![]() | Register | FAQ | Members | Social Groups | User Map | Calendar | Search | Today's Posts | Mark Forums Read |
*nix
*nix forum sponsored by |
| | | LinkBack | Thread Tools | Search Thread | Language |
| Sponsored Links |
| | #1 |
![]() Join Date: Jun 2005 Location: Fylde, Lancs, UK.
Posts: 9,839
Thanks: 41
Thanked 217 Times in 198 Posts
Blog Entries: 1 Rep Power: 64 | I recently wanted to see if I could educate Linux about VLAN tagging and dispense with the multiple network card approach we've used in the past. Mainly because it's more elegant and I loath wasting hardware and Gigabit switch ports when I don't need to. Happily it worked, so here's how I did it. Disclaimer: These instructions work for Ubuntu 6.06 LTS. If your using another distro (specifcally something not based on debian) these instructions wont work. However they should point you in enough of the right direction to get it going. Prequesites VLAN support is actually a kernel feature, if you don't have it compiled it, it's not going to work. Check this before you continue. For reference, I'm using the 'linux-server' meta package on Ubuntu, which does support this. If your doing a kernel compile, the option that enables 802.1Q VLAN support is found under the Networking options. You also need the usermode configuration tool 'vconfig'. This is avalible in the package 'vlan' on debian based distros. So simply apt-get it. If you can't use this package you can get the source and compile it yourself from here. The vlan package also installed some configuration scripts that hook into the standard network interface ifup/ifdown scripts. If your not using the vlan package, you'll have to cook up your own. Switch Configuration Obviously the machine will needed to be plugged into a port on a switch that supports VLANs. This usually means using one of the more expensive managed switches. Unfortunately I can't give instructions for every possible switch that supports VLANs so I'll just give a generic overview and a specific example using a ProCurve 2650 via its console (its inadvisable to configure VLANs via telnet or the web interface, if you get something wrong you're likely to lose access to the switch). Generally on switches supporting VLANs there are two configuration areas related to them. A global configuration that assigns numeric VLAN IDs to some easily recognizable name. So for example you might have: VLAN ID 1 = DEFAULT_VLAN (*) VLAN ID 2 = CURRICULUM VLAN ID 3 = ADMIN * VLAN 1 is special. It's the only VLAN that will let you communicate with the switches management interface. Thus it's best not to use it other than for infrastructure management. Once the VLANs are configured you can assign them to specific ports on the switch. There's three possible states for a port for each VLAN. Untagged member Any data traveling over this port with no VLAN information attached will be tagged with this VLAN ID. You generally use this when you have a device that isn't configured for VLANs and you only want it to be a member of one VLAN. A end client PC for example. Tagged member Data travelling over this port with VLAN information attached for the VLAN ID listed as a tagged member will be forwarded on. Any data with no VLAN information attached (untagged as above) or VLAN IDs that have not been configured for use with the port will be dropped. Non-member The port isn't a member of this VLAN. It will never get any data sent using the VLAN ID. Configuration of the ProCurve The ProCurves have a lot of extra features when it comes to VLANs. However I'm only going to show the basics here. Firstly I log into the switch and enter the configuration context. Code: ProCurve J4899B Switch 2650
Firmware revision H.08.98
Copyright (C) 1991-2006 Hewlett-Packard Co. All Rights Reserved.
RESTRICTED RIGHTS LEGEND
Use, duplication, or disclosure by the Government is subject to restrictions
as set forth in subdivision (b) (3) (ii) of the Rights in Technical Data and
Computer Software clause at 52.227-7013.
HEWLETT-PACKARD COMPANY, 3000 Hanover St., Palo Alto, CA 94303
We'd like to keep you up to date about:
* Software feature updates
* New product announcements
* Special events
Please register your products now at: www.ProCurve.com
Password: *******
Code: ProCurve Switch 2650# configure Code: ProCurve Switch 2650(config)# vlan 2 name CURRICULUM ProCurve Switch 2650(config)# vlan 3 name ADMIN Code: ProCurve Switch 2650(config)# primary-vlan 2 Code: ProCurve Switch 2650(config)# vlan 1 tagged 49 50 ProCurve Switch 2650(config)# vlan 2 tagged 49 50 ProCurve Switch 2650(config)# vlan 3 tagged 49 50 Now for the purposes of this HOWTO, our Linux base server is going to be in port 10. We want it to communicate on both VLAN 2 and 3. So we have a couple of options here. We can either just add port 10 as a tagged member to VLAN 3 and leave untagged data going to VLAN 2. Or we can set port 10 to be a tagged member of both VLAN 2 and 3. Personally I find this second option to be more understandable (especially from Linux). However I'll provide examples for both here and later in the Linux section. Option A: Mixed tagged and untagged port. By default the swtich will send untagged data out on VLAN 2 so we don't have to do anything about it (see above). Code: ProCurve Switch 2650(config)# vlan 3 tagged 10 You'll notice this is exactly what we did for our uplink ports (Minus the management VLAN). Code: ProCurve Switch 2650(config)# vlan 2 tagged 10 Code: ProCurve Switch 2650(config)# vlan 3 tagged 10 Debian based distro configuration For host configuration, we also need to know the ip addressing schemes being used. For the purposes of this HOWTO. We shall assume that the CURRICULUM VLAN is using hte address range 192.168.200.0/24 and the Linux machine has been assigned the address 192.168.200.10. The default router is 192.168.200.1 for this network. We shall assume the ADMIN VLAN is using the address range 192.168.300.0/24 and the Linux machine has been assigned the address 192.168.300.10. We will not use the router available on this VLAN. On debian based systems. The init scripts for networking control the VLAN assignment for interfaces. They require that a virtual interface is created for each VLAN the system will be a member of. This is done by naming the interface as 'vlanXX' (where XX is the VLAN ID) in /etc/interfaces/networks. Additionally each VLAN interface must be assigned to a physical interface with the 'vlan_raw_device' keyword. Configurations wil differ at this point depending on if you chose to use Mixed or Explicit port tagging. Option A: Mixed Tagged Port In this configuration, the default network interface will be used to generate untagged traffic. So eth0 can be configured as normal Additionally a vlan3 interface must be configured to generate tagged traffic for VLAN ID 3 (ADMIN). Code: # The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
iface eth0 inet static
address 192.168.200.10
netmask 255.255.255.0
gateway 192.168.200.1
# VLAN interface for ADMIN (VLAN 3)
auto vlan3
iface vlan3 inet static
address 192.168.300.10
netmask 255.255.255.0
vlan_raw_device eth0
In this configuration, the default network interface will left un-configured. The vlan2 interface will be configured to generate traffic for VLAN ID 2 (CURRICULUM). The vlan3 interface configuration is identical to before. Code: # The loopback network interface
auto lo
iface lo inet loopback
# VLAN interface for CURRICULUM (VLAN 2)
auto vlan2
iface vlan2 inet static
address 192.168.200.10
netmask 255.255.255.0
gateway 192.168.200.1
vlan_raw_device eth0
# VLAN interface for ADMIN (VLAN 3)
auto vlan3
iface vlan3 inet static
address 192.168.300.10
netmask 255.255.255.0
vlan_raw_device eth0
Finishing Up You can either reboot or run '/etc/init.d/networking restart'. Just be aware that existing network services will also need restarting to pickup the changes if you only restart networking. Once everything is back up and running, you can verify the new network interfaces are configured correctly. You can do this either with 'ifconfig' or you can examine the contents of the files in '/proc/net/vlan'. The 'config' file lists vlan to physical interface mappings and each 'vlanxx' file lists VLAN specific statistics. |
| |
| |
| | ||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| FreeRadius MAC authentication/dynamic VLANs | localzuk | *nix | 3 | 19-10-2007 09:28 AM |
| Vlans | strawberry | Networks | 2 | 04-10-2007 02:09 PM |
| VLANs/ Subnets help | Ste_Harve | Networks | 19 | 25-06-2007 12:42 PM |
| HOWTO: Validate Linux as Microsoft Genuine Software | Geoff | *nix | 3 | 18-06-2007 02:51 PM |
| Question about VLans.............help? | Kyle | Windows | 11 | 06-11-2006 01:48 PM |
| Tags |
| linux, procurve, vlans |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | Search Thread |
|
|







