# VLANs and 802.1q



## zbr (Jan 22, 2020)

Hello everyone.

I am trying to understand how does the FreeBSD handle VLANs. The documentation for this process is scarce and not clear enough. Man pages are also kind of brief and are not providing enough information. Here's the topo:

`M1: re0 (192.168.7.1)<-----------------[trunk carrying vlans 3 and 7]----------------->bce2: FBSDr :bce1 <----------[carries vlan 7]----------> ge0/1 (192.168.7.2):CISCO router`

CISCO router is a C2900 router, configured as follows:
`(...)
!
interface GigabitEthernet0/1
ip address 192.168.7.2 255.255.255.0
duplex auto
speed auto
vlan-id dot1q 7
  description vlan7
  exit-vlan-config
!
!
(...)`

Now, what I want to achieve is to be able to send both traffic tagged with vlanid=3 and with vlanid=8 through the trunk (bce2) on FBSDr.

I would be grateful if you could tell me what am I doing wrong.

I'm starting off with creating vlan devices, the bridge, and binding them together.
`root@hp-fbsd-11:/home/zbr # ifconfig vlan3 create
root@hp-fbsd-11:/home/zbr # ifconfig vlan7 create
root@hp-fbsd-11:/home/zbr # ifconfig vlan37 create
root@hp-fbsd-11:/home/zbr # ifconfig bridge0 create
root@hp-fbsd-11:/home/zbr # ifconfig vlan3 vlan 3 vlandev bce2 up
root@hp-fbsd-11:/home/zbr # ifconfig vlan7 vlan 7 vlandev bce1 up
root@hp-fbsd-11:/home/zbr # ifconfig vlan37 vlan 7 vlandev bce2 up
root@hp-fbsd-11:/home/zbr # ifconfig bridge0 addm vlan3 addm vlan37 addm vlan7 up`

Also, similar configuration is done at M1 for re0.

My understanding is, that at this point, it should work as intended, but it is not. When I ping 192.168.7.1 from 192.168.7.2, ARP request is being generated, which can be seen on bce1. However, it is never passed further for bce2 (nor can be seen on any of vlan# interfaces). What am I getting wrong here ? Interestingly, those arps are not visible when sniffing on bridge0 either (and after *brief* peek at the code, I believe it should be).

It would help me greatly (and save me a tons of time that I will have to spend on looking at the code) if anyone would be so nice and help me out with this!

Thank you in advance.


----------



## SirDice (Jan 22, 2020)

zbr said:


> I'm starting off with creating vlan devices, the bridge, and binding them together.


Don't bridge them as that will connect all your VLANs on layer 2 negating the whole point of VLANs. Create the VLAN interfaces and use plain ordinary layer 3 routing. A vlan(4) interface is just like a 'regular' ethernet interface, except it adds the VLAN frame before putting it on the (trunk) interface. In my case my em1 is a trunk interface that's connected to a trunked port on the switch. 


```
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 9000
        options=209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC>
        ether 90:e2:ba:54:ff:22
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
em1.1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 9000
        options=3<RXCSUM,TXCSUM>
        ether 90:e2:ba:54:ff:22
        inet 10.0.0.1 netmask 0xffffff00 broadcast 10.0.0.255
        groups: vlan
        vlan: 1 vlanpcp: 0 parent interface: em1
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
em1.10: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 9000
        options=3<RXCSUM,TXCSUM>
        ether 90:e2:ba:54:ff:22
        inet 192.168.10.1 netmask 0xffffff00 broadcast 192.168.10.255
        inet6 fe80::92e2:baff:fe54:ff22%em1.10 prefixlen 64 scopeid 0x7
        inet6 2001:470:1f15:bcd::1 prefixlen 64
        groups: vlan
        vlan: 10 vlanpcp: 0 parent interface: em1
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
 em1.11: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 9000
        options=3<RXCSUM,TXCSUM>
        ether 90:e2:ba:54:ff:22
        inet 192.168.11.1 netmask 0xffffff00 broadcast 192.168.11.255
        inet6 fe80::92e2:baff:fe54:ff22%em1.11 prefixlen 64 scopeid 0x8
        inet6 2001:470:7989:11::1 prefixlen 64
        groups: vlan
        vlan: 11 vlanpcp: 0 parent interface: em1
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
em1.20: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 9000
        options=3<RXCSUM,TXCSUM>
        ether 90:e2:ba:54:ff:22
        inet 10.0.1.1 netmask 0xffffff00 broadcast 10.0.1.255
        inet6 fe80::92e2:baff:fe54:ff22%em1.20 prefixlen 64 scopeid 0x9
        inet6 2001:470:7989:20::1 prefixlen 64
        groups: vlan
        vlan: 20 vlanpcp: 0 parent interface: em1
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
```
Important bits from rc.conf:

```
ifconfig_em1="up mtu 9000"
vlans_em1="1 10 11 20"
ifconfig_em1_1="inet 10.0.0.1 netmask 255.255.255.0"
ifconfig_em1_10="inet 192.168.10.1 netmask 255.255.255.0"
ifconfig_em1_11="inet 192.168.11.1 netmask 255.255.255.0"
ifconfig_em1_20="inet 10.0.1.1 netmask 255.255.255.0"
```

Routing table:

```
root@maelcum:~ # netstat -rn4
Routing tables

Internet:
Destination        Gateway            Flags     Netif Expire
default            X.X.X.X       UGS         em0
10.0.0.0/24        link#6             U         em1.1
10.0.0.1           link#6             UHS         lo0
10.0.1.0/24        link#9             U        em1.20
10.0.1.1           link#9             UHS         lo0
X.X.X.0/24    link#2             U           em0
X.X.X.X     link#2             UHS         lo0
127.0.0.1          link#4             UH          lo0
192.168.10.0/24    link#7             U        em1.10
192.168.10.1       link#7             UHS         lo0
192.168.11.0/24    link#8             U        em1.11
192.168.11.1       link#8             UHS         lo0
192.168.21.0/24    X.X.X.X       US          em0
```


----------



## zbr (Jan 22, 2020)

Hello SirDice. Thank you for your time to answer. Sorry if that's a stupid question/request, but could you please elaborate on why would connecting these vlans via bridge would negate point of VLANs ? What about managed L2 switches ? They are configurable to take advantage of vlans, yet don't use Layer 3 (routing). There's certainly (?) a point in using vlans purely in layer 2.


----------



## SirDice (Jan 22, 2020)

VLANs are used to _separate_ broadcast domains, bridges are used to _combine_ broadcast domains. They're pretty much the polar opposites of each other. 



zbr said:


> What about managed L2 switches ?


Layer 2 switches don't allow you to tie two different VLANs into one broadcast domain. 



zbr said:


> They are configurable to take advantage of vlans, yet don't use Layer 3 (routing).


Correct. But you can't push traffic from one VLAN to another either. Each VLAN is separated from the others. Which is why you need a separate router in order for two networks to talk to each other. A layer 3 switch has this routing functionality built-in.



zbr said:


> There's certainly (?) a point in using vlans purely in layer 2.


Yes, to split up your broadcast domains.


----------



## zbr (Jan 22, 2020)

SirDice said:


> VLANs are used to _separate_ broadcast domains, bridges are used to _combine_ broadcast domains. They're pretty much the polar opposites of each other.



Hmmm.. never looked at it from this perspective. Fact is the last time I used vlans was like 10 years ago. I think this is all clear now ! Thank you so much!

I believe my confusion originated by the fact, that I had to deal with Linux recently, and wanting to achieve something similar, I've stumbled upon this:
How do VLAN access ports and trunk ports work on Linux?

Commands semantics is completely different (or it's just me?), hence the confusion.


----------



## LVLouisCyphre (Jan 23, 2020)

One of the purposes of segregation of broadcast domains is for security such as for DMZs or to segregate your wired from your WiFi networks.  You run 802.1q trunking on your router for interVLAN routing if the switch doesn't do L3 switching.  Cisco referred to this practice as a router on a stick. The router on a stick link should clear up how VLANs and interVLAN routing works especially since the OP is using Cisco equipment.


----------

