Changes between Initial Version and Version 1 of linux/vlan


Ignore:
Timestamp:
10/22/2017 05:28:45 AM (2 years ago)
Author:
trac
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • linux/vlan

    v1 v1  
     1[[PageOutline]]
     2
     3= VLANs =
     4[https://en.wikipedia.org/wiki/IEEE_802.1Q IEEE 802.1Q IEEE 802.1Q] is the networking standard that supports Virtual LANs (VLANs) on an Ethernet network (Layer 3 networking).
     5
     6The advantages of a VLAN are:
     7 * increased switching efficiency
     8 * network segmentation
     9 * security
     10 * trunks
     11 * ability to sub-divide a LAN for security purposes
     12
     13In order to use VLAN's you need:
     14 1. a switch that supports IEEE 802.1Q
     15 2. a NIC (Network Interface Card) that supports 802.1Q (Not all network drivers support VLAN)
     16 3. 802.1Q support in the kernel (8021q module, CONFIG_VLAN_8021Q)
     17
     18VLANs work by applying a '''tag''' to each frame (which increases the header size by 4 bytes). The tag contains an 'ID' and a 'prority'. The priority can be used for a quality of service (QoS) scheme known IEEE 802.1p.
     19
     20Only portions of a network which are VLAN-aware (802.1Q compliant) can include VLAN tags - traffic on other segments (802.1D conformant) will not contain tags. When a frame enters the VLAN-aware portion a tag is added to denote the VLAN info (membership etc).
     21
     22In general, you add a VLAN tag to a network port (on a managed switch, for example), and that switch port will drop all packets that don't have the specified VLAN ID, while allowing those with the appropriate VLAN ID to continue on.
     23
     24Here is an image showcasing a potential use case for VLANs:
     25
     26[[Image(http://wiki.mikrotik.com/images/9/9a/Image12005.gif)]]
     27
     28Generally speaking, VLAN tagging is done on a switch basis, though you can also use Linux to listen to VLAN tagged packets on interface devices.
     29
     30== Linux VLAN support ==
     31The Linux network layer supports VLAN if built with CONFIG_VLAN_8021Q. To create a VLAN you need to slave it off a physical interface port. Note that the physical interface will still accept 'un-tagged' traffic, but only traffic matching the VLAN ID will be presented to the virtual interface.
     32
     33The Linux {{{ip}}} utility from the ip-route2 package allows the manipulation of the network stack on the Layer 3 network layer.
     34
     35Examples:
     36 * use {{{ip link add}}} to create VLAN ID 5 slaved off physical interface eth0:
     37{{{#!bash
     38ip link add link eth0 name eth0.5 type vlan id 5
     39ifconfig eth0.5 192.168.1.100 up
     40}}}
     41  - adds a 'link' object to the {{{eth0}}} nic with a name of {{{eth0.5}}} (the name can be anything but it is convention to use the <physical>.<id>)
     42  - any packets leaving {{{eth0.5}}} will be tagged with VLAN ID #5
     43  - only packets coming into {{{eth0}}} tagged with VLAN ID #5 will be presented to {{{eth0.5}}}
     44 * use {{{ip link set}}} to re-configure the VLAN:
     45{{{#!bash
     46}}}
     47 * use {{{ip link show}}} to show the sate of a VLAN:
     48{{{#!bash
     49$ ip -d link show eth0.5
     505: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
     51    link/ether f8:bc:12:8c:23:21 brd ff:ff:ff:ff:ff:ff promiscuity 0
     52    vlan protocol 802.1Q id 5 <REORDER_HDR>
     53}}}
     54  - {{{eth0.1@eth0}}} is using the IEEE 802.1Q standard with VLAN id 42.
     55 * use tcpdump to show information when you receive a packet on this nic with the VLAN ID of 5:
     56{{{#!bash
     57tcpdump -i eth0 -Uw - | tcpdump -en -r - vlan 5
     58}}}
     59 * delete a VLAN interface:
     60{{{#!bash
     61ifconfig eth0 down
     62ip link delete eth0.5
     63}}}
     64
     65See [http://linux.die.net/man/8/ip ip(8)] or [https://access.redhat.com/sites/default/files/attachments/rh_ip_command_cheatsheet_1214_jcs_print.pdf here] for more info
     66
     67Alternatively the Linux {{{vconfig}}} (which is a bit older and deprecated) can be used as well.
     68
     69Examples:
     70 * create VLAN ID 5 slaved off physical interface eth0:
     71{{{#!bash
     72vconfig add eth0 5
     73ifconfig eth0.5 192.168.1.100 up
     74}}}
     75 * show info about a VLAN ID (older kernels only):
     76{{{#!bash
     77# cat /proc/net/vlan/config
     78VLAN Dev name    | VLAN ID
     79Name-Type: VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD
     80eth0.5         | 5  | eth0
     81# cat /proc/net/vlan/eth0.5
     82eth0.5  VID: 5   REORDER_HDR: 1  dev->priv_flags: 1
     83         total frames received            4
     84          total bytes received          252
     85      Broadcast/Multicast Rcvd            0
     86
     87      total frames transmitted            8
     88       total bytes transmitted          688
     89Device: eth0
     90INGRESS priority mappings: 0:0  1:0  2:0  3:0  4:0  5:0  6:0 7:0
     91 EGRESS priority mappings:
     92}}}
     93 * remove VLAN ID 5
     94{{{#!bash
     95vconfig rem eth0.5
     96}}}
     97
     98See [http://linux.die.net/man/8/vconfig vconfig(8)] for more info
     99
     100
     101[=#hardware]
     102== Hardware Support ==
     103Many Gateworks products have ethernet MAC's or switch devices that support VLAN tagging.
     104
     105[=#ventana]
     106=== Ventana ===
     107All on-board NIC's on Ventana boards support 802.1Q VLAN Tagging:
     108 * Freescale FEC (eth0 on most boards)
     109 * Marvell Sky2 (eth1 on GW54xx/GW53xx)
     110 * Intel i210 (igb driver) (eth0 and eth1 on GW5520 and MAC on GW16083)
     111
     112The Ventana [wiki:ventana/expansion#GW16083Ethernetexpansionmezzanine GW16083 Ethernet Expansion Mezzanine] supports VLAN tagging in the OpenWrt BSP via [wiki:OpenWrt/swconfig swconfig] as well as DSA support.
     113
     114
     115[=#laguna]
     116=== Laguna ===
     117The on-board NIC's on Laguna boards support 802.1Q VLAN Tagging.
     118
     119[=#ixp4xx]
     120=== Avila / Cambria (ixp4xx) ===
     121The Avila and Cambria products based off the Intel XScale processor support VLAN tagging as well but some software customatization is needed:
     122 - make sure you have the ixp4xx-microcode package in your firmware
     123 - edit build_dir/target-armeb_vrte*/IxNpeMicrocode?.h file:
     124  - comment out IX_NPEDL_NPEIMAGE_NPEA_ETH_SPAN_FIREWALL_VLAN_QOS_HDR_CONV
     125  - uncomment IX_NPEDL_NPEIMAGE_NPEA_ETH_LEARN_FILTER_SPAN_FIREWALL
     126  - for more info see IxNpeMicrocode?.c:3348 'NPE FIRMWARE IMAGE'
     127 - rebuild ixp4xx-microcode package and reinstall in /lib/firmware
     128 - apparently switching to the ETH_LEARN_* firmware causes issues with bridging and STP so this isn't a 'fix' but a change based on use case. Likely needs more investigation
     129
     130For more info on IXP4xx VLAN see:
     131 - ​http://lists.gateworks.com/avila/2010-September.txt
     132​ - https://dev.openwrt.org/ticket/7945
     133
     134
     135[=#openwrt]
     136= OpenWrt VLAN support (swconfig) =
     137OpenWrt has its own light-weight application and kernel driver that configures 'embedded switches' and supports per-port management including VLAN configuration. Being light-weight it does not represent each port as a network interface and thus you can not sun higher level protocols such as STP, LLDP, etc on a per-port basis (for that, see #dsa below).
     138
     139Please see our OpenWrt [wiki:OpenWrt/swconfig swconfig] page for more details.
     140
     141
     142[=#dsa]
     143= Linux Distributed Switch Architecture =
     144The Linux Distributed Switch Architecture (DSA) is a framework for Ethernet Switch chips present on Embedded boards. When supported each external port of the switch is available as a Network Interface Card (NIC) such that higher level protocols can act at the port level.
     145
     146In other words each physical port on the switch becomes a network interface in Linux and this allows protocols such as STP, LLDP, etc to run at a port level.
     147
     148
     149== GW16083 Ethernet Expansion Mezzanine ==
     150The GW16083 Ethernet Expansion Mezzanine has DSA support in the latest Gateworks Yocto and OpenWrt BSPs.
     151
     152Note that while the MV88E6176 switch can tag/untag frames automatically according to VLAN configuration which does not require the CPU port to be 'up', if you need to do any other protocol level networking packets must enter the CPU and thus the cpu port needs to be 'up'. Typically the GW16083 PCI NIC routing to the CPU interface is the 2nd network interface (eth1).
     153
     154For example, a GW54xx + GW16083:
     155{{{#!bash
     156root@ventana:~# ls /sys/class/net/
     157can0   eth0   eth1   eth2   lo     sit0   wlan0
     158root@ventana:~# grep -H DRIVER=igb /sys/class/net/*/device/uevent
     159/sys/class/net/eth1/device/uevent:DRIVER=igb
     160root@ventana:~# ifconfig eth1 up
     161[  233.512754] igb: eth1 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX
     162[  233.582674] igb 0000:06:00.0 eth1: igb PHY driver [MV88E6176] (mii_bus:phy_addr=0000:06:00.0-157:10)
     163[  233.592314] 8021q: adding VLAN 0 to HW filter on device eth1
     164root@ventana:~# [  234.494007] Distributed Switch Architecture driver version 0.1
     165[  234.500007] eth1[0]: detected a Marvell 88E6176 switch
     166[  234.583752] libphy: dsa slave smi: probed
     167[  235.208987] MV88E6176 0000:06:00.0-157:10: registered GW16083 DSA switch
     168
     169root@ventana:~# ls /sys/class/net/
     170can0   eth0   eth1   eth2   lan1   lan2   lan3   lan4   lan5   lan6   lo     sit0   wlan0
     171}}}
     172 * Notice how we use {{{grep -H DRIVER=igb /sys/class/net/*/device/uevent}}} to show which NIC belongs to the Intel I210 on the GW16083. Note that on a GW552x you will see three NIC's all using igb.
     173 * Notice how until the Intel I210 on the GW16083 is brought up the lan1 - lan6 NIC's are not present
     174 * The lan numbering matches the silkscreen. Please refer to the following table:
     175||= Connector =||= Silkscreen =||= DSA Name =||
     176|| J7          || Ethernet1    || lan1       ||
     177|| J8          || Ethernet2    || lan2       ||
     178|| J9          || Ethernet3    || lan3       ||
     179|| J10         || Ethernet4    || lan4       ||
     180|| J3/J4       || Ethernet5    || lan5       ||
     181|| J2/J4       || Ethernet6    || lan6       ||
     182
     183OpenWrt BSP Notes:
     184 * Note that on OpenWrt by default the 2nd NIC on a GW552x/GW53xx/GW54xx is configured as the {{{wan}}} interface and brought up with dhcp running on it. If you want to use dhcp you will want to run it on a port interface instead (ie lan1 through lan6)
     185 * On boards with a single on-board NIC (ie GW51xx/GW52xx) you will need to bring eth1 up manually before you can see lan1 - lan6 (or configure it to come up via OpenWrt's network configuration)