 ms
--- 192.168.100.254 ping statistics ---
1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 93/93/93 ms
PC>ping 202.1.1.1
Ping 202.1.1.1: 32 data bytes, Press Ctrl_C to break
From 202.1.1.1: bytes=32 seq=1 ttl=254 time=110 ms
From 202.1.1.1: bytes=32 seq=2 ttl=254 time=63 ms
--- 202.1.1.1 ping statistics ---
2 packet(s) transmitted
2 packet(s) received
0.00% packet loss
round-trip min/avg/max = 63/86/110 ms
PC>
PC>ping 192.168.100.1
Ping 192.168.100.1: 32 data bytes, Press Ctrl_C to break
From 192.168.100.2: Destination host unreachable
PC>
PC>ping 192.168.100.3
Ping 192.168.100.3: 32 data bytes, Press Ctrl_C to break
From 192.168.100.2: Destination host unreachable
PC>
4.3 PC3测试
可以ping通网关，出口，但是无法ping通其他subvlan地址
PC>
PC>ping 192.168.100.254
Ping 192.168.100.254: 32 data bytes, Press Ctrl_C to break
From 192.168.100.254: bytes=32 seq=1 ttl=255 time=47 ms
From 192.168.100.254: bytes=32 seq=2 ttl=255 time=32 ms
--- 192.168.100.254 ping statistics ---
2 packet(s) transmitted
2 packet(s) received
0.00% packet loss
round-trip min/avg/max = 32/39/47 ms
PC>
PC>
PC>ping 202.1.1.1
Ping 202.1.1.1: 32 data bytes, Press Ctrl_C to break
From 202.1.1.1: bytes=32 seq=1 ttl=254 time=62 ms
From 202.1.1.1: bytes=32 seq=2 ttl=254 time=47 ms
--- 202.1.1.1 ping statistics ---
2 packet(s) transmitted
2 packet(s) received
0.00% packet loss
round-trip min/avg/max = 47/54/62 ms
PC>
PC>ping 192.168.100.1
Ping 192.168.100.1: 32 data bytes, Press Ctrl_C to break
From 192.168.100.3: Destination host unreachable
PC>
PC>ping 192.168.100.2
Ping 192.168.100.2: 32 data bytes, Press Ctrl_C to break
From 192.168.100.3: Destination host unreachable
PC>
五 状态查看
5.1 核心状态查看
<HX>dis super-vlan
VLAN ID Sub-vlan
--------------------------------------------------------------------------------
100 10 20 30
<HX>
<HX>
<HX>
<HX>dis sub-vlan
VLAN ID Super-vlan
--------------------------------------------------------------------------------
10 100 //subvlan映射到supervlan，同时subvlan的端口映射给supervlan
20 100
30 100
<HX>
//subvlan映射到supervlan，同时subvlan的端口映射给supervlan，所以supervlan虽然无法添加接口，但是又subvlan映射过来的端口，vlan虚接口就会UP。
<HX>dis ip in b
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
The number of interface that is UP in Physical is 4
The number of interface that is DOWN in Physical is 1
The number of interface that is UP in Protocol is 3
The number of interface that is DOWN in Protocol is 2
Interface IP Address/Mask Physical Protocol
MEth0/0/1 unassigned down down
NULL0 unassigned up up(s)
Vlanif1 unassigned up down
Vlanif100 192.168.100.254/24 up up
Vlanif1000 1.1.1.1/24 up up
<HX>
六 supervlan的虚拟接口下开启arp代理arp-proxy inner-sub-vlan-proxy实现不同subvlan之间的互通
6.1 arp-proxy inner-sub-vlan-proxy配置
interface Vlanif100
ip address 192.168.100.254 255.255.255.0
arp-proxy inner-sub-vlan-proxyenable
6.2 业务测试-不同subvlan业务互通
6.2.1 PC1测试
PC>
PC>ping 192.168.100.2
Ping 192.168.100.2: 32 data bytes, Press Ctrl_C to break
From 192.168.100.2: bytes=32 seq=1 ttl=127 time=93 ms
From 192.168.100.2: bytes=32 seq=2 ttl=127 time=94 ms
--- 192.168.100.2 ping statistics ---
2 packet(s) transmitted
2 packet(s) received
0.00% packet loss
round-trip min/avg/max = 93/93/94 ms
PC>ping 192.168.100.3
Ping 192.168.100.3: 32 data bytes, Press Ctrl_C to break
From 192.168.100.3: bytes=32 seq=1 ttl=127 time=63 ms
From 192.168.100.3: bytes=32 seq=2 ttl=127 time=78 ms
--- 192.168.100.3 ping statistics ---
2 packet(s) transmitted
2 packet(s) received
0.00% packet loss
round-trip min/avg/max = 63/70/78 ms
PC>
6.2.2 PC2测试
PC>ping 192.168.100.1
Ping 192.168.100.1: 32 data bytes, Press Ctrl_C to break
From 192.168.100.1: bytes=32 seq=1 ttl=127 time=62 ms
--- 192.168.100.1 ping statistics ---
1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 62/62/62 ms
PC>ping 192.168.100.3
Ping 192.168.100.3: 32 data bytes, Press Ctrl_C to break
From 192.168.100.3: bytes=32 seq=1 ttl=127 time=63 ms
From 192.168.100.3: bytes=32 seq=2 ttl=127 time=47 ms
--- 192.168.100.3 ping statistics ---
2 packet(s) transmitted
2 packet(s) received
0.00% packet loss
round-trip min/avg/max = 47/55/63 ms
PC>
6.2.3 PC3测试
PC>ping 192.168.100.1
Ping 192.168.100.1: 32 data bytes, Press Ctrl_C to break
From 192.168.100.1: bytes=32 seq=1 ttl=127 time=78 ms
From 192.168.100.1: bytes=32 seq=2 ttl=127 time=46 ms
--- 192.168.100.1 ping statistics ---
2 packet(s) transmitted
2 packet(s) received
0.00% packet loss
round-trip min/avg/max = 46/62/78 ms
PC>ping 192.168.100.2
Ping 192.168.100.2: 32 data bytes, Press Ctrl_C to break
From 192.168.100.2: bytes=32 seq=1 ttl=127 time=46 ms
From 192.168.100.2: bytes=32 seq=2 ttl=127 time=63 ms
--- 192.168.100.2 ping statistics ---
2 packet(s) transmitted
2 packet(s) received
0.00% packet loss
round-trip min/avg/max = 46/54/63 ms
PC>