Chapter 4. Configuring VLAN tagging

Procedure

1. Display the network interfaces:

   # nmcli device status
   DEVICE   TYPE      STATE         CONNECTION
   enp1s0   ethernet  disconnected  enp1s0
   bridge0  bridge    connected     bridge0
   bond0    bond      connected     bond0
   ...

2. Create the VLAN interface. For example, to create a VLAN interface named vlan10 that uses enp1s0 as its parent interface and that tags packets with VLAN ID 10, enter:

   # nmcli connection add type vlan con-name vlan10 ifname vlan10 vlan.parent enp1s0 vlan.id 10

   Note that the VLAN must be within the range from 0 to 4094.

3. By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. If you require a different MTU value, enter:

   # nmcli connection modify vlan10 ethernet.mtu 2000

4. Configure the IPv4 settings:

   • To set a static IPv4 address, network mask, default gateway, and DNS server to the vlan10 connection, enter:

     # nmcli connection modify vlan10 ipv4.addresses '192.0.2.1/24' ipv4.gateway '192.0.2.254' ipv4.dns '192.0.2.253' ipv4.method manual

   • To use DHCP, no action is required.
   • If you plan to use this VLAN device as a port of other devices, no action is required.

5. Configure the IPv6 settings:

   • To set a static IPv6 address, network mask, default gateway, and DNS server to the vlan10 connection, enter:

     # nmcli connection modify vlan10 ipv6.addresses '2001:db8:1::1/32' ipv6.gateway '2001:db8:1::fffe' ipv6.dns '2001:db8:1::fffd' ipv6.method manual

   • To use stateless address autoconfiguration (SLAAC), no action is required.
   • If you plan to use this VLAN device as a port of other devices, no action is required.

6. Activate the connection:

   # nmcli connection up vlan10

Procedure

1. Display the physical network devices:

   # nmcli device status
   DEVICE   TYPE      STATE         CONNECTION
   enp1s0  ethernet  connected      enp1s0
   ...

2. Create the base VLAN interface. For example, to create a base VLAN interface named vlan10 that uses enp1s0 as its parent interface and that tags packets with VLAN ID 10, enter:

   # nmcli connection add type vlan con-name vlan10 dev enp1s0 vlan.id 10

   Note that the VLAN must be within the range from 0 to 4094.

3. By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. If you require a different MTU value, enter:

   # nmcli connection modify vlan10 ethernet.mtu 2000

4. Create the nested VLAN interface on top of the base VLAN interface:

   # nmcli connection add type vlan con-name vlan10.20 dev enp1s0.10 id 20 vlan.protocol 802.1ad

   This command creates a new VLAN connection with a name of vlan10.20 and a VLAN ID of 20 on the parent VLAN connection vlan10. The dev option specifies the parent network device. In this case it is enp1s0.10. The vlan.protocol option specifies the VLAN encapsulation protocol. In this case it is 802.1ad (Q-in-Q).

5. Configure the IPv4 settings of the nested VLAN interface:

   • To use DHCP, no action is required.

   • To set a static IPv4 address, network mask, default gateway, and DNS server to the vlan10.20 connection, enter:

     # nmcli connection modify vlan10.20 ipv4.method manual ipv4.addresses 192.0.2.1/24 ipv4.gateway 192.0.2.254 ipv4.dns 192.0.2.200

6. Configure the IPv6 settings of the nested VLAN interface:

   • To use stateless address autoconfiguration (SLAAC), no action is required.

   • To set a static IPv6 address, network mask, default gateway, and DNS server to the vlan10 connection, enter:

     # nmcli connection modify vlan10.20 ipv6.addresses '2001:db8:1::1/64' ipv6.gateway '2001:db8:1::fffe' ipv6.dns '2001:db8:1::fffd' ipv6.dns-search 'example.com' ipv6.method manual

7. Activate the profile:

   # nmcli connection up vlan10.20

Verification

1. Verify the configuration of the nested VLAN interface:

   # ip -d addr show enp1s0.10.20
   10: enp1s0.10.20@enp1s0.10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
       link/ether 52:54:00:d2:74:3e brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 0 maxmtu 65535
       vlan protocol 802.1ad id 20 <REORDER_HDR> numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 tso_max_size 65536 tso_max_segs 65535 gro_max_size 65536
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute enp1s0.10.20
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::1/32 scope global noprefixroute
          valid_lft forever preferred_lft forever
       inet6 fe80::ce3b:84c5:9ef8:d0e6/64 scope link noprefixroute
          valid_lft forever preferred_lft forever

Procedure

1. Select the Networking tab in the navigation on the left side of the screen.
2. Click Add VLAN in the Interfaces section.
3. Select the parent device.
4. Enter the VLAN ID.
5. Enter the name of the VLAN device or keep the automatically-generated name.
6. Click Apply.

7. By default, the VLAN device uses a dynamic IP address. If you want to set a static IP address:

   1. Click the name of the VLAN device in the Interfaces section.
   2. Click Edit next to the protocol you want to configure.
   3. Select Manual next to Addresses, and enter the IP address, prefix, and default gateway.
   4. In the DNS section, click the + button, and enter the IP address of the DNS server. Repeat this step to set multiple DNS servers.
   5. In the DNS search domains section, click the + button, and enter the search domain.
   6. If the interface requires static routes, configure them in the Routes section.
   7. Click Apply

Procedure

1. If you do not know the network device name on which you want configure VLAN tagging, display the available devices:

   # nmcli device status
   DEVICE     TYPE      STATE                   CONNECTION
   enp1s0     ethernet  unavailable             --
   ...

2. Start nmtui:

   # nmtui

3. Select Edit a connection, and press Enter.
4. Press Add.
5. Select VLAN from the list of network types, and press Enter.

6. Optional: Enter a name for the NetworkManager profile to be created.

   On hosts with multiple profiles, a meaningful name makes it easier to identify the purpose of a profile.

7. Enter the VLAN device name to be created into the Device field.
8. Enter the name of the device on which you want to configure VLAN tagging into the Parent field.
9. Enter the VLAN ID. The ID must be within the range from 0 to 4094.

10. Depending on your environment, configure the IP address settings in the IPv4 configuration and IPv6 configuration areas accordingly. For this, press the button next to these areas, and select:

    • Disabled, if this VLAN device does not require an IP address or you want to use it as a port of other devices.
    • Automatic, if a DHCP server or stateless address autoconfiguration (SLAAC) dynamically assigns an IP address to the VLAN device.

    • Manual, if the network requires static IP address settings. In this case, you must fill further fields:

      1. Press Show next to the protocol you want to configure to display additional fields.

      2. Press Add next to Addresses, and enter the IP address and the subnet mask in Classless Inter-Domain Routing (CIDR) format.

         If you do not specify a subnet mask, NetworkManager sets a /32 subnet mask for IPv4 addresses and /64 for IPv6 addresses.

      3. Enter the address of the default gateway.
      4. Press Add next to DNS servers, and enter the DNS server address.
      5. Press Add next to Search domains, and enter the DNS search domain.
11. Press OK to create and automatically activate the new connection.
12. Press Back to return to the main menu.
13. Select Quit, and press Enter to close the nmtui application.

Procedure

1. Create a YAML file, for example ~/create-vlan.yml, with the following content:

   ---
   interfaces:
   - name: vlan10
     type: vlan
     state: up
     ipv4:
       enabled: true
       address:
       - ip: 192.0.2.1
         prefix-length: 24
       dhcp: false
     ipv6:
       enabled: true
       address:
       - ip: 2001:db8:1::1
         prefix-length: 64
       autoconf: false
       dhcp: false
     vlan:
       base-iface: enp1s0
       id: 10
   - name: enp1s0
     type: ethernet
     state: up
   
   routes:
     config:
     - destination: 0.0.0.0/0
       next-hop-address: 192.0.2.254
       next-hop-interface: vlan10
     - destination: ::/0
       next-hop-address: 2001:db8:1::fffe
       next-hop-interface: vlan10
   
   dns-resolver:
     config:
       search:
       - example.com
       server:
       - 192.0.2.200
       - 2001:db8:1::ffbb

   These settings define a VLAN with ID 10 that uses the enp1s0 device. As the child device, the VLAN connection has the following settings:

   • A static IPv4 address - 192.0.2.1 with the /24 subnet mask
   • A static IPv6 address - 2001:db8:1::1 with the /64 subnet mask
   • An IPv4 default gateway - 192.0.2.254
   • An IPv6 default gateway - 2001:db8:1::fffe
   • An IPv4 DNS server - 192.0.2.200
   • An IPv6 DNS server - 2001:db8:1::ffbb
   • A DNS search domain - example.com

2. Apply the settings to the system:

   # nmstatectl apply ~/create-vlan.yml

Verification

1. Display the status of the devices and connections:

   # nmcli device status
   DEVICE      TYPE      STATE      CONNECTION
   vlan10      vlan      connected  vlan10

2. Display all settings of the connection profile:

   # nmcli connection show vlan10
   connection.id:              vlan10
   connection.uuid:            1722970f-788e-4f81-bd7d-a86bf21c9df5
   connection.stable-id:       --
   connection.type:            vlan
   connection.interface-name:  vlan10
   ...

3. Display the connection settings in YAML format:

   # nmstatectl show vlan10

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configure the network
     hosts: managed-node-01.example.com
     tasks:
       - name: VLAN connection profile with Ethernet port
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.network
         vars:
           network_connections:
             # Ethernet profile
             - name: enp1s0
               type: ethernet
               interface_name: enp1s0
               autoconnect: yes
               state: up
               ip:
                 dhcp4: no
                 auto6: no
   
             # VLAN profile
             - name: enp1s0.10
               type: vlan
               vlan:
                 id: 10
               ip:
                 dhcp4: yes
                 auto6: yes
               parent: enp1s0
               state: up

   e settings specified in the example playbook include the following:

   type: <profile_type>

   Sets the type of the profile to create. The example playbook creates two connection profiles: One for the parent Ethernet device and one for the VLAN device.

   dhcp4: <value>

   If set to yes, automatic IPv4 address assignment from DHCP, PPP, or similar services is enabled. Disable the IP address configuration on the parent device.

   auto6: <value>

   If set to yes, IPv6 auto-configuration is enabled. In this case, by default, NetworkManager uses Router Advertisements and, if the router announces the managed flag, NetworkManager requests an IPv6 address and prefix from a DHCPv6 server. Disable the IP address configuration on the parent device.

   parent: <parent_device>

   Sets the parent device of the VLAN connection profile. In the example, the parent is the Ethernet interface.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.network/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml