You want to show a list of vlans on your system. which command would you use?

Red Hat Training

A Red Hat training course is available for RHEL 8

Inhaltsverzeichnis Show

Red Hat Training
5.1. Configuring VLAN tagging using nmcli commands
5.2. Configuring VLAN tagging using the RHEL web console
5.3. Configuring VLAN tagging using nmtui
5.4. Configuring VLAN tagging using nm-connection-editor
5.5. Configuring VLAN tagging using nmstatectl
5.6. Configuring VLAN tagging using RHEL System Roles
5.7. Additional resources
Which command would you use to delete a VLAN?
What command is used to find all the VLANs for which your switch is the root bridge?
Which command should you use to verify if the VLAN was created?
Which command would you use to delete a VLAN quizlet?

A Virtual Local Area Network (VLAN) is a logical network within a physical network. The VLAN interface tags packets with the VLAN ID as they pass through the interface, and removes tags of returning packets. You create VLAN interfaces on top of another interface, such as Ethernet, bond, team, or bridge devices. These interfaces are called the parent interface.

Red Hat Enterprise Linux provides administrators different options to configure VLAN devices. For example:

Use nmcli to configure VLAN tagging using the command line.
Use the RHEL web console to configure VLAN tagging using a web browser.
Use nmtui to configure VLAN tagging in a text-based user interface.
Use the nm-connection-editor application to configure connections in a graphical interface.
Use nmstatectl to configure connections through the Nmstate API.
Use RHEL System Roles to automate the VLAN configuration on one or multiple hosts.

5.1. Configuring VLAN tagging using nmcli commands

You can configure Virtual Local Area Network (VLAN) tagging on the command line using the nmcli utility.

Prerequisites

The interface you plan to use as a parent to the virtual VLAN interface supports VLAN tags.
If you configure the VLAN on top of a bond interface:
- The ports of the bond are up.
- The bond is not configured with the fail_over_mac=follow option. A VLAN virtual device cannot change its MAC address to match the parent’s new MAC address. In such a case, the traffic would still be sent with the incorrect source MAC address.
- The bond is usually not expected to get IP addresses from a DHCP server or IPv6 auto-configuration. Ensure it by setting the ipv4.method=disable and ipv6.method=ignore options while creating the bond. Otherwise, if DHCP or IPv6 auto-configuration fails after some time, the interface might be brought down.
The switch, the host is connected to, is configured to support VLAN tags. For details, see the documentation of your switch.

Procedure

Display the network interfaces:

# nmcli device status
DEVICE   TYPE      STATE         CONNECTION
enp1s0   ethernet  disconnected  enp1s0
bridge0  bridge    connected     bridge0
bond0    bond      connected     bond0
...

Create the VLAN interface. For example, to create a VLAN interface named vlan10 that uses enp1s0 as its parent interface and that tags packets with VLAN ID 10, enter:
```
# nmcli connection add type vlan con-name vlan10 ifname vlan10 vlan.parent enp1s0 vlan.id 10
```
Note that the VLAN must be within the range from 0 to 4094.
By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. Optionally, set a different MTU value:
```
# nmcli connection modify vlan10 ethernet.mtu 2000
```

Configure the IP settings of the VLAN device. Skip this step if you want to use this VLAN device as a port of other devices.

Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, and DNS server to the vlan10 connection, enter:

# nmcli connection modify vlan10 ipv4.addresses '192.0.2.1/24'
# nmcli connection modify vlan10 ipv4.gateway '192.0.2.254'
# nmcli connection modify vlan10 ipv4.dns '192.0.2.253'
# nmcli connection modify vlan10 ipv4.method manual

Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, and DNS server to the vlan10 connection, enter:

# nmcli connection modify vlan10 ipv6.addresses '2001:db8:1::1/32'
# nmcli connection modify vlan10 ipv6.gateway '2001:db8:1::fffe'
# nmcli connection modify vlan10 ipv6.dns '2001:db8:1::fffd'
# nmcli connection modify vlan10 ipv6.method manual

Activate the connection:
```
# nmcli connection up vlan10
```

Verification steps

Verify the settings:

# ip -d addr show vlan10
4: vlan10@enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 52:54:00:72:2f:6e brd ff:ff:ff:ff:ff:ff promiscuity 0
    vlan protocol 802.1Q id 10 <REORDER_HDR> numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
    inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute vlan10
       valid_lft forever preferred_lft forever
    inet6 2001:db8:1::1/32 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 fe80::8dd7:9030:6f8e:89e6/64 scope link noprefixroute
       valid_lft forever preferred_lft forever

5.2. Configuring VLAN tagging using the RHEL web console

Use the RHEL web console to configure VLAN tagging if you prefer to manage network settings using a web browser-based interface.

Prerequisites

The interface you plan to use as a parent to the virtual VLAN interface supports VLAN tags.
If you configure the VLAN on top of a bond interface:
- The ports of the bond are up.
- The bond is not configured with the fail_over_mac=follow option. A VLAN virtual device cannot change its MAC address to match the parent’s new MAC address. In such a case, the traffic would still be sent with the incorrect source MAC address.
- The bond is usually not expected to get IP addresses from a DHCP server or IPv6 auto-configuration. Ensure it by disabling the IPv4 and IPv6 protocol creating the bond. Otherwise, if DHCP or IPv6 auto-configuration fails after some time, the interface might be brought down.
The switch, the host is connected to, is configured to support VLAN tags. For details, see the documentation of your switch.

Procedure

Select the Networking tab in the navigation on the left side of the screen.
Click Add VLAN in the Interfaces section.
Select the parent device.
Enter the VLAN ID.
Enter the name of the VLAN device or keep the automatically-generated name.
Click Apply.
By default, the VLAN device uses a dynamic IP address. If you want to set a static IP address:
1. Click the name of the VLAN device in the Interfaces section.
2. Click Edit next to the protocol you want to configure.
3. Select Manual next to Addresses, and enter the IP address, prefix, and default gateway.
4. In the DNS section, click the + button, and enter the IP address of the DNS server. Repeat this step to set multiple DNS servers.
5. In the DNS search domains section, click the + button, and enter the search domain.
6. If the interface requires static routes, configure them in the Routes section.
7. Click Apply

Verification

Select the Networking tab in the navigation on the left side of the screen, and check if there is incoming and outgoing traffic on the interface:

5.3. Configuring VLAN tagging using nmtui

The nmtui application provides a text-based user interface for NetworkManager. You can use nmtui to configure VLAN tagging on a host without a graphical interface.

In nmtui:

Navigate by using the cursor keys.
Press a button by selecting it and hitting Enter.
Select and deselect checkboxes by using Space.

Prerequisites

The interface you plan to use as a parent to the virtual VLAN interface supports VLAN tags.
If you configure the VLAN on top of a bond interface:
- The ports of the bond are up.
- The bond is not configured with the fail_over_mac=follow option. A VLAN virtual device cannot change its MAC address to match the parent’s new MAC address. In such a case, the traffic would still be sent with the then incorrect source MAC address.
- The bond is usually not expected to get IP addresses from a DHCP server or IPv6 auto-configuration. Ensure it by setting the ipv4.method=disable and ipv6.method=ignore options while creating the bond. Otherwise, if DHCP or IPv6 auto-configuration fails after some time, the interface might be brought down.
The switch the host is connected to is configured to support VLAN tags. For details, see the documentation of your switch.

Procedure

If you do not know the network device name on which you want configure VLAN tagging, display the available devices:

# nmcli device status
DEVICE     TYPE      STATE                   CONNECTION
enp1s0     ethernet  unavailable             --
...

Start nmtui:
```
# nmtui
```
Select Edit a connection, and press Enter.
Press the Add button.
Select VLAN from the list of network types, and press Enter.
Optional: Enter a name for the NetworkManager profile to be created.
Enter the VLAN device name to be created into the Device field.
Enter the name of the device on which you want to configure VLAN tagging into the Parent field.
Enter the VLAN ID. The ID must be within the range from 0 to 4094.
Depending on your environment, configure the IP address settings in the IPv4 configuration and IPv6 configuration areas accordingly. For this, press the Automatic button, and select:
- Disabled, if this VLAN device does not require an IP address or you want to use it as a port of other devices.
- Automatic, if a DHCP server dynamically assigns an IP address to the VLAN device.
- Manual, if the network requires static IP address settings. In this case, you must fill further fields:
  1. Press the Show button next to the protocol you want to configure to display additional fields.
  2. Press the Add button next to Addresses, and enter the IP address and the subnet mask in Classless Inter-Domain Routing (CIDR) format.
    If you do not specify a subnet mask, NetworkManager sets a /32 subnet mask for IPv4 addresses and /64 for IPv6 addresses.
  3. Enter the address of the default gateway.
  4. Press the Add button next to DNS servers, and enter the DNS server address.
  5. Press the Add button next to Search domains, and enter the DNS search domain.
Figure 5.1. Example of a VLAN connection with static IP address settings
Press the OK button to create and automatically activate the new connection.
Press the Back button to return to the main menu.
Select Quit, and press Enter to close the nmtui application.

Verification

Verify the settings:

# ip -d addr show vlan10
4: vlan10@enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 52:54:00:72:2f:6e brd ff:ff:ff:ff:ff:ff promiscuity 0
    vlan protocol 802.1Q id 10 <REORDER_HDR> numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
    inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute vlan10
       valid_lft forever preferred_lft forever
    inet6 2001:db8:1::1/32 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 fe80::8dd7:9030:6f8e:89e6/64 scope link noprefixroute
       valid_lft forever preferred_lft forever

5.4. Configuring VLAN tagging using nm-connection-editor

You can configure Virtual Local Area Network (VLAN) tagging in a graphical interface using the nm-connection-editor application.

Prerequisites

The interface you plan to use as a parent to the virtual VLAN interface supports VLAN tags.
If you configure the VLAN on top of a bond interface:
- The ports of the bond are up.
- The bond is not configured with the fail_over_mac=follow option. A VLAN virtual device cannot change its MAC address to match the parent’s new MAC address. In such a case, the traffic would still be sent with the incorrect source MAC address.
The switch, the host is connected, to is configured to support VLAN tags. For details, see the documentation of your switch.

Procedure

Open a terminal, and enter nm-connection-editor:
```
$ nm-connection-editor
```
Click the + button to add a new connection.
Select the VLAN connection type, and click Create.
On the VLAN tab:
1. Select the parent interface.
2. Select the VLAN id. Note that the VLAN must be within the range from 0 to 4094.
3. By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. Optionally, set a different MTU value.
4. Optionally, set the name of the VLAN interface and further VLAN-specific options.
Configure the IP settings of the VLAN device. Skip this step if you want to use this VLAN device as a port of other devices.
1. On the IPv4 Settings tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, and DNS server:
2. On the IPv6 Settings tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, and DNS server:
Click Save to save the VLAN connection.
Close nm-connection-editor.

Verification steps

Verify the settings:

# ip -d addr show vlan10
4: vlan10@enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 52:54:00:d5:e0:fb brd ff:ff:ff:ff:ff:ff promiscuity 0
    vlan protocol 802.1Q id 10 <REORDER_HDR> numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
    inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute vlan10
       valid_lft forever preferred_lft forever
    inet6 2001:db8:1::1/32 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 fe80::8dd7:9030:6f8e:89e6/64 scope link noprefixroute
       valid_lft forever preferred_lft forever

5.5. Configuring VLAN tagging using nmstatectl

You can use the nmstatectl utility to configure Virtual Local Area Network (VLAN) tagging. This example configures a VLAN with ID 10 that uses an Ethernet connection. As the child device, the VLAN connection contains the IP, default gateway, and DNS configurations.

Depending on your environment, adjust the YAML file accordingly. For example, to use a bridge, or bond device in the VLAN, adapt the base-iface attribute and type attributes of the ports you use in the VLAN.

Prerequisites

To use Ethernet devices as ports in the VLAN, the physical or virtual Ethernet devices must be installed on the server.
The nmstate package is installed.

Procedure

Create a YAML file, for example ~/create-vlan.yml, with the following contents:

---
interfaces:
- name: vlan10
  type: vlan
  state: up
  ipv4:
    enabled: true
    address:
    - ip: 192.0.2.1
      prefix-length: 24
    dhcp: false
  ipv6:
    enabled: true
    address:
    - ip: 2001:db8:1::1
      prefix-length: 64
    autoconf: false
    dhcp: false
  vlan:
    base-iface: enp1s0
    id: 10
- name: enp1s0
  type: ethernet
  state: up

routes:
  config:
  - destination: 0.0.0.0/0
    next-hop-address: 192.0.2.254
    next-hop-interface: vlan10
  - destination: ::/0
    next-hop-address: 2001:db8:1::fffe
    next-hop-interface: vlan10

dns-resolver:
  config:
    search:
    - example.com
    server:
    - 192.0.2.200
    - 2001:db8:1::ffbb

Apply the settings to the system:
```
# nmstatectl apply ~/create-vlan.yml
```

Verification steps

Display the status of the devices and connections:

# nmcli device status
DEVICE      TYPE      STATE      CONNECTION
vlan10      vlan      connected  vlan10

Display all settings of the connection profile:

# nmcli connection show vlan10
connection.id:              vlan10
connection.uuid:            1722970f-788e-4f81-bd7d-a86bf21c9df5
connection.stable-id:       --
connection.type:            vlan
connection.interface-name:  vlan10
...

Display the connection settings in YAML format:
```
# nmstatectl show vlan0
```

Additional resources

nmstatectl(8) man page
/usr/share/doc/nmstate/examples/ directory

5.6. Configuring VLAN tagging using RHEL System Roles

You can use the network RHEL System Role to configure VLAN tagging. This example adds an Ethernet connection and a VLAN with ID 10 on top of this Ethernet connection. As the child device, the VLAN connection contains the IP, default gateway, and DNS configurations.

Depending on your environment, adjust the play accordingly. For example:

To use the VLAN as a port in other connections, such as a bond, omit the ip attribute, and set the IP configuration in the child configuration.
To use team, bridge, or bond devices in the VLAN, adapt the interface_name and type attributes of the ports you use in the VLAN.

Perform this procedure on the Ansible control node.

Prerequisites

You have prepared the control node and the managed nodes
You are logged in to the control node as a user who can run playbooks on the managed nodes.
The account you use to connect to the managed nodes has sudo permissions on them.
The hosts or host groups on which you to want run this playbook are listed in the Ansible inventory file.

Procedure

Create a playbook file, for example ~/vlan-ethernet.yml, with the following content:

---
- name: Configure the network
  hosts: managed-node-01.example.com
  tasks:
  - name: Configure a VLAN that uses an Ethernet connection
    include_role:
      name: rhel-system-roles.network

    vars:
      network_connections:
        # Add an Ethernet profile for the underlying device of the VLAN
        - name: enp1s0
          type: ethernet
          interface_name: enp1s0
          autoconnect: yes
          state: up
          ip:
            dhcp4: no
            auto6: no

        # Define the VLAN profile
        - name: enp1s0.10
          type: vlan
          ip:
            address:
              - "192.0.2.1/24"
              - "2001:db8:1::1/64"
            gateway4: 192.0.2.254
            gateway6: 2001:db8:1::fffe
            dns:
              - 192.0.2.200
              - 2001:db8:1::ffbb
            dns_search:
              - example.com
          vlan_id: 10
          parent: enp1s0
          state: up

The parent attribute in the VLAN profile configures the VLAN to operate on top of the enp1s0 device.

Run the playbook:
```
# ansible-playbook ~/vlan-ethernet.yml
```

Additional resources

/usr/share/ansible/roles/rhel-system-roles.network/README.md file

5.7. Additional resources

VLANs for sysadmins: The basics

Which command would you use to delete a VLAN?

From global configuration mode, enter interface Ethernet configuration mode. Enter the vlan-config remove all command to remove all VLANs from the Ethernet port. Enter the vlan-config remove all command to remove the VLANs from the Ethernet port.

What command is used to find all the VLANs for which your switch is the root bridge?

Use the show spanning-tree vlan command to determine which switch is the root bridge.

Which command should you use to verify if the VLAN was created?

VLANs that can be configured have unique IDs ranging from 1-4094. Database mode will support the configuration of IDs ranging from 1-1001, but not more than 1006. In order to create a VLAN, you have to enter the VLAN command using an unused ID. To verify if a specific ID is working, you have to enter "show vlan id".

Which command would you use to delete a VLAN quizlet?

To delete a VLAN, use the no vlan vlan-id global configuration mode command. If a switch port is not configured for the correct VLAN, devices configured on that VLAN cannot connect to the router interface.