《网络架构和网络规划.ppt》由会员分享，可在线阅读，更多相关《网络架构和网络规划.ppt（77页珍藏版）》请在三一办公上搜索。
1、网络架构和网络规划,园区网络基本架构,园区网络传统的基本架构,Collision Domain 1,Collision Domain 2,Broadcast Domain,Bridges terminate collision domains,3,Performance Issues,Multicast,broadcast,and unknown destination events become global events,Server A,I need to know the MAC address for Server A,4,Broadcast Issues,Broadcasts ca
2、n consume all available bandwidthEach device must decode the broadcast frame,Server A,5,Solution:Localizing Traffic,LAN broadcasts terminate at the router interface,6,Solution:Localizing Traffic(Cont.),VLAN3,VLAN2,VLAN1,VLANs contain broadcast traffic and separate traffic flows,7,VLAN7,VLAN6,VLAN5,C
3、urrent Campus Networks,VLAN3,VLAN2,VLAN1,VLAN10,VLAN9,VLAN8,Layer 3 devices interconnect LAN segments while still containing broadcast domains,8,The New 20/80 Rule,20 percent of the traffic is local;80 percent is remote,VLAN3,VLAN2,VLAN1,20%Local Traffic,20%Local Traffic,20%Local Traffic,80+%Remote
4、Traffic,9,Emerging Campus Structure,Remote Services,Enterprise Services,Local Services,Traffic patterns dictate the placement of services,80%Non-Local Traffic,10,Local Services,Devices connected by switchesTraffic within the same subnet/VLANTraffic does not cross the backbone,11,Remote Services,Devi
5、ces connected by routersTraffic crosses subnet/VLANSegregated by Layer 3Traffic may/may not cross the backbone,12,Enterprise Services,Common to all usersTraffic crosses subnet/VLANTraffic crosses the backbone Segregated by Layer 3May be grouped by Layer 2,13,Layer 2 Switching,Data Link,Hardware-base
6、d bridgingWire-speed performanceHigh-speed scalabilityLow latencyMAC addressLow cost,7654321,14,Impact of Layer 2 Switching,Layer 2 switched networks have the same characteristics as bridged networks,15,Benefits of Routing,Broadcast controlMulticast controlOptimal path determinationTraffic managemen
7、tLogical addressingLayer 3 security,E0,E1,E0,E1,16,7654321,Layer 3 Switching,Network Layer,Hardware-based packet forwardingHigh-performance packet switching High-speed scalabilityLow latencyLower per-port costFlow accountingSecurityQoS,17,Multilayer Switching,Transport Layer,7654321,Data Link,Networ
8、k Layer,Combines functionality of:Layer 2 switchingLayer 3 switchingLayer 4 switchingHigh-speed scalabilityLow latency,网络规划基本层次结构,19,Network Structure Defined by Hierarchy,Distribution Layer,Core Layer,AccessLayer,20,Access Layer,Entry point to the networkShared bandwidthLayer 2 servicesFilteringVLA
9、N membership,Access Layer,21,Distribution Layer,Access aggregation pointWorkgroup services accessBroadcast domains definitionInterVLAN routingMedia translationSecurity,Distribution Layer,22,The Core Layer,Fast transportNo Layer 3 processing,Core Layer,23,Distribution Layer,Core Layer,Access Layer,Ch
10、oosing a Cisco Product,C4xxx,C5xxx,C3550,C2950,Catalyst 2950/3550/3750 50 portsCatalyst 4000/4500Catalyst 5000/5500,Catalyst 4500Catalyst 6500,Catalyst 65xx,24,The Building Block Approach,Building A,SwitchBlock,Building B,Building C,CoreBlock,ServerBlock,WAN Block,Mainframe Block,25,LocalEvent,The S
11、witch Block,Switch Block 1,Switch Block 2,Access Layer,Distribution Layer,Access Layer,Distribution Layer,Broadcast storms are contained to a switch block,26,Switch Block Characteristics,Support one or more subnets/VLANsSubnets terminate at the distribution switchAccess devices have redundant linksS
12、panning tree terminates at the switch block boundary,27,Sizing the Switch Block,Type of trafficNumber of usersGeographic scope of subnetsSize of spanning-tree domains,28,The Core Block,A core is required when there are two or more switch blocks,29,Core Block Characteristics,Supports frame,packet,or
13、cell;subnets terminate at the coreLayer 2 or Layer 3 devicesDistribution to core links should scale n*100 MBpsSupports various configurationsProvides redundant paths for each switch block,30,A Collapsed Core,Switch Block 2,Access Layer,Distribution/Core Layer,Switch Block 1,Access Layer,Distribution
14、/Core Layer,Core Connectivity,Core Connectivity,31,Switch Block 2,Access Layer,Distribution/Core Layer,Switch Block 1,Access Layer,Distribution/Core Layer,Core Connectivity,Core Connectivity,A Collapsed Core(Cont.),32,The Dual Core,Switch Block 2,Switch Block 1,Core Block,Subnet A,Subnet B,33,The Du
15、al Core(cont.),Switch Block 2,Switch Block 1,Core Block,Subnet A,Subnet B,34,Sizing the Core,Routing protocol limitationsNumber of distribution switchesNumber of equal-cost links,35,Layer 2 Backbone Scaling,Spanning tree prohibits core interconnectionsEqual-cost path limits number of independent cor
16、e switches,36,Layer 3 Backbone Scaling,Fast convergenceLoad balancingNo peering problemsPerformance/cost issues,37,Campus Network Example,M1,M2,M,P1,P2,P,X,Y,A,B,C,North Building,South Building,D,38,Campus Network Example(cont.),M1,M2,M,P1,P2,P,X,Y,A,B,C,North Building,South Building,D,39,Campus Net
17、work Example(cont.),M1,M2,M,P1,P2,P,X,Y,A,B,C,North Building,South Building,D,40,Campus Network Example(cont.),M1,M2,M,P1,P2,P,X,Y,A,B,C,North Building,South Building,D,思科的 LAN 交换产品系列,可堆叠，小型尺寸 中型端口密度 无阻塞千兆位密度：12 L2-L4交换 集群管理 外部冗余电源,最高交换容量 最高端口密度 可选服务模块 高可用性状态故障恢复 冗余Supervisor，结构 10千兆位以太网接口 无阻塞千兆位密度：
18、142 LAN/WAN接口（到OC-48）L2-L7交换 集成化线内电源 集成化冗余电源,服务和密度,高交换容量 冗余Supervisor 高密度10/100/1000 高密度100FX和1000LX 无阻塞千兆位密度：32 LAN/WAN接口（T1/E1）L2-L4交换 集成化线内电源 集成化冗余电源,Catalyst 2950/3550,Catalyst 4500,Catalyst 6500,部署Catalyst:企业园区/数据中心,Catalyst 产品线最新信息,Catalyst 6500Catalyst 4500,Catalyst 6500系列主要特色,多功能性可扩展性高可用性,最高
19、交换容量：256Gbps 720Gbps线速 L3,L4-7服务:MPLS,IPv6,NSF/SSO,防火墙,IDS,SSL,VPN,NAM,内容交换最高密度平台10/100和GE-578个GE端口IPv6硬件转发MPLS上的任意传输集成化数据中心功能完全语音集成到OC-48的光服务,Catalyst 6500 系列,高速Catalyst 6500,6506/9/13 插槽机箱Sup II/MSFC-2、Sup720每插槽16 Gbps/40Gbps256/720Gbps 交叉背板实施16端口GE XBar实施48端口10/100 XBar16/48端口10/100/1000 XBar 电信级
20、应用OSM光服务模块集成化服务模块,256/720Gbps Up to 210/400 Mpps,分布层/核心层重点,无缝线卡兼容性：布线室-核心一致的CatOS和IOS版本,Cisco Catalyst 6500的发展,32Gb/s6Mpps L3高密度10/100QoS,1999 2000 2001 20022003,720Gb/s 400Mpps L3集成于引擎上的交叉背板可提供高级的基于CEF的硬件IP服务多端口无阻塞10GbE 高密度数据中心和布线室 10/100/1000应用,NEW,Catalyst 6500 系列 可扩展、模块化机箱,3插槽机箱每7机架高达11个机箱适用于城域、
21、WAN和小型布线室6插槽机箱 适用于中等密度的布线室和骨干网9插槽水平机箱适用于高密度布线室和骨干网,9插槽垂直机箱为电信运营商中央办公室和POP提供更高NEBS第3级兼容性、垂直插槽和前后空气流通13插槽机箱最高性能和密度，凭借多个服务/WAN模块针对高密度布线室和骨干网优化,Catalyst 6500 Supervisor选项Sup 1A、Sup 2、Sup 720,Supervisor 1A高达15Mpps L2转发注重布线室Supervisor 230-210Mpps L2/3 转发性能和 256Gb/s 结构布线室和分布层,Catalyst 6500 更新Supervisor 720
22、&PFC3A,Supervisor 720,智能服务Enhances Operational Control with ERSPAN*and User Based Rate LimitingApplication DeliveryHardware Bi-directional PIM Hardware NAT/PATSupports 256K Hardware RoutesEvolutionary InfrastructureSupported in all Catalyst 6500 SystemsSupports CatOS and Cisco IOS,Policy Feature Car
23、d 3A,服务 Hardware IPv6,MPLS,NAT,GRE密度 Integrated Switch Fabric性能 400Mpps/720Gbps 交换背板，40Gbps/slot投资保护 Supports all existing modules,Catalyst 6500更新Supervisor 720 Advanced Intelligent Services,Supervisor 720,L3 DSCP MarkingL2 Classification and MarkingUser based Microflow PolicingDSCP to MPLS EXP Mapp
24、ingPort Based Access ControlEncapsulated Remote SPAN*ACL Based RPFHardware Bi-Directional PIM,Sup720,IPv6 CEF in Hardware*IPv4 CEF in Hardware IPv6 EtherChannel*IPv4 NAT in HardwareH/W based MPLS*-MPLS VPN-MPLS P/PE-MPLS TE-EoMPLSGRE and IP in IP TunnellingWCCP v2*Support 256K+IPv4 routesSupport 128
25、K+IPv6 routesSupport 255 HSRP Groups,NEW,WS-X6502-10GEWS-G6483,WS-X6502-10GEWS-G6488,Serial 1550nm 长达40km，用于超长距离园区间和POP间连接,Serial 1310nm-长达 10km，适用于中等距离的建筑物间、短距离机架间连接,Catalyst 6500提供了业界第一款发售的10GbE和第一款标准 10GbE,Catalyst 6500 LAN连接 10GbE模块,Catalyst 6500 更新高性能 2-port 10 GigE 模块,Intelligent ServicesDeep
26、150ms buffers/interface for DWDM interconnection and more32 Queues,Multiple ThresholdsEvolutionary InfrastructureIncreases 10GbE Port DensitySupported in any Catalyst 6500 with Sup720Interoperable with all modules,Flexible Modular 10GbE Optics SC fiber optic connector Long Range 10km SMF Extended Ra
27、nge 40km SMF LX4 300m MMF(Future),2 port 10Gb EthernetdCEF720 Series,Services dCEF IPv6,dCEF MPLS,and morePerformance Non-Blocking 40Gb/s per SlotApplication Aggregation,SONET ReplacementInvestment Protection Industry Standard Modular Optics,NEW,WS-X6802-10GE,企业布线室的应用方案,高可用性 无中断转发最高密度的 10/100和10/100
28、/1000集成化网络分析模块集成化入侵检测系统全服务语音联网普通备件和操作管理远程站点可生存性,Cisco SAFE:可实现集成化网络安全性的架构框架,SAFE 为安全服务提供深入防御方式SAFE 在网络基础设施中集成入安全性 SAFE 将安全性与智能“网络”服务集成SAFE 通过路由器和交换机中的应用和集成化安全性提供SAFE扩展后包括Catalyst 6500 系列,风险降低,高,低,全新,应用和服务集成,网络基础设施,识别服务,外设安全性,安全连接,入侵检测和保护,安全管理和监控,Catalyst 6500 防火墙模块集成数据中心,扩展到应用防火墙外 PIX产品线实现可操作性一致软件 高
29、性能防火墙 集成化第3层路由在数据中心、互联网接入、互联网数据中心和外部网站点部署独立部署或作为安全系统部署可将数据中心平均销售额提高20WS-SVC-FWM-1-K9,千兆位网络分析模块,集成化VOIP监控扩展了AVVID网络基础设施的价值监控功能将 Cisco Catalyst 交换平台与竞争对手明显区分开来通过企业分布层和布线室实现最优部署无缝交换集成确保了简单、有效的部署强有力的竞争个性化,交换集成网络分析模块，用于全流量监控和纠错,Catalyst 6500系列集成企业数据中心,致密机箱，带LAN连接,CSM,防火墙,SSL,数据中心解决方案全路由全交换集成化服务,可用插槽,防火墙,
30、3插槽机箱,防火墙解决方案全互联网路由(BGP,MPLS)智能交换集成化防火墙,可用插槽,VPN,3插槽机箱,VPN 解决方案全路由全交换集成化VPN集成化IDS,集成数据中心,Catalyst 6513Supervisor Engine 2/MSFC 2完全第3层互联网路由丰富的L2功能套件高性能转发智能网络层服务,Firewall Module,SSL Module,NAM,CSM,VPN Module,Catalyst 产品线最新信息,Catalyst 6500Catalyst 4500 Catalyst 3750Catalyst 3550/2950,Cisco Catalyst 400
31、0 系列的发展,Catalyst 4500系列 实现对多业务融合网络的控制,可扩展、可预测、线速性能48 Mpps第2/3/4层 Cisco快速转发智能服务:细化QoS增强安全性可管理性集成化弹性Supervisor冗余性1+1 电源冗余性增强IP电话支持 无与伦比的投资保护,Cisco Catalyst 4000 可扩展架构,推出Supervisor IV,构建于 Supervisor III基础之上48 Mpps L2/L3/L4 线速，带ACL和QoS，任意分组大小 在 Catalyst 4507R机箱中实现冗余性支持可选 NetFlow 服务模块 更快控制面板更大DRAM 512MB(
32、256)更快CPU 333MHz(300)更快内存 133MHz(100)Catalyst 4500机箱系列上完全兼容与Catalyst 4006向后兼容,可选NetFlow 服务模块,可持续48 Mpps L2/3/4，实现ACL、QoS、Netflow和冗余性!,Catalyst 4500 机箱系列,HSRPRPR 故障恢复PortFastUplinkFast BackboneFast线卡上的以太通道MISTP802.1w802.1sPAgP 负载均衡热插拔 Supervisor热插拔PSU热插拔模块高MTBF,Catalyst 4500系列 提供集成化高可用性,1+1电源弹性,双系统时钟
33、,无源背板,用于优化 MTBR的模块化架构,高可用性特性:,冗余Supervisor Engine,Catalyst 4507R冗余性,新4507R 机箱，带2个专用Supervisor插槽Supervisor IV 将支持RPR，实现Catalyst 4507R中的冗余性1分钟内容完成故障恢复(取决于配置),Catalyst 4507R canbe deployed with a single SupervisorRedundancy can be enabled by adding second supervisor,Catalyst 6500,Stateful failover无业务中断
34、软件升级2-3秒Supervisor 故障恢复Stateful 生成树Stateful L3转发stateful端口安全性Staeful CAM表Stateful ACLStateful QoSStateful WAN接口,Catalyst上的高可用性,Catalyst 4500,可堆叠解决方案,1分钟故障恢复HSRPRPR故障恢复快速生成树多模块以太通道多生成树负载均衡热插拔 Supervisor热插拔PSU热插拔模块,交换集群Ether-Channel快速生成树,Cisco HA基础,MISTP802.1w802.1sPAgP 负载均衡热插拔高 MTBF,HSRPRPR 故障恢复PortF
35、astUplinkFast BackboneFastEthernetChannel 弹性,Supervisor III/IV 新软件特性,冗余支持(RPR)(仅限Supervisor IV)安全特性MAC ACL/VLAN映射L4 ACL增强802.1x 端口安全性DHCP窃听,IPX/Appletalk4K VLAN支持更少MAC使用率802.1s+802.1wSPAN Src 方向混合 PVLANs 独立中继Baby GiantsQinQ 通过中继上的IGMP过滤附加SNMP支持,Catalyst 4000 系列LAN安全特性,用于用户级验证的802.1x安全 Telnet 和 SNMPv
36、3 对管理流量加密线速 ACL 限制网络的敏感部分 DHCP Interface Tracker 可在网络上定位用户并防止窃听MAC 地址通知可提醒管理员新用户的到来专用VLAN 边缘隔离交换机上的端口 RADIUS 和 TACACS+实现对 交换机的集中控制,新安全特性,802.1x交换LAN,需802.1x客户机,布线室,RADIUS,802.1x,DHCP Interface Tracker(选项 82),跟踪用户物理连接至网络之处，向DHCP服务器提供交换机和端口ID,通过允许RADIUS服务器验证用户，许可/禁止其接入网络来保护网络接入,线速L4 ACL,包括基于VLAN和基于路由器
37、的访问控制列表，以助于接受或拒绝对网络敏感部分的访问,线速性能，实现安全特性！,Catalyst 4500 Supervisor 选项,中小型L3分布层/核心冗余性中型密度 GbE可持续L3转发L3/L4 智能服务集成化WAN 网络安全性,布线室冗余性智能服务10/100/1000 端口密度 IP 电话集成,企业分支机构冗余性10/100/1000 端口密度 智能服务集成化WANIP电话网络安全性,Catalyst 4500 企业部署,网络架构和网络规划,广域网设计基础,家庭用户,PSTN,IP WAN,Internet,分部,传统的广域网络互联方式,总部,电话拨号、宽带接入,电话拨号,电话拨
38、号,DDN、F.R.专线,DDN、F.R.专线,电话拨号,经济安全的学校广域网络连接-VPN,分支机构,POP,路由器,或,VPN接入集中器（路由器）,VPN接入集中器（PIX）,总部,远程用户,拨号或宽带接入,宽带或专线接入,宽带或专线接入,宽带或专线接入,VPN 通道,VPN 通道,虚拟专网(VPN)通过安全加密的技术将企业的私有网络经由一个开放的公共网络比如因特网互联在一起；,网络互联的新方法：VPN,网络与网络之间的VPN连接传统WAN的扩展,远程网络,POP,远程分支机构,路由器,或,VPN接入集中器路由器,VPN接入集中器PIX,总部,VPN设备路由器或防火墙,VPN设备路由器或防火墙,POP,ADSLcable,POP,合作院校,家庭办公,接入网络的新方法：远程接入VPN,远程接入用户,路由器,Internet,或,远程接入VPN 传统电话拨号联网 方式的扩展与革新,VPN接入集中器路由器,VPN接入集中器PIX,总部,
