How do you put a Linux server on a VLAN trunk?
Show the answer
Say this first
Create a VLAN subinterface on top of the physical NIC, one per VLAN:
ip link add link ens192 name ens192.10 type vlan id 10, then put the address on ens192.10. The 8021q
module tags outgoing frames and sorts incoming tagged frames to the right subinterface. The switch port
must be a trunk carrying those VLANs. Untagged frames still arrive on the parent ens192.
Go deeper
Runtime
ip link add link ens192 name ens192.10 type vlan id 10
ip addr add 10.10.0.21/24 dev ens192.10
ip link set ens192 up
ip link set ens192.10 up$ ip -d link show ens192.10
5: ens192.10@ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 00:50:56:a1:2b:3c brd ff:ff:ff:ff:ff:ff promiscuity 0 ...
vlan protocol 802.1Q id 10 <REORDER_HDR> ...@ens192 names the parent. The VLAN interface uses the parent's MAC.
Persistent, netplan
network:
version: 2
ethernets:
ens192: {}
vlans:
ens192.10:
id: 10
link: ens192
addresses: [10.10.0.21/24]Details
- The VLAN interface MTU defaults to the parent's and cannot exceed it. The NIC carries the 4-byte tag.
- QinQ:
ip link add link ens192 name ens192.100 type vlan proto 802.1ad id 100, then a second 802.1Q VLAN on top of it. - The interface name is free text;
ens192.10is a convention.
They will ask next
Pings in VLAN 10 fail but the parent interface works untagged. Where do you look?
The switch port: is it a trunk, is VLAN 10 allowed, is the native VLAN what you expect. On the host,
tcpdump -i ens192 -nn -e vlan 10shows whether tagged frames leave and come back.How does this differ from a VLAN-aware bridge?
A VLAN interface makes the host itself a member of that VLAN. A VLAN-aware bridge switches frames for other devices (VMs, containers) between ports. Hypervisors use the bridge; plain servers use VLAN interfaces.
Traps
- Configuring VLAN interfaces against an access port. The switch drops or untags the frames.