Pages

Sunday, January 5, 2014

802.1Q VLAN trunk in Linux

I need to configure an Ethernet interface as an IEEE 802.1q VLAN trunk on Linux Mint for Lab purposes so I can connect GNS3 with a physical Cisco Switch. So I will create 6 vlan interface using VLAN ID 101-106 on eth0 interface.


Install VLAN package

 sudo apt-get install vlan 


Load the 8021q kernel module

 sudo modprobe 8021q   

Check if the kernel module is loaded

 $ lsmod | grep 8021q  
 8021q         24353 0   
 garp          14313 1 8021q  
 mrp           18471 1 8021q   


Create VLAN interfaces

Use the vconfig tool to create virtual VLAN interfaces
 sudo vconfig add eth0 101   
 sudo vconfig add eth0 102   
 sudo vconfig add eth0 103   
 sudo vconfig add eth0 104   
 sudo vconfig add eth0 105   
 sudo vconfig add eth0 106  
This will create the virtual interfaces eth0.101 - eth0.106.
For example interface eth0.101 will be sending packets tagged with VID 101. Packets received on eth0 tagged with VID 101 will show up on eth0.101 as untagged packets. Only packets that were tagged with VID 101 will arrive on the VLAN interface.

Instead of using the (deprecated) "vconfig" command you can use the "ip link". For example:
ip link add link eth0 name eth0.101 type vlan id 101


To remove a VLAN interface
 sudo vconfig rem eth0.101   


Assign IP address on vlan interface

 sudo ip addr add 10.0.101.1/24 dev eth0.101   
 sudo ip addr add 10.0.102.1/24 dev eth0.102   
 sudo ip addr add 10.0.103.1/24 dev eth0.103   
 sudo ip addr add 10.0.104.1/24 dev eth0.104   
 sudo ip addr add 10.0.105.1/24 dev eth0.105   
 sudo ip addr add 10.0.106.1/24 dev eth0.106  


Detailed information about VLAN interface:
 $ sudo cat /proc/net/vlan/eth0.101  
 eth0.101 VID: 101      REORDER_HDR: 1 dev->priv_flags: 1  
      total frames received     1104  
      total bytes received    92424  
    Broadcast/Multicast Rcvd      51  
   
    total frames transmitted     1208  
     total bytes transmitted    131766  
 Device: eth0  
 INGRESS priority mappings: 0:0 1:0 2:0 3:0 4:0 5:0 6:0 7:0  
  EGRESS priority mappings:     


Permanent VLAN mapping

To preserve the vlan configuration when the system reboots we need to make sure that module 802.1q is loaded and that the interface vlan configuration exists.
Latter can be done in two ways, either make it permanent by editing the /etc/network/interfaces file OR run a script with the appropriate commands every time you need it.

To make sure that 802.1q module is loaded after a reboot we need to add the module to the /etc/modules.
 sudo su -c 'echo "8021q" >> /etc/modules'    


To check it:
 $ cat /etc/modules  
 # /etc/modules: kernel modules to load at boot time.  
 #  
 # This file contains the names of kernel modules that should be loaded  
 # at boot time, one per line. Lines beginning with "#" are ignored.  
 # Parameters can be specified after the module name.  
   
 lp  
 rtc  
 8021q   


A. Edit /etc/network/interfaces

To save the vlan interfaces and make them available when the system boots we need to edit file /etc/network/interfaces.
First make a backup of your /etc/network/interfaces file before making any changes.
 sudo cp /etc/network/interfaces /etc/network/interfaces.backup

 sudo nano /etc/network/interfaces   
 $ cat /etc/network/interfaces  
 # interfaces(5) file used by ifup(8) and ifdown(8)  
 # The loopback network interface  
 auto lo  
 iface lo inet loopback  
   
 # The primary network interface  
  allow-hotplug eth0  
  auto eth0  
  iface eth0 inet static  
  address 192.168.0.10  
  netmask 255.255.255.0  
  gateway 192.168.0.1  

 #add VLAN 101 on eth0  
 auto eth0.101  
 iface eth0.101 inet static  
  address  10.0.101.1
  netmask 255.255.255.0
   
 #add VLAN 102 on eth0  
 auto eth0.102  
 iface eth0.102 inet static  
  address 10.0.102.1
  netmask 255.255.255.0  
   
 #add VLAN 103 on eth0  
 auto eth0.103  
 iface eth0.103 inet static  
  address 10.0.103.1  
  netmask 255.255.255.0  
   
 #add VLAN 104 on eth0  
 auto eth0.104  
 iface eth0.104 inet static  
  address 10.0.104.1  
  netmask 255.255.255.0
   
 #add VLAN 105 on eth0  
 auto eth0.105  
 iface eth0.105 inet static  
  address 10.0.105.1  
  netmask 255.255.255.0  
   
 #add VLAN 106 on eth0  
 auto eth0.106  
 iface eth0.106 inet static  
  address 10.0.106.1  
  netmask 255.255.255.0  


B.Run a script

Run the following script manually every time is needed.
 #!/bin/bash   
 modprobe 8021q  
 # bring interfaces up  
 ifconfig eth0 down   
 ifconfig eth0 up   
    
 # setup vlans  
 vconfig add eth0 101   
 vconfig add eth0 102   
 vconfig add eth0 103    
 vconfig add eth0 104    
 vconfig add eth0 105    
 vconfig add eth0 106  
   
 ifconfig eth0.101 10.0.101.1 netmask 255.255.255.0 up  
 ifconfig eth0.102 10.0.102.1 netmask 255.255.255.0 up  
 ifconfig eth0.103 10.0.103.1 netmask 255.255.255.0 up  
 ifconfig eth0.104 10.0.104.1 netmask 255.255.255.0 up  
 ifconfig eth0.105 10.0.105.1 netmask 255.255.255.0 up  
 ifconfig eth0.106 10.0.106.1 netmask 255.255.255.0 up 

Restart your network interface:
 sudo service networking restart    


Cisco Switch Configuration

 interface FastEthernet0/1  
  description --Trunk to Linux--  
  switchport trunk encapsulation dot1q  
  switchport mode trunk  
  no ip address  
  spanning-tree bpdufilter enable  
  spanning-tree bpduguard enable  
 !  
 interface Vlan101  
  ip address 10.0.101.254 255.255.255.0  
 !  
 interface Vlan102  
  ip address 10.0.102.254 255.255.255.0    



Verifying

We can verifying by pinging from Linux computer to the vlan SVI interfaces on the cisco switch
 ping 10.0.101.254 -c 5; ping 10.0.102.254 -c 5    

Using tcpdump on interface eth0 we see that packets are passing with the VLAN ID tagged
 sudo tcpdump -i eth0 -n -e vlan  
   
 14:27:10.001070 00:1f:c6:75:58:8b > 00:0f:8f:05:b6:00, ethertype 802.1Q (0x8100), length 102: vlan 101, p 0, ethertype IPv4, 10.0.101.1 > 10.0.101.254: ICMP echo request, id 4796, seq 1, length 64 
 14:27:14.003204 00:1f:c6:75:58:8b > 00:0f:8f:05:b6:00, ethertype 802.1Q (0x8100), length 102: vlan 102, p 0, ethertype IPv4, 10.0.102.1 > 10.0.102.254: ICMP echo request, id 4797, seq 1, length 64  



Using tcpdump on the vlan interface eth0.101 or eth0.102 we see that packets are passing with VLAN ID untagged
 sudo tcpdump -i eth0.101 -n -e  
   
 14:35:50.792633 00:1f:c6:75:58:8b > 00:0f:8f:05:b6:00, ethertype IPv4 (0x0800), length 98: 10.0.101.1 > 10.0.101.254: ICMP echo request, id 4834, seq 1, length 64  
 14:35:50.793104 00:0f:8f:05:b6:00 > 00:1f:c6:75:58:8b, ethertype IPv4 (0x0800), length 98: 10.0.101.254 > 10.0.101.1: ICMP echo reply, id 4834, seq 1, length 64  


 sudo tcpdump -i eth0.102 -n -e  
   
 14:39:26.003155 00:1f:c6:75:58:8b > 00:0f:8f:05:b6:00, ethertype IPv4 (0x0800), length 98: 10.0.102.1 > 10.0.102.254: ICMP echo request, id 4839, seq 1, length 64  
 14:39:26.003589 00:0f:8f:05:b6:00 > 00:1f:c6:75:58:8b, ethertype IPv4 (0x0800), length 98: 10.0.102.254 > 10.0.102.1: ICMP echo reply, id 4839, seq 1, length 64  


Similarly sending packets from the switch SVI interface to the Linux computer we also see the packets with VLAN ID tagged on physical interface eth0.
 SW#ping 10.0.101.1  
 SW#ping 10.0.102.1  


 sudo tcpdump -i eth0 -n -e vlan  
   
 14:40:30.946055 00:1f:c6:75:58:8b > 00:0f:8f:05:b6:00, ethertype 802.1Q (0x8100), length 118: vlan 101, p 0, ethertype IPv4, 10.0.101.1 > 10.0.101.254: ICMP echo reply, id 5569, seq 5160, length 80  
 14:40:35.458061 00:1f:c6:75:58:8b > 00:0f:8f:05:b6:00, ethertype 802.1Q (0x8100), length 118: vlan 102, p 0, ethertype IPv4, 10.0.102.1 > 10.0.102.254: ICMP echo reply, id 835, seq 4155, length 80  



And packets captured on vlan interfaces on Linux computer have VLAN ID untagged
 sudo tcpdump -i eth0.101 -n -e  
   
 14:49:18.062039 00:0f:8f:05:b6:00 > 00:1f:c6:75:58:8b, ethertype IPv4 (0x0800), length 114: 10.0.101.254 > 10.0.101.1: ICMP echo request, id 2560, seq 8314, length 80  
 14:49:18.062077 00:1f:c6:75:58:8b > 00:0f:8f:05:b6:00, ethertype IPv4 (0x0800), length 114: 10.0.101.1 > 10.0.101.254: ICMP echo reply, id 2560, seq 8314, length 80  


 sudo tcpdump -i eth0.102 -n -e  
   
 14:49:37.390147 00:0f:8f:05:b6:00 > 00:1f:c6:75:58:8b, ethertype IPv4 (0x0800), length 114: 10.0.102.254 > 10.0.102.1: ICMP echo request, id 4021, seq 3229, length 80  
 14:49:37.390187 00:1f:c6:75:58:8b > 00:0f:8f:05:b6:00, ethertype IPv4 (0x0800), length 114: 10.0.102.1 > 10.0.102.254: ICMP echo reply, id 4021, seq 3229, length 80  


Reference :
GNS3 website on Direct VLAN mapping option
VLANs on Linux
VLAN Support in Linux
wiki.ubuntu for VLAN
Debian Network Configuration

9 comments:

Anonymous said...

Hi Mate, I dont know to thank you but you have sure made my day. I have been looking for an article like this. I am trying to run a virtual router inside my ESXhost rinning on a G7. This I think is going to be a life saver and help trim down the bill. I will give it a go.

Homelab said...

Thanks and good luck. Hope it helps.

Unknown said...
This comment has been removed by the author.
Anonymous said...

First, thanks for a very helpful article. I have a few additional quesions. First, please explain what you meant by, "The ip addresses are not be necessary but will help for troubleshooting purposes" in the Assign IP Addresses on VLAN Interface section. Also, when giving the instructions to make this permanent, you showed how to modify the /etc/interfaces file and used address and netmask of 0.0.0.0 instead of the IP addresses used in the previous section. What was the reason for that? Thanks again...I greatly appreciate your input!!

Homelab said...

Hi , thanks for spoting my mistake on missing the IP addresses. It is a mistake and I remove that comment. For the specific example an IP address is very well needed. I also fix the /etc/network/interfaces adding IP addresses.

Priya Anvartha said...

Hi, This is informative. Do you have any idea on how to send snmp traffic to specific virtual interface.
Eg: eth0.101 is virtual interface and need to send snmptrap out with this vlanid

Unknown said...

i'm missing something...
my hookup: cisco switch f0/1 <-----> eth0 Linux mint
did everything u suggested but not able to ping from either sides
not using gns3 .. just the straight hookup from switch to linux

Unknown said...

nvm.. it worked.. just had to reboot the linux box..service networking restart didn restart... thanks for the effort!

Homelab said...

Hi Ray,
Great that you solve the problem.
thanks and good luck!