Presentation of Vlans
If you’ve got a switch with vlan capabilities, at one point or another, you will want to add vlans to your network. Vlan stands for virtual local area network. It is a way to create separate virtual networks from a single physical one (see wikipedia for an in-depth explanation). In a typical production environment, you’ve got several vlans: one for console management, one for storage, one for backup, one for application flows, etc.
Vlans receive a number for identification between 0 and 4095. Avoid 0, 1 and 4095.
Normally, the number 1 is reserved for management. On some switches, it is not possible to change this configuration. Check your switch documentation for more details.
This separation is done through a mechanism called tagging. Each port of a switch is associated with a vlan. Each packet going into a switch through a port receives a tag containing the vlan number, telling from which vlan it is coming. This tag is removed when the packet leaves the switch. In the remaining of this tutorial we will use the 802.1Q standard.
If your server isn’t used as a router between vlans or if it doesn’t need to be connected to several vlans at the same time through the same cable, no additional configuration is required.
However, if it is a router or if it sees several vlans at the same time, your server needs to be connected to a special kind of port called a trunk. A trunk is a port of a switch where the tags are not removed. It is up to the server to remove them.
First, you will need to set up a trunk on the switch side. It’s only in a second stage that you will need to configure vlans on the server side.
Let’s assume that we configured a trunk on a switch dealing with two vlans:
- vlan number 10 called vlan10,representing the 192.168.10.0/24 network,
- vlan number 20 called vlan20, representing the 192.168.20.0/24 network.
We now want to connect our server to the trunk through the eth0 network interface with a cable.
To remove any previous configuration on the eth0 network interface, type:
# nmcli con del eth0
Note: It is important that there is no ip configuration on the main interface (no ip address, etc).
To create the two vlans on the eth0 network interface, type:
# nmcli con add type vlan con-name vlan10 dev eth0 id 10 Connection 'vlan10' (8275c94d-2dc7-4c6c-95fd-e64caec67850) successfully added. # nmcli con add type vlan con-name vlan20 dev eth0 id 20 Connection 'vlan20' (e10eea8c-ea4e-483a-8ceb-1669d2252106) successfully added.
To check the new configuration, type:
# nmcli con show NAME UUID TYPE DEVICE vlan20 e10eea8c-ea4e-483a-8ceb-1669d2252106 vlan -- vlan10 8275c94d-2dc7-4c6c-95fd-e64caec67850 vlan --
Now, you can configure the network interfaces as usual (look at the network configuration tutorial for more details):
# nmcli con mod vlan10 ipv4.addresses 192.168.10.1/24 # nmcli con mod vlan10 ipv4.gateway 192.168.10.1 # nmcli con mod vlan10 ipv4.method manual # nmcli con up vlan10 Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3) # nmcli con mod vlan20 ipv4.addresses 192.168.20.1/24 # nmcli con mod vlan20 ipv4.gateway 192.168.20.1 # nmcli con mod vlan20 ipv4.method manual # nmcli con up vlan20 Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/5)
Finally, to check the configuration, type:
# nmcli dev DEVICE TYPE STATE CONNECTION eth0.10 vlan connected vlan10 eth0.20 vlan connected vlan20 eth0 ethernet disconnected -- lo loopback unmanaged -- # nmcli con show NAME UUID TYPE DEVICE vlan20 e10eea8c-ea4e-483a-8ceb-1669d2252106 vlan eth0.20 vlan10 8275c94d-2dc7-4c6c-95fd-e64caec67850 vlan eth0.10
Note: You’ve got now two sub-interfaces called eth0.10 and eth0.20.
After this configuration, two new files have been created in the /etc/sysconfig/network-script directory and one removed (ifcfg-eth0):
VLAN=yes TYPE=Vlan PHYSDEV=eth0 VLAN_ID=10 REORDER_HDR=0 BOOTPROTO=none DEFROUTE=yes IPV4_FAILURE_FATAL=no IPV6INIT=yes IPV6_AUTOCONF=yes IPV6_DEFROUTE=yes IPV6_FAILURE_FATAL=no NAME=vlan10 UUID=8275c94d-2dc7-4c6c-95fd-e64caec67850 ONBOOT=yes IPADDR=192.168.10.1 PREFIX=24 GATEWAY=192.168.10.1 IPV6_PEERDNS=yes IPV6_PEERROUTES=yes
VLAN=yes TYPE=Vlan PHYSDEV=eth0 VLAN_ID=20 REORDER_HDR=0 BOOTPROTO=none DEFROUTE=yes IPV4_FAILURE_FATAL=no IPV6INIT=yes IPV6_AUTOCONF=yes IPV6_DEFROUTE=yes IPV6_FAILURE_FATAL=no NAME=vlan20 UUID=e10eea8c-ea4e-483a-8ceb-1669d2252106 ONBOOT=yes IPADDR=192.168.20.1 PREFIX=24 GATEWAY=192.168.20.1 IPV6_PEERDNS=yes IPV6_PEERROUTES=yes
Obviously, if you plan to route packets between your two network interfaces, type:
# echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf # sysctl -p
Note: Additional details about the sysctl command are available in the sysctl tutorial.