Archive for January, 2009


Posted: January 28, 2009 in LINUX, Linux Server
Tags: ,

Howto: Configure Linux Virtual Local Area Network 


VLAN is an acronym for Virtual Local Area Network. Several VLANs can co-exist on a single physical switch, which are configured via software (Linux commands and configuration files) and not through hardware interface (you still need to configure switch).

Hubs or switch connects all nodes in a LAN and node can communicate without a router. For example, all nodes in LAN A can communicate with each other without the need for a router. If a node from LAN A wants to communicate with LAN B node, you need to use a router. Therefore, each LAN (A, B, C and so on) are separated using a router.

VLAN as a name suggest combine multiple LANs at once. But what are the advantages of VLAN?

  • Performance
  • Ease of management
  • Security
  • Trunks
  • You don’t have to configure any hardware device, when physically moving server computer to another location etc.

VLAN concepts and fundamental discussion is beyond the scope of this article. I am reading following textbooks. I found these textbooks extremely useful and highly recommended:

  • Cisco CNNA ICND books (part I and II)
  • Andrew S. Tanenbaum, Computer Networks book

Linux VLAN Configuration Issue

I am lucky enough to get couple of hints from our internal wiki docs :D.

  • Not all network drivers support VLAN. You may need to patch your driver.
  • MTU may be another problem. It works by tagging each frame i.e. an Ethernet header extension that enlarges the header from 14 to 18 bytes. The VLAN tag contains the VLAN ID and priority. See Linux VLAN site for patches and other information.
  • Do not use VLAN ID 1 as it may be used for admin purpose.

Linux VLAN How To

My VLAN ID is 5. So I need to copy file /etc/sysconfig/network-scripts/ifcfg-eth0 to /etc/sysconfig/network-scripts/ifcfg-eth0.5

# cp /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0.5
Now, I’ve one network card (eth0) and it needs to use tagged network traffic for VLAN ID 5.

  • eth0 – Your regular network interface
  • eth0.5 – Your virtual interface that use untagged frames

Do not modify /etc/sysconfig/network-scripts/ifcfg-eth0 file. Now open file /etc/sysconfig/network-scripts/ifcfg-eth0.5 using vi text editor:
# vi /etc/sysconfig/network-scripts/ifcfg-eth0.5
Find DEVICE=ifcfg-eth0line and replace with:
Append line:
Also make sure you assign correct IP address using DHCP or static IP. Save the file. Remove gateway entry from all other network config files. Only add gateway to /etc/sysconfig/network file. Save and close the file. Restart network:
# /etc/init.d/network restart
Please note that if you need to configure for VLAN ID 2 then copy the copy file /etc/sysconfig/network-scripts/ifcfg-eth0 to /etc/sysconfig/network-scripts/ifcfg-eth0.2 and do the above procedure again.

Using vconfig command

Above method is perfect and works with Red hat Enterprise Linux / CentOS / Fedora Linux without any problem. However, you will notice that there is a command called vconfig. The vconfig program allows you to create and remove vlan-devices on a vlan enabled kernel. Vlan-devices are virtual ethernet devices which represents the virtual lans on the physical lan.

Please note that this is yet another method of configuring VLAN. If you are happy with above method no need to read below.

Add VLAN ID 5 with follwing command for eth0:
# vconfig add eth0 5

The vconfig add command creates a vlan-device on eth0 which result into eth0.5 interface. You can use normal ifconfig command to see device information:
# ifconfig eth0.5
Use ifconfig to assign IP address to vlan interfere :
# ifconfig eth0.5 netmask broadcast up
Get detailed information about VLAN interface:
# cat /proc/net/vlan/eth0.5
If you wish to delete VLAN interface delete command:
# ifconfig eth0.5 down
# vconfig rem eth0.5

A VLAN is a “Virtual Local Area Network” and is present in L2 (Level 2) of the protocal stack.

A host may be a server, workstation or other device which conforms to 802.1q specification. Therefore, it is possible (with certain limitations) to attach a laptop to a VLAN seen by a server.

802.1q provides for an additional 4-bytes of information added to the L2 frame, 12 bits of which indicate the VLAN is. Thus one may have 4K VLANs.

When you want to configure a VLAN in Linux, assuming your kernel supports it (2.6+ do) you need to make sure 802.1q support is available. This is most easily done with modprobe. So the command:

/sbin/modprobe 8021q

should do the trick.

Then, for any given NIC interface you only have to do the following:

/sbin/vconfig add eth
/sbin/ifconfig eth. 192.168.0.x netmask

Of course I just picked some arbitrary class C address, you would have to use what is appropriate for you.

You may need then to add to the routing table (not knowing what Linux you are running) something like:

/sbin/route add -net netmask eth.


Virtual LAN configuration

You can create a VLAN on Linux by executing the following commands:
vconfig add
ifconfig . netmask
ifconfig . up

For example:
vconfig add eth0 6
ifconfig eth0.5 netmask
ifconfig eth0.6 up

You can view the traffic of that VLAN by executing the following command:

cat /proc/net/vlan/eth0.6

like you can configure 2048 VLANs for one physical interface.

Advantages of VLANs

VLANs provide a number of benefits to a network designer. The first advantage is the number of devices required to implement a given network topology can be reduced. Without VLANs, if your network design requires ten machines divided into five different LANs, you would need five different switches or hubs, and most of the ports would be wasted. With VLANs, this work could be done with one device.

Most routers and standard computers can support a limited number of physical network interfaces. Although dual and quad-port Ethernet adapters are available, these are expensive. For example, a quad-port Ethernet card may cost $400. VLAN capable switches start at around $500, but they support many more interfaces.

Depending on the scenario, VLANs and trunks can provide an effective way of segmenting a network without the expense and complexity of managing many physical interfaces.