ситуация такая. Если комп у клиента является распростанителем вирусов - он определяется в Vlan 100 но остаётся с тем-же статическим IP адресом. Клиент должен иметь доступ к странице личной статистики и странице локального сайта. Смена IP клиента не предусматривается.Пытаюсь создать такое от ARP-sppofing, а то сеть ложится на ура :(
Тоесть насколько я понял, мне нужно поднять мост между VLAN1 и VLAN100 ?
___________________________________________
Sticky Interfaces
If a bridge member interface is marked as sticky then dynamically learned address entries are treated at static once entered into the forwarding cache. Sticky entries are never aged out of the cache or replaced, even if the address is seen on a different interface. This gives the benefit of static address entries without the need to pre-populate the forwarding table, clients learnt on a particular segment of the bridge can not roam to another segment.
Another example of using sticky addresses would be to combine the bridge with VLANs to create a router where customer networks are isolated without wasting IP address space. Consider that CustomerA is on vlan100 and CustomerB is on vlan101. The bridge has the address 192.168.0.1 and is also an internet router.
# ifconfig bridge0 addm vlan100 sticky vlan100 addm vlan101 sticky vlan101
# ifconfig bridge0 inet 192.168.0.1/24
Both clients see 192.168.0.1 as their default gateway and since the bridge cache is sticky they can not spoof the MAC address of the other customer to intercept their traffic.
Any communication between the VLANs can be blocked using private interfaces (or a firewall):
# ifconfig bridge0 private vlan100 private vlan101
The customers are completely isolated from each other, the full /24 address range can be allocated without subnetting.
_______________________________________________________
Как думаете моможет мне эта штука?
Нужно-ли прописывать ip адреса Vlan-ам?
Рабочий конфиг должен быть такой?
xl1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=48<VLAN_MTU,POLLING>
ether 00:60:08:36:60:3d
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST,NEEDSGIANT> mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
inet6 ::1 prefixlen 128
inet 127.0.0.1 netmask 0xff000000
vlan1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 00:60:08:36:60:3d
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
vlan: 1 parent interface: xl1
vlan100: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 00:60:08:36:60:3d
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
vlan: 100 parent interface: xl1
ifconfig bridge0 addm vlan1 sticky vlan1 addm vlan100 sticky vlan100
ifconfig bridge0 inet 192.168.0.1/24
Вариант для распечатки
Маршрутизаторы CISCO и др. оборудование. (Public)
(??) on 05-Июл-08, 12:22 
