# bridge with vlans not working



## Abdullah (Apr 21, 2018)

Hello
I would like to get some help regarding a little problem i am facing. I create bridge0 and assign 2 interfaces igb6 and igb7 to it. Connecting 2 systems to these ports and they are able to ping each other (both of 10.10.10.0/24 series for testing).
Next I create vlan_igb5 with parent interface igb5 and vlan_igb6 with parent igb6. Remove parent interfaces from bridge0 and assign vlan_igb5 vlan_igb6 to the bridge, I can't seem to ping no matter what. Can anyone please guide what is wrong?


----------



## SirDice (Apr 23, 2018)

Does the switch you're connected to support VLANs? And have those ports been configured for VLANs?


----------



## Abdullah (Apr 24, 2018)

Thank you for replying SirDice.
This is simply a testing scenario. I have 8 ports on my lanner fw8894. Tested out bridges first by assigning 2 ports (igb5 and igb6). Connected 2 pcs to those ports with same network and they were able to ping each other. tcpdump on the bridge shows packets coming and going just fine
Now i am trying to test out vlans (having parents igb5 and igb6) by assigning them to the bridge (igb5 and igb6 now replaced by the respective vlans). Now these 2 systems dont communicate no matter what. I think since both the vlans are on the bridge they should communicate and traffic should be tagged. Am i wrong in my assumption? tcpdump doesnt show anything on the bridge either.

Also if i assign vlan to bridge and try to run stp, i get this error
ifconfig: unable to set bridge flags: Invalid argument


Tried it another way too. Assigned igb5 and igb6 to the bridge,  created a vlan with the bridge as parent. Both the devices communicate but when i run tcpdump on the created vlan, there is nothing. I assume there is no tagged traffic if done this way?


----------



## SirDice (Apr 24, 2018)

The switch and the switch ports you are connected to have to be configured for VLANs too. You can't enable VLAN tagging and expect a non-managed switch to understand those tags.


----------



## Abdullah (Apr 24, 2018)

Sorry i think i couldnt make it clear, attaching a diagram.


----------



## SirDice (Apr 24, 2018)

It sounds like your VLAN 20 is untagged. That means there's no VLAN header any more on the packets. That's why it works if you remove the VLAN from the bridge.

The ports need to be configured as a "trunk" (Cisco-speak), that means VLAN 20 needs to be tagged on the Lanner device.


----------



## Abdullah (Apr 24, 2018)

using this

```
ifconfig vlan2 create vlan 20 vlandev igb5
ifconfig vlan3 create vlan 20 vlandev igb6
ifconfig bridge10 create addm vlan2 addm vlan3 up
```

is this correct?


----------



## phoenix (Apr 24, 2018)

Yes, that's correct.  But *only* if you have also configured the two ports on the switch to be part of tagged vlan 20.  If you have not configured that on the switch, then it won't work (packets will not be passed through).


----------



## Abdullah (Apr 25, 2018)

So 2 systems connected via same box running freebsd part and of same vlan (which are bridged) will not be able to communicate with each other? like when 2 systems do when the parent interfaces are made part of a bridge?


----------



## SirDice (Apr 25, 2018)

Please draw a diagram of how everything is connected. The way you are explaining it is extremely confusing.


----------



## PacketMan (Apr 25, 2018)

phoenix said:


> Yes, that's correct.  But *only* if you have also configured the two ports on the switch to be part of tagged vlan 20.  If you have not configured that on the switch, then it won't work (packets will not be passed through).



Following on this, and using a flavour of Cisco switch as an example:


```
!
vlan 21
name data_vlan_1
!
vlan 22
name data_vlan_2
!
vlan 23
name data_vlan_3
!
!
! The following ports are accesss (non-tagged-mode)
!
interface GigabitEthernet0/1
description L2 Access_data_vlan_1
switchport access vlan 21
switchport mode access
media-type rj45
no shutdown
!
interface GigabitEthernet0/2
description L2 Access_data_vlan_1
switchport access vlan 21
switchport mode access
media-type rj45
no shutdown
!
interface GigabitEthernet0/3
description L2 Access_data_vlan_2
switchport access vlan 22
switchport mode access
media-type rj45
no shutdown
!
interface GigabitEthernet0/4
description L2 Access_data_vlan_2
switchport access vlan 22
switchport mode access
media-type rj45
no shutdown
!
interface GigabitEthernet0/5
description L2 Access_data_vlan_3
switchport access vlan 23
switchport mode access
media-type rj45
no shutdown
!
interface GigabitEthernet0/6
description L2 Access_data_vlan_3
switchport access vlan 23
switchport mode access
media-type rj45
no shutdown
!
!
! The following ports are in 802.1q trunk mode (packets are tagged vlan 802.1q vlan IDs)
!
interface GigabitEthernet0/7
description L2 Trunk_data_vlan_21_22
switchport trunk allowed vlan 21,22
switchport mode trunk
media-type rj45
no shutdown
!
interface GigabitEthernet0/8
description L2 Trunk_data_vlan_22_23
switchport trunk allowed vlan 22,23
switchport mode trunk
media-type rj45
no shutdown
!
interface GigabitEthernet0/9
description L2 Trunk_data_vlan_21_23
switchport trunk allowed vlan 21,23
switchport mode trunk
media-type rj45
no shutdown
!
interface GigabitEthernet0/10
description L2 Trunk_data_vlan_21_to_23
switchport trunk allowed vlan 21-23
switchport mode trunk
media-type rj45
no shutdown
!
!
!
! If this switch is multilayer switch, meaning it can do routing then routing configuration can look like this,
! and if you want this switch to be the router:
!
interface vlan 21
description L3 Interface for vlan 21
ip address 10.10.21.1 255.255.255.0
no shutdown
!
interface vlan 22
description L3 Interface for vlan 22
ip address 10.10.22.1 255.255.255.0
no shutdown
!
interface vlan 23
description L3 Interface for vlan 23
ip address 10.10.23.1 255.255.255.0
no shutdown
!
```

Hope this helps a bit.


----------



## Abdullah (Apr 25, 2018)

PacketMan said:


> Following on this, and using a flavour of Cisco switch as an example:
> 
> 
> ```
> ...


Thanks packet man, will look into it and follow up!


----------



## Abdullah (Apr 25, 2018)

SirDice said:


> Please draw a diagram of how everything is connected. The way you are explaining it is extremely confusing.


SirDice  attached a diagram
2 vlans tagged 5 


```
ifconfig vlan2 create vlan 5 vlandev igb5
ifconfig vlan3 create vlan 5 vlandev igb6
ifconfig bridge10 create addm vlan2 addm vlan3 up
```

If I bridge using physical interfaces, the systems are able to ping each other but when I bridge the vlans as shown above, I am not able to. Is it possible?


----------



## SirDice (Apr 25, 2018)

If you enable VLAN tagging on the FreeBSD host (igb5 and igb6) you will need to enable VLAN tagging on both PC1 and PC2 too.

And I assume you're doing this for exercise/experimentation because it's rather useless to enable VLAN tagging in this way.


----------



## Abdullah (Apr 25, 2018)

SirDice said:


> If you enable VLAN tagging on the FreeBSD host (igb5 and igb6) you will need to enable VLAN tagging on both PC1 and PC2 too.
> 
> And I assume you're doing this for exercise/experimentation because it's rather useless to enable VLAN tagging in this way.


experimentation it is 
sorry for having caused so much trouble in asking a simple question. Thanks


----------



## phoenix (Apr 25, 2018)

Abdullah said:


> SirDice  attached a diagram
> 2 vlans tagged 5
> 
> 
> ...



This would fail.

PC1 would send packets without any vlan tags attached (so they belong to the "DEFAULT" vlan aka vlan 1).  igb0 on FreeBSD would receive the packet, compare the vlan tag to what it's configured to use (1 <--> 5), see they are not equal, and would drop the packet.

Same for PC2.  It would send untagged packets (aka vlan tag 1) to igb1.  FreeBSD would compare vlan tags, see they don't match what's set on igb1, and drop the packets.

If you configure PC1 and PC2 to also use tagged vlan 5, then the bridge configuration using tagged vlan 5 interfaces would work.

This is why I mentioned you need to configure the switch to use the same vlan tagging setup as the bridge interfaces.  Or, configure all devices plugged into the vlan interfaces to use the same vlan configuration.  Either everything uses untagged vlans, or everything uses tagged vlans.  Either way, the vlan tag number needs to match for packets to pass through interfaces.


----------



## Abdullah (Apr 26, 2018)

phoenix said:


> This would fail.
> 
> PC1 would send packets without any vlan tags attached (so they belong to the "DEFAULT" vlan aka vlan 1).  igb0 on FreeBSD would receive the packet, compare the vlan tag to what it's configured to use (1 <--> 5), see they are not equal, and would drop the packet.
> 
> ...


thanks for replying, it is perfectly clear now. 
Do you think it is possible using netgraph modules?


----------



## phoenix (Apr 26, 2018)

No.  You can't connect a system sending untagged packets (PC1/PC2 in your setup) with a system expecting tagged packets (FreeBSD system).  You have to match the tagging setup, and the vlan number, in order to connect systems.  (The default network setup is untagged vlan 1, which is what you get when you don't configure vlans anywhere, and just plug cables into switches.)

You either need to configure PC1/PC2 to use tagged vlan 5 (not impossible if they're Windows but it's NIC driver-dependent) in order to connect to FreeBSD using tagged vlan 5.

Or, you need to configure FreeBSD to use untagged vlan 1 (aka just the interface in the bridge) in order to connect to PC1/PC2.


----------



## Abdullah (Apr 27, 2018)

so the bridge is vlan 1 (untagged) , physical ports part of the bridge will communicate but vlans (sub interfaces created on physical interfaces wont).
lastly is it possible for freebsd system to put tags at ingress ?


----------



## phoenix (Apr 28, 2018)

Tags are compared on ingress and only packets that match the tag of the interface are allowed.

Tags are added to packets on egress based on the settings for the interface.


----------



## phoenix (Apr 28, 2018)

As mentioned in email, thinking in switch terms:

FreeBSD supports access ports (untagged vlan only)
FreeBSD supports trunk ports (tagged vlans only)
FreeBSD does not support hybrid ports (untagged packets get tagged with the PVID of the port, tagged vlans are allowed)
FreeBSD has no concept of a PVID (port virtual ID)
What you are trying to do requires a hybrid port, where the port is configured with a PVID of 5, and is part of tagged vlan 5. That way, any packets tagged with vlan 5 are accepted. And any untagged packets that arrive are tagged with 5 and accepted. FreeBSD doesn't support that.


----------



## Deever (Apr 28, 2018)

I'm actually trying something like this in Thread 65645 and looking for a less clumsy solution than mine...!


----------

