|
| 1 | +# VLAN Interfaces |
| 2 | + |
| 3 | +A VLAN interface is an interface stacked on top of another Linux interface |
| 4 | +that filters traffic for a single 802.1Q VID. `tcpdump` on a VLAN interface |
| 5 | +shows only frames matching that VID, compared to *all* VIDs when listening |
| 6 | +on the lower-layer interface. |
| 7 | + |
| 8 | + |
| 9 | + |
| 10 | +This page covers VLAN interfaces stacked on Ethernet, on a VLAN-filtering |
| 11 | +bridge, and on other VLAN interfaces. For VLAN handling *inside* a bridge |
| 12 | +(port VIDs, tagged/untagged membership, pvid), see [VLAN Filtering |
| 13 | +Bridge](bridging.md#vlan-filtering-bridge). |
| 14 | + |
| 15 | +## On Top of an Ethernet Interface |
| 16 | + |
| 17 | +A VLAN interface for VID 20 on top of an Ethernet interface `eth0` is by |
| 18 | +convention named `eth0.20`. |
| 19 | + |
| 20 | +<pre class="cli"><code>admin@example:/> <b>configure</b> |
| 21 | +admin@example:/config/> <b>edit interface eth0.20</b> |
| 22 | +admin@example:/config/interface/eth0.20/> <b>show</b> |
| 23 | +type vlan; |
| 24 | +vlan { |
| 25 | + tag-type c-vlan; |
| 26 | + id 20; |
| 27 | + lower-layer-if eth0; |
| 28 | +} |
| 29 | +admin@example:/config/interface/eth0.20/> <b>leave</b> |
| 30 | +</code></pre> |
| 31 | + |
| 32 | +The `tag-type` defaults to `c-vlan` (802.1Q customer VLAN, EtherType 0x8100). |
| 33 | +Set to `s-vlan` (802.1ad service VLAN, EtherType 0x88A8) to terminate an outer |
| 34 | +S-Tag. |
| 35 | + |
| 36 | +> [!TIP] |
| 37 | +> If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a |
| 38 | +> number, the CLI infers the interface type automatically. Otherwise |
| 39 | +> the type must be set explicitly. |
| 40 | +
|
| 41 | +## On Top of a Bridge |
| 42 | + |
| 43 | +When the lower-layer interface is a VLAN-filtering bridge, the VLAN interface |
| 44 | +gives the CPU an IP-addressable endpoint inside the bridged broadcast domain |
| 45 | +for that VID. This pattern is named `vlanN` by convention. |
| 46 | + |
| 47 | +<pre class="cli"><code>admin@example:/> <b>configure</b> |
| 48 | +admin@example:/config/> <b>edit interface vlan10</b> |
| 49 | +admin@example:/config/interface/vlan10/> <b>set vlan id 10</b> |
| 50 | +admin@example:/config/interface/vlan10/> <b>set vlan lower-layer-if br0</b> |
| 51 | +admin@example:/config/interface/vlan10/> <b>leave</b> |
| 52 | +</code></pre> |
| 53 | + |
| 54 | +The bridge `br0` must have VLAN 10 configured with the bridge itself as a |
| 55 | +tagged member. See [VLAN Filtering Bridge](bridging.md#vlan-filtering-bridge) |
| 56 | +for the bridge-side configuration. |
| 57 | + |
| 58 | +## Stacked (Q-in-Q) |
| 59 | + |
| 60 | +VLAN interfaces can be stacked. A VLAN interface whose lower-layer is itself |
| 61 | +a VLAN interface terminates the inner tag, leaving the outer tag for the |
| 62 | +parent to handle. |
| 63 | + |
| 64 | +<pre class="cli"><code>admin@example:/> <b>configure</b> |
| 65 | +admin@example:/config/> <b>edit interface eth0.10</b> |
| 66 | +admin@example:/config/interface/eth0.10/> <b>set vlan tag-type s-vlan</b> |
| 67 | +admin@example:/config/interface/eth0.10/> <b>leave</b> |
| 68 | +admin@example:/config/> <b>edit interface eth0.10.20</b> |
| 69 | +admin@example:/config/interface/eth0.10.20/> <b>show</b> |
| 70 | +type vlan; |
| 71 | +vlan { |
| 72 | + tag-type c-vlan; |
| 73 | + id 20; |
| 74 | + lower-layer-if eth0.10; |
| 75 | +} |
| 76 | +admin@example:/config/interface/eth0.10.20/> <b>leave</b> |
| 77 | +</code></pre> |
| 78 | + |
| 79 | +The summary view shows each VLAN row pointing at its immediate parent: |
| 80 | + |
| 81 | +<pre class="cli"><code>admin@example:/> <b>show interface</b> |
| 82 | +<span class="header">INTERFACE PROTOCOL STATE DATA </span> |
| 83 | +eth0.10 vlan UP vid: 10 |
| 84 | +│ ipv4 10.0.10.1/24 (static) |
| 85 | +└ eth0 |
| 86 | +eth0.10.20 vlan UP vid: 20 |
| 87 | +│ ipv4 10.0.10.20/28 (static) |
| 88 | +└ eth0.10 |
| 89 | +</code></pre> |
0 commit comments