S5130V2（汇聚）+ S7003x(核心)核心能通监控，但是监控显示不上线
- 0关注
- 0收藏，91浏览
问题描述：
当汇聚插上核心，客户反应监控离线，但是我在核心去ping离线监控的地址是通的，把汇聚交换机拔了，客户说监控恢复正常，没拔的会监控出现断链
配置问题。检查下业务VLAN
<JK-HX>dis cu # version 7.1.070, Release 7748P01 # sysname JK-HX # telnet server enable # multicast forwarding-mode default # ip unreachables enable ip ttl-expires enable # lldp global enable # system-working-mode standard password-recovery enable # vlan 1 # vlan 10 # stp global enable # interface NULL0 # interface Vlan-interface1 # interface Vlan-interface10 ip address 192.168.1.1 255.255.255.0 ip address 10.110.1.254 255.255.254.0 sub ip address 192.168.0.1 255.255.255.0 sub ip address 192.168.2.1 255.255.255.0 sub ip address 192.168.10.251 255.255.255.0 sub # interface GigabitEthernet0/0/1 port link-mode bridge port link-type trunk port trunk permit vlan all # interface GigabitEthernet0/0/2 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/3 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/4 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/5 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/6 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/7 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/8 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/9 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/10 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/11 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/12 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/13 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/14 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/15 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/16 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/17 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/18 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/19 port link-mode bridge port link-type trunk port trunk permit vlan all # interface GigabitEthernet0/0/20 port link-mode bridge port link-type trunk port trunk permit vlan all # interface GigabitEthernet0/0/21 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/22 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/23 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet0/0/24 port link-mode bridge port access vlan 10 stp edged-port # interface GigabitEthernet1/0/1 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/2 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/3 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/4 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/5 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/6 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/7 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/8 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/9 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/10 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/11 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/12 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/13 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/14 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/15 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/16 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/17 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/18 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/19 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/20 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/21 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/22 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/23 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/24 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/25 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 # interface GigabitEthernet1/0/26 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/27 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 10 # interface GigabitEthernet1/0/28 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/29 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/30 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/31 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/32 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/33 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/34 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/35 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/36 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/37 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/38 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/39 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/40 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/41 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/42 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/43 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/44 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/45 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/46 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/47 port link-mode bridge port access vlan 10 # interface GigabitEthernet1/0/48 port link-mode bridge port access vlan 10 # interface M-GigabitEthernet0/0/0 # interface Ten-GigabitEthernet0/0/25 port link-mode bridge # interface Ten-GigabitEthernet0/0/26 port link-mode bridge # interface Ten-GigabitEthernet0/0/27 port link-mode bridge # interface Ten-GigabitEthernet0/0/28 port link-mode bridge # scheduler logfile size 16 # line class console user-role network-admin # line class vty authentication-mode scheme user-role network-admin user-role network-operator protocol inbound ssh # line con 0 user-role network-admin # line vty 0 15 authentication-mode scheme user-role level-15 user-role network-operator # line vty 16 63 user-role network-operator # ip route-static 0.0.0.0 0 192.168.10.1 # ssh server enable # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage password hash $h$6$rI2cpTKExZZjDQzN$FRPpH7zpRNSrtMrC9ttV3c+VtZuVwl+RVQnASkJ8sp2sABGC4MHlJuzCDWzgw1wphD3ZlGfbPV7qpDWVAKiVUw== service-type telnet http https ssh terminal authorization-attribute user-role level-15 authorization-attribute user-role network-admin authorization-attribute user-role network-operator password-control length 8 undo password-control complexity user-name check # ip https enable # return <JK-HX> dis ll n l Chassis ID : * -- -- Nearest nontpmr bridge neighbor # -- -- Nearest customer bridge neighbor Default -- -- Nearest bridge neighbor Local Interface Chassis ID Port ID System Name GE0/0/1 eccd-4cce-f800 GigabitEthernet0/0/1 BGW-Core GE0/0/11 b42e-99e0-c966 b42e-99e0-c966 - GE1/0/1 78a1-3e75-7a80 GigabitEthernet1/0/28 H3C GE1/0/3 78a1-3e75-8920 GigabitEthernet1/0/28 H3C GE1/0/5 78a1-3e75-88d8 GigabitEthernet1/0/28 H3C GE1/0/7 78a1-3e75-8800 GigabitEthernet1/0/28 H3C GE1/0/9 78a1-3e75-d948 GigabitEthernet1/0/28 H3C GE1/0/11 78a1-3e75-d750 GigabitEthernet1/0/28 H3C GE1/0/13 78a1-3e75-8140 GigabitEthernet1/0/28 H3C GE1/0/15 78a1-3e75-fcb8 GigabitEthernet1/0/28 H3C GE1/0/17 78a1-3e76-0600 GigabitEthernet1/0/28 H3C GE1/0/19 78a1-3e76-0570 GigabitEthernet1/0/28 H3C GE1/0/21 7081-853c-5890 GigabitEthernet1/0/28 H3C GE1/0/26 7081-853c-b5a8 GigabitEthernet1/0/28 H3C GE1/0/28 7081-853c-3e20 GigabitEthernet1/0/27 H3C GE1/0/30 7081-853d-43b0 GigabitEthernet1/0/28 H3C GE1/0/32 7081-853c-7930 GigabitEthernet1/0/28 H3C GE1/0/34 7081-856b-ab80 GigabitEthernet1/0/27 H3C GE1/0/36 7081-853c-c1c0 GigabitEthernet1/0/27 H3C GE1/0/38 7081-853c-b950 GigabitEthernet1/0/27 H3C GE1/0/40 7081-853c-be60 GigabitEthernet1/0/27 H3C
[汇聚交换机]dis cu # version 7.3.28, Release 3507P18 # sysname 汇聚交换机 # irf mac-address persistent timer irf auto-update enable undo irf link-delay irf member 1 priority 1 # dns server 114.114.114.114 # lldp global enable # password-recovery enable pex working-mode switch slot 1 # vlan 1 # vlan 10 # stp global enable # interface NULL0 # interface Vlan-interface1 dhcp client identifier ascii 44760996dc3d-VLAN0001 ipv6 address dhcp-alloc # interface Vlan-interface10 ip address 192.168.1.254 255.255.255.0 ip address 10.110.0.254 255.255.254.0 sub # interface GigabitEthernet1/0/1 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/2 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/3 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/4 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/5 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/6 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/7 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/8 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/9 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/10 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/11 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/12 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/13 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/14 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/15 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/16 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/17 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/18 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/19 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/20 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/21 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/22 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/23 port access vlan 10 stp edged-port # interface GigabitEthernet1/0/24 port link-type trunk port trunk permit vlan 1 10 # interface GigabitEthernet1/0/25 # interface GigabitEthernet1/0/26 # interface GigabitEthernet1/0/27 # interface GigabitEthernet1/0/28 # scheduler logfile size 16 # line class aux user-role network-admin # line class vty authentication-mode scheme user-role network-admin user-role network-operator protocol inbound ssh # line aux 0 user-role network-admin # line vty 0 63 user-role network-operator # ip route-static 0.0.0.0 0 192.168.1.1 # ssh server enable # arp user-ip-conflict record enable # radius scheme system user-name-format without-domain # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage password hash $h$6$pIkQm0LluQitk1Dm$ETQNKjXzJPKeB5xpx/H1r9cv9pouBEbOYYFL/7goNg/9E6Bg8vZqYOniXVfHGtmeLfSqqiBlb7DaZofa+NH2Hw== service-type telnet http https ssh authorization-attribute user-role network-admin password-control length 4 password-control composition type-number 1 type-length 1 undo password-control complexity user-name check # local-user clouduser class manage password hash $h$6$hqhhsI48RlJHhtDy$wIdafgomz2vHgVMjd/flp0FazT/KlT455A9NzWTqcm3aAR/JF8dpGTJy7JSVfw2whcskAAQEQDkYtQr0h24cVA== service-type http authorization-attribute user-role network-admin # security-enhanced level 1 # netconf soap http enable # ip http enable ip https enable # smartmc tc enable # cloud-management server domain oasis.h3c.com # return
配置是啥问题
组网是怎么接的，怎么接一根到汇聚就断了？我怀疑是IP冲突了，汇聚这一边有和监控一样的IP。
打开你的电脑，在浏览器输入知了社区，找到这个帖子，要么在别人下面评论，要么点我名字。
汇聚插核心上面的，汇聚插监控这些设备
1. 检查STP状态
在S5130V2和S7003X上执行：
display stp brief
display stp abnormal-port
确认根桥是否合理（核心应为根桥），是否存在端口被阻塞或频繁切换。若汇聚与核心间存在多链路且未做聚合，可能引发环路。
2. 检查端口流量和广播抑制
在汇聚上联核心端口执行：
display interface brief
display counters rate inbound interface GigabitEthernet x/x/x
观察广播/组播速率是否异常。监控业务对广播敏感，风暴会导致心跳超时。建议在汇聚和核心全局开启：
broadcast-suppression pps 1000
multicast-suppression pps 1000
3. 检查VLAN和网关配置
确认监控VLAN在汇聚和核心上透传一致，且网关在核心上。执行：
display vlan brief
display ip routing-table <监控网段>
若汇聚上错误配置了同网段IP或VLAN接口，可能引起ARP冲突。
4. 检查是否有私接设备或环路
汇聚接入后触发，可能下联存在环路。在汇聚上执行：
display loopback-detection
若未开启，建议全局开启环路检测：
loopback-detection enable vlan all
loopback-detection action shutdown
5. 抓包确认
在核心连接汇聚端口镜像抓包，查看是否有大量ARP请求或重复报文。若监控使用ONVIF/RTSP，风暴会导致信令丢失。
快速恢复建议：
临时在汇聚上联核心端口配置风暴抑制，并开启STP边缘端口（若下联接终端）。
检查汇聚下联是否有环回，优先物理排查。
若仍异常，请提供拓扑和STP状态输出进一步分析。
上行 Trunk VLAN 配置不一致（最高概率）
S5130V2 汇聚上联 S7003X 核心 Trunk：
- 监控业务 VLAN 没有正确允许通过；或者 PVID 本征 VLAN 两边不匹配；
核心交换机本机发出 ping 报文可以被 CPU 处理回复；但终端（NVR / 监控平台）发出的 TCP 业务报文跨设备转发异常，监控心跳报文丢包，平台判定设备离线。
排查命令（汇聚 S5130V2）
display current‑configuration interface GigabitEthernet 1/0/x #上联核心的接口
display port trunk
确认监控业务 VLAN 在 Trunk 的permitted vlan列表中，本征 PVID 两边核心、汇聚必须一致。
2、STP 生成树环路 / 端口被阻塞
S5130V2 汇聚存在二层环路，上联口被 STP 阻塞，ICMP 从核心 CPU 直接回应能通，但是终端之间 TCP 业务转发被阻断。
display stp brief
如果汇聚上联核心端口角色为
ALTERNATE（替代端口、阻塞状态），业务报文被丢弃，就会出现本故障现象。
- 处理：梳理拓扑，破除二层环路，调整 STP 优先级，保证上联端口为 FORWARDING 转发状态。
3、回包路径不一致（路由不对称）
S7003X 做三层网关，监控摄像头网关在 S7003X Vlanif；但是监控设备侧存在双网卡 / 错误静态网关。
- 核心设备本机 ping 监控设备：请求从核心发出，监控设备回包可以回来，ping 通；
- NVR / 监控平台（别的网段）访问监控：请求走 S7003X‑>S5130V2，监控设备回包不走 S5130V2 这条上行，走别的路径，来回路径不一致，TCP 会话异常，监控心跳断，设备离线。
测试验证：在 S7003X 核心，指定源 Vlanif 网关 IP 去 ping 监控设备，而不是交换机本身源 IP。
ping -a 监控网段网关IP 监控摄像头IP
如果带源 ping 丢包，就确认是来回路径不一致问题。 解决：监控摄像头只配置唯一正确网关，删除多余静态路由。
4、S5130V2 汇聚存在 ACL、端口隔离、风暴抑制
- 汇聚交换机下联监控端口配置了
port‑isolate端口隔离；或者 ACL 过滤监控业务 TCP 报文，但是没有拦截 ICMP ping 报文。
display port‑isolate
display acl all
display interface GigabitEthernet 1/0/x | include storm‑constrain
风暴抑制阈值过小，监控大流量视频报文被丢弃，ping 小包放行，视频心跳丢包平台判定离线。
5、MTU/MSS 问题，监控大报文分片异常
监控业务 TCP 报文大包分片异常；ICMP ping 小包正常；TCP 大数据报文丢包，监控心跳保活报文异常离线。
可以长 ping 测试大包：
ping -l 1472 监控IP
大包 ping 丢包，小包正常，就是 MTU 问题。
6、MAC 地址漂移
S5130V2 汇聚下联网络存在 MAC 漂移，监控摄像头 MAC 在端口频繁漂移，平台心跳报文时通时断，离线。
display mac‑address flapping record
快速定位测试步骤（现场执行）
- S7003X 核心上，使用监控网段的 Vlanif 源 IP ping 监控设备：
ping -a 监控网关IP 监控IP- 带源 ping 不通：优先排查 Trunk VLAN、STP、ACL；
- 带源 ping 通，但是 NVR 平台还是离线：排查路由回包路径、MTU、监控设备网关配置。
- 查看 S5130V2 上联口
display stp brief确认端口为 FORWARDING 转发，不是阻塞状态。 - 确认 S5130V2 上联 Trunk 允许监控业务 VLAN 通过，PVID 两边一致。
- 检查汇聚是否开启端口隔离、风暴抑制过高，丢弃监控视频大报文。
- 检查监控摄像头 / NVR，确认只有唯一网关，不存在多网关、多余静态路由。
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
点我头像