Hi,

I'm trying to configure a linux machine to have multiple VLANs on eth0. The computer is plugged into a Cisco 3550, and the port on the switch is trunked.

I am using Mandriva 2006, and it does include vlan utilities, read: vconfig

Let me tell you what I want, and where I'm at.

For starters, I have two VLANs: 127 and 254. On the 127 VLAN, the IP address is to be configured statically. On the 254 VLAN, the IP address should be returned from a DHCP server.

/etc/network:
HOSTNAME=host.whatever.com
NETWORKING=yes
VLAN=yes

/etc/sysconfig/network-scripts/ifcfg-eth0:
DEVICE=eth0
ONBOOT=yes
MII_NOT_SUPPORTED=yes
USERCTL=no

/etc/sysconfig/network-scripts/ifcfg-eth0.127:
DEVICE=eth0.127
BOOTPROTO=static
IPADDR=192.168.127.1
NETMASK=255.255.255.0
NETWORK=192.168.127.0
BROADCAST=192.168.127.255
ONBOOT=yes

/etc/sysconfig/network-scripts/ifcfg-eth0.254:
DEVICE=eth0.254
BOOTPROTO=dhcp
ONBOOT=yes
DHCP_CLIENT=dhclient

I guess a starting question would be, do I need ifcfg-eth0? is it correct?

DHCP does not work for VLAN 254, no address is assigned. VLAN 127 has a static address, but I am unable to ping other hosts on the 127 VLAN.

Do I need to change the scripts around? or maybe I need to modify ifup? the scripts after a onceover appear to be set up to do VLANs, but I don't know what I am missing.

Any help would be appreciated

Regards

John Morris

Did you use vconfig to create?

Here is one link. http://www.linuxhorizon.ro/vlans.html
Also goto http://www.google.com/linux and use ' multiple vlan eth0 ' as your search option.
Lots of links there.

Brian1

Brian,

Thanks I had seen a few of those pages after doing a search and none had the information I needed. It seemed like everything I tried didn't work, one VLAN would get data, the other would not.

First of all, I couldn't get either VLAN to work while Shorewall was running. More on that later. I turned off Shorewall temporarily.

I did an ethereal dump of the data flowing thru eth0, and saw traffic in both directions for both VLANs going thru eth0, but I never received any data on VLAN 254. This is why DHCP was not working (the data never came back from the switch). Looking in the ethereal dump, I could see my computer asking for a DHCP address, and the DHCP server replying, but dhclient acted like nothing ever happened. Then it dawned on me to recheck the Cisco switch configuration. Although I knew that the port was trunked, I wanted to check the other port parameters. What bit me was:

switchport trunk native vlan 254

I was sending out packets with VLAN information, but because VLAN 254 was native for the port, the switch was sending VLAN 254 packets back with no VLAN information in them. This is not readily apparent, I'm not sure how you can see if an incoming packet has VLAN information. Anyway, I went into the switch and removed the native vlan parameter for that port.

Now I was getting data on both VLANs as I expected. Good!

Now, I had to get Shorewall working. Shorewall was set up to work with interface eth0. Shorewall documentation makes no mention of VLANs, however it mentioned aliasing, different concept I know. Reading the criteria for aliasing led me to believe that Shorewall needed to be set up one interface for each VLAN. In the /etc/shorewall/interfaces file I removed:

net eth0 detect

and added:

net eth0.127 detect
net eth0.254 detect dhcp

I restarted Shorewall, and both VLANs were operational.

For those keeping track of my config files.

/etc/sysconfig/network:
HOSTNAME=host.network.com
NETWORKING=yes
VLAN=yes

/etc/sysconfig/network-scripts/ifcfg-eth0:
DEVICE=eth0
BOOTPROTO=none
ONBOOT=yes

/etc/sysconfig/network-scripts/ifcfg-eth0.127:
DEVICE=eth0.127
BOOTPROTO=static
IPADDR=192.168.127.1
NETMASK=255.255.255.0
NETWORK=192.168.127.0
BROADCAST=192.168.127.255
ONBOOT=yes

/etc/sysconfig/network-scripts/ifcfg-eth0.254:
DEVICE=eth0.254
BOOTPROTO=dhcp
ONBOOT=yes
DHCP_CLIENT=dhclient
MII_NOT_SUPPORTED=yes
USERCTL=no
IPV6INIT=no
IPV6TO4INIT=no
PEERDNS=yes
NEEDHOSTNAME=no
PEERYP=no
PEERNTPD=no

This is using Mandriva 2006 which includes the VLAN patch, utils, and VLAN aware network scripts.

Regards,

John

Never thought you had a firewall up. A basic question anymore in network. Easy to miss the simple things. Glad to see you have the interfaces up.

Now I am not a user of shorewall, mostly use to using iptables for firewalling. Not sure if shorewall uses iptables or not. But in iptables it does not understand anthing other than eth* or IP. I know iptables does not handle virtual aliasing IP like eth0:0, eth0:1, and so on but not sure about your layout eth0.127. To make use of Alias IP one needs to use the IP and not eth0:0.

Hope this might help.
Brian1