A VLAN is a type of local area network that does not have its own dedicated physical infrastructure but instead uses another local area network to carry its traffic. The traffic is encapsulated so that a number of logically separate VLANs can be carried by the same physical LAN. With VLANs, you can create multiple distinct broadcast domains that are mutually isolated. With VLANs, network switches (not routers) create the broadcast domain.


Each VLAN is identified by a VID (VLAN Identifier) in the range 1 to 4094 inclusive. Switch ports are assigned to a VLAN ID, and all ports assigned to a single VLAN are in a single broadcast domain. The VID is stored in an extra 4-byte header that is added to the packet called the Tag. Adding a Tag to a packet is called tagging.


Configuring VLAN tagging using nmcli


1. You can use the nmcli connection command to create a VLAN connection. Include the “add type vlan” arguments and any additional information to create a VLAN connection. For example:

# nmcli con add type vlan con-name vlan-ens37.100 ifname ens37.100 dev ens37 id 100 ip4
Connection 'vlan-ens37.100' (66950580-5ee1-40f7-8ce3-b9819fdfc492) successfully added.


The example defines the following attributes of the VLAN connection:


con-name vlan-ens37.100: Specifies the name of the new VLAN connection

ifname ens37.100: Specifies the interface to bind the connection to

dev ens37: Specifies the physical (parent) device this VLAN is on

id 100: Specifies the VLAN ID

ip4 Specifies IPv4 address to assign to the interface


2. The nmcli con command shows the new VLAN connection.

# nmcli connection 
NAME                UUID                                  TYPE            DEVICE    
vlan-ens37.100      66950580-5ee1-40f7-8ce3-b9819fdfc492  vlan            ens37.100


3. This command creates the ifcfg-vlan-ens37.100 file. Following is the contents of this file:

# cat /etc/sysconfig/network-scripts/ifcfg-vlan-ens37.100


4. You can use the ip addr command to view the protocol address information for the network devices. The following shows the VLAN interface, ens37.100:

# ip add show
1: lo: [LOOPBACK,UP,LOWER_UP] mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens37.100@ens37: [BROADCAST,MULTICAST,UP,LOWER_UP] mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 00:0c:29:54:f7:34 brd ff:ff:ff:ff:ff:ff
    inet brd scope global ens37.100
       valid_lft forever preferred_lft forever
    inet6 fe80::473b:5fc1:87d:89c3/64 scope link 
       valid_lft forever preferred_lft forever


5. The nmcli device command shows the ens37.100 device.

# nmcli device 
DEVICE     TYPE      STATE      CONNECTION          
ens37.100  vlan      connected  vlan-ens37.100


6. The nmcli connection command shows the vlan-ens37.100 connection.

# nmcli connection 
NAME                UUID                                  TYPE            DEVICE    
vlan-ens37.100      66950580-5ee1-40f7-8ce3-b9819fdfc492  vlan            ens37.100


Viewing VLAN Information


Each network interface contains a directory in the /sys/class/net directory. For example:

# ls /sys/class/net
ens33  ens36  ens37  ens37.100  lo


In this example, a VLAN interface exists named ens37.100 and a directory of the same name exists that contains configuration information for that interface. For example:

# ls /sys/class/net/ens37.100
addr_assign_type  broadcast        dev_id    duplex             ifalias  link_mode    netdev_group  power   statistics    type
address           carrier          dev_port  flags              ifindex  lower_ens37  operstate     queues  subsystem     uevent
addr_len          carrier_changes  dormant   gro_flush_timeout  iflink   mtu          phys_port_id  speed   tx_queue_len


There are also files in the /proc/net/vlan directory that describe the VLAN interface. For example:

# ls /proc/net/vlan
config  ens37.100


You can use the tcpdump utility to see tagged and untagged packets to ensure traffic is showing up on the expected interfaces. The -e option specifies the Ethernet header that includes 802.1Q tags. Use the -i option to specify the interface. For example:

# tcpdump –e –i ens37


Was this answer helpful? 0 Users Found This Useful (0 Votes)