How to Configure VLAN Tagging with nmcli and netplan

Updated: 28 September 2026 · Applies to: NetworkManager 1.54 and 1.56 on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10; netplan on Ubuntu 24.04 and 26.04

VLAN tagging lets one physical network port carry several separate networks. Each VLAN has a number (ID), and Linux creates a virtual interface per VLAN on top of the physical one, for example eth0.10 or vlan10. The switch port must be configured as a trunk that carries those VLAN IDs, so agree the IDs with your network or data-centre team first. We generated both configurations below on AlmaLinux 9 and Ubuntu 24.04 to check them.

Before you start

• Work from a console (IPMI or KVM), not over the interface you are changing, in case the connection drops.
• Find the parent interface name with ip link (for example eth0, eno1 or enp3s0f0).

AlmaLinux, Rocky Linux and RHEL (nmcli)

1. Create the VLAN connection with a static address:

   nmcli connection add type vlan con-name vlan10 ifname eth0.10 dev eth0 id 10 \
     ipv4.method manual ipv4.addresses 192.0.2.10/24

   Add ipv4.gateway 192.0.2.1 only if this VLAN should carry the default route, and ipv6.method disabled if the VLAN has no IPv6.
2. Activate it:

   nmcli connection up vlan10

3. Check the interface and its VLAN ID:

   ip -d link show eth0.10
   nmcli connection show vlan10 | grep -E 'vlan.id|vlan.parent|ipv4.addresses'

NetworkManager stores the setting as a keyfile in /etc/NetworkManager/system-connections/vlan10.nmconnection, which survives reboots. The ifcfg-eth0.10 files from CentOS 7 guides are deprecated on RHEL 9 and no longer supported on RHEL 10.

Ubuntu (netplan)

1. Create /etc/netplan/60-vlan.yaml, with the parent interface listed under ethernets:

   network:
     version: 2
     ethernets:
       eth0: {}
     vlans:
       vlan10:
         id: 10
         link: eth0
         addresses: [192.0.2.10/24]

   If eth0 is already defined in another netplan file, leave the ethernets part out here.
2. Protect the file and test it. netplan try rolls back automatically after 120 seconds unless you confirm:

   chmod 600 /etc/netplan/60-vlan.yaml
   netplan try

3. Check: ip -d link show vlan10

Remove a VLAN

nmcli connection delete vlan10       # AlmaLinux, Rocky Linux, RHEL

On Ubuntu, delete the netplan file and run netplan apply.

Common problems

• The VLAN interface is up but nothing answers: the switch port does not carry this VLAN ID, or the other side uses a different ID. Capture on the parent to see tags: tcpdump -e -n -i eth0 vlan.
• The default route moved to the VLAN: remove the gateway from the VLAN connection unless it is meant to be the main route.

Official documentation: Configuring VLAN tagging (Red Hat) and Netplan YAML reference.