Overview

802.1q is a standard that supports VLAN tagging on an ethernet network.

This article will explain how to configure a switchport on a Cisco switch for vlan tagging, as well as how to configure an Ubuntu linux server for 802.1q (vlan) tagging.

Cisco Setup

All I am doing here is trunking one interface (G2/0/18) and restricting access to two vlans (101 and 102).

switch#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
switch01(config)#interface G1/0/18
switch01(config-if)#switchport trunk encapsulation dot1q
switch01(config-if)#switchport mode trunk
switch01(config-if)#switchport trunk allowed vlan 101,102
switch01(config-if)#exit
switch01(config)#exit
switch01#show running-config interface G1/0/18
Building configuration...

Current configuration : 167 bytes
!
interface GigabitEthernet1/0/18
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 101,102
 switchport mode trunk
end

switch01#

Linux Setup

  1. Add the 8021q module to the kernel
    # modprobe 8021q
  2. Add the module to the /etc/modules file, so that it loads at next startup
    # echo 8021q >> /etc/modules
  3. Install the appropriate package
    # apt-get install vlan
  4. Configure the network. In my example, eth0 is connected to the trunk port on a Cisco switch, with vlans 101 and 102 trunked. eth1 is connected to a separate network and switch.
    # cat /etc/network/interfaces.
    
    auto eth0.101
    iface eth0.101 inet static
        address 172.17.101.9
        netmask 255.255.255.0
        network 172.17.101.0
        broadcast 172.17.101.255
        gateway 172.17.101.1
        vlan_raw_device eth0
    
    auto eth0.102
    iface eth0.102 inet static
        address 172.17.102.9
        netmask 255.255.255.0
        network 172.17.102.0
        broadcast 172.17.102.255
        vlan_raw_device eth0
    
    auto eth1
    iface eth1 inet static
        address 172.17.100.9
        netmask 255.255.255.0
        network 172.17.100.0
        broadcast 172.17.100.255
  5. Restart networking. I came across inconsistent results by using /etc/init.d/networking restart and the ifup and ifdown commands. While your mileage may vary, I just rebooted the box.
  6. Make sure things are working. As you can see, eth0 does not have an ip address, while the vlan interfaces, eth0.101 and eth0.102, do.
    kmjohnson@squid:~$ ifconfig
    eth0      Link encap:Ethernet  HWaddr 14:fe:b5:2c:15:86
              inet6 addr: fe80::16fe:b5ff:fe2c:1586/64 Scope:Link
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:23763 errors:0 dropped:0 overruns:0 frame:0
              TX packets:10485 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:1000
              RX bytes:3481376 (3.4 MB)  TX bytes:2500480 (2.5 MB)
              Interrupt:36 Memory:d6000000-d6012800 
    
    eth1      Link encap:Ethernet  HWaddr 14:fe:b5:2c:15:88
              inet addr:172.17.100.9  Bcast:172.17.100.255  Mask:255.255.255.0
              inet6 addr: fe80::16fe:b5ff:fe2c:1588/64 Scope:Link
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:973 errors:0 dropped:0 overruns:0 frame:0
              TX packets:257 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:1000
              RX bytes:75737 (75.7 KB)  TX bytes:29086 (29.0 KB)
              Interrupt:48 Memory:d8000000-d8012800 
    
    eth0.101  Link encap:Ethernet  HWaddr 14:fe:b5:2c:15:86
              inet addr:172.17.101.9  Bcast:172.17.101.255  Mask:255.255.255.0
              inet6 addr: fe80::16fe:b5ff:fe2c:1586/64 Scope:Link
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:17260 errors:0 dropped:0 overruns:0 frame:0
              TX packets:10350 errors:0 dropped:4 overruns:0 carrier:0
              collisions:0 txqueuelen:0
              RX bytes:2445291 (2.4 MB)  TX bytes:2400114 (2.4 MB)
    
    eth0.102  Link encap:Ethernet  HWaddr 14:fe:b5:2c:15:86
              inet addr:172.17.102.9  Bcast:172.17.102.255  Mask:255.255.255.0
              inet6 addr: fe80::16fe:b5ff:fe2c:1586/64 Scope:Link
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:6503 errors:0 dropped:0 overruns:0 frame:0
              TX packets:101 errors:0 dropped:3 overruns:0 carrier:0
              collisions:0 txqueuelen:0
              RX bytes:513299 (513.2 KB)  TX bytes:8438 (8.4 KB)
    
    lo        Link encap:Local Loopback
              inet addr:127.0.0.1  Mask:255.0.0.0
              inet6 addr: ::1/128 Scope:Host
              UP LOOPBACK RUNNING  MTU:16436  Metric:1
              RX packets:277 errors:0 dropped:0 overruns:0 frame:0
              TX packets:277 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:0
              RX bytes:25230 (25.2 KB)  TX bytes:25230 (25.2 KB)
    
    kmjohnson@squid:~$ ping 172.17.101.1
    PING 172.17.101.1 (172.17.101.1) 56(84) bytes of data.
    64 bytes from 172.17.101.1: icmp_seq=1 ttl=64 time=0.124 ms
    ^C
    --- 172.17.101.1 ping statistics ---
    1 packets transmitted, 1 received, 0% packet loss, time 0ms
    rtt min/avg/max/mdev = 0.124/0.124/0.124/0.000 ms
    kmjohnson@squid:~$ ping 172.17.102.1
    PING 172.17.102.1 (172.17.102.1) 56(84) bytes of data.
    64 bytes from 172.17.102.1: icmp_seq=1 ttl=64 time=9.39 ms
    ^C
    --- 172.17.102.1 ping statistics ---
    1 packets transmitted, 1 received, 0% packet loss, time 0ms
    rtt min/avg/max/mdev = 9.391/9.391/9.391/0.000 ms
    kmjohnson@squid:~$

Issues

I ran into an issue where when connecting to an interface that did not have a gateway defined (eth0.102), the packet was being dropped by the kernel. To fix this, the following two lines were needed in /etc/sysctl.conf:

net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.all.rp_filter=0