How to configure Multiple VLANs (QinQ) in Private Network

Description

Contents

Operating systems support matrix

Ubuntu

Configuration

Step1: Edit Netplan and add the following configuration for your QinQ VLAN. In our case it’s VLAN 100.

vi /etc/netplan/01-netcfg.yaml

vlans:
  vlan.100:
    id: 100
    link: eno2
    addresses: [192.168.1.100/24]

Run "netplan apply" command to apply the config changes. If necessary reboot the server

netplan apply

Important: To confirm that the QinQ VLAN works across the private network, you need to configure another server and do a simple ping test to verify.

Removal

Step 1: Remove the existing persistent configuration from Netplan

vi /etc/netplan/01-netcfg.yaml

vlans:
  vlan.100:
    id: 100
    link: eno2
    addresses: [192.168.1.100/24]

Step 2: Apply the config. If necessary reboot the server

netplan apply

Debian

Configuration

Step 1: Install the VLAN package

sudo apt update && sudo apt install vlan

Important: Only for Debian 9

modprobe 8021q

Step 2: Edit the interfaces file and add the following configuration for your QinQ VLAN. In our case it’s VLAN 100.

vi /etc/network/interfaces

auto vlan100
iface vlan100 inet static
        address 192.168.1.100/24
        vlan-raw-device eno2

Step 3: Save and apply the config by bringing the QinQ interface online using the ifup/ifdown command or by restaring the system Network service

ifup vlan100

Important: To confirm that the QinQ VLAN works across the private network, you need to configure another server and do a simple ping test to verify.

Removal

Step 1: Remove the existing persistent configuration from the "interfaces" file

Step 2: Apply and restart the Networking service if necessary

ifdown vlan100

CentOS / RockyLinux / AlmaLinux

Configuration

Step 1: Disable the NetworkManager service

Check the status of the NetworkManager.

sudo systemctl status NetworkManager

If NetworkManager is not running and you see Active: inactive (dead) you can proceed with step 2

If the NetworkManager service is active, it needs to be disabled

sudo systemctl stop NetworkManager

Step 2: Load kernel module

Check if kernel module 8021q is loaded.

sudo lsmod | grep 8021q

If it’s loaded, you will see an output similar to this:

If you do not, then it means that the module is not loaded. Load the kernel module.

sudo modprobe 8021q

To ensure that the kernel module 8021q is loaded during boot, we have to add the module into the modules configuration file.

sudo su -c 'echo "8021q" >> /etc/modules'

Step 3: Create a VLAN

Create a new configuration file for your QinQ VLAN. In our case it’s VLAN 100.

vi /etc/sysconfig/network-scripts/ifcfg-vlan100

Config:

DEVICE=vlan100
BOOTPROTO=none
ONBOOT=yes
IPADDR=192.168.1.100
PREFIX=24
PHYSDEV=eno2
VLAN=yes

Step 4: Restart the NetworkManager service so the interface is created and in 'up' state

systemctl status NetworkManager

The alternative is to use the ifdown or ifup commands

ifdown vlan100
ifup vlan100

Important: To confirm that the QinQ VLAN works across the private network, you need to configure another server and do a simple ping test to verify.

Removal

Remove the existing persistent configuration by reversing the steps from the Configuration part.

FreeBSD

Configuration

Edit the rc.conf file and add the following persistent configuration for your QinQ VLAN. In our case it’s VLAN 100.

vi /etc/rc.conf

vlans_bge1="100"
ifconfig_bge1_100="inet 192.168.1.100/24"

With the  "ifconfig" command you should see an ouput similar to this to confirm the creation of the interface:

Important: To confirm that the QinQ VLAN works across the private network, you need to configure another server and do a simple ping test to verify.

Removal

Remove the existing persistent configuration by reversing the steps from the Configuration part.

Windows

Configuration

Step 1: Check before creating VLAN

Go to "Control Panel\Network and Internet\Network Connections" and right-click on "Embedded LOM 1 Port 2".

Select "Properties", then click "Configure" button and select "Advanced" tab.

Make sure that no VLAN ID is set in the network adapter advanced settings (VLAN ID value= 0).

Step 2:  Create NIC Teaming

Go to Start → Server Manager → Select Local Server tab and enable the NIC Teaming by clicking on the link.

After enabling you get a "NIC Teaming" window. Under Teams section click Task →  New Team.

Specify the Team name (VLAN ID) as "100" - This is your QinQ VLAN Id and select Member adapters as "Embedded LOM 1 Port 2".

Step 3: Create an interface

In the “Adapter and Interfaces” section add virtual network interfaces. Click Tasks -> Add Interface

You need to create 2 interfaces to make sure it's hybrid (one with Default VLAN for the Private Network overall traffic and another with 100, for the QInQ VLAN).

• Default  VLAN (Private Network)
  

Add an interface with "VLAN 100" and select Default as VLAN Membership.

• QinQ VLAN
  

Click on the Add Interface again with Specific VLAN number.

After configuring you will see 2 new network connections under  "Control Panel\Network and Internet\Network Connections":

Step 4: Assigning IP Address

Go to "Control Panel\Network and Internet\Network Connections".

Right-click on the newly created connection "VLAN 100" and Select Properties. Afterwards select Internet Protocol Version 4 (TCP/IPv4) and click the Properties button.

Make sure "Obtain IP address automatically" is selected.

Right-click on the another newly created connection "VLAN100 - VLAN 100" and select Properties. Afterwards, select Internet Protocol Version 4 (TCP/IPv4) and click the Properties button.

Assign 192.168.1.100/24

Subnet Mask: 255.255.255.0

Important: To confirm that the QinQ VLAN works across the private network, you need to configure another server and do a simple ping test to verify.

An example, where we had another servers configured with 192.168.1.1 to verify that connectivity works.

Removal

Step 1: Delete Interfaces

In the “Adapter and Interfaces” section, select the two virtual network interfaces created for QinQ (one with Default Vlan & another with VLAN 100) and delete them.

Step 2: Disable Teaming

Go to Start → Server Manager → Select "Local Server" tab and Disable the NIC Teaming by clicking on the link "Enabled".

VMware ESXi

Configuration

• Virtual switch has to be created on the ESXi. In our case we've named it "Internal" followed by two port groups:
  1. Port group Internal access for untagged Private Network traffic
  2. Port group Internal VLAN 100 for the tagged QinQ VLAN 100 traffic

• Once we have the vSwitch and port-groups set, now we have to attach a NIC to the port-groups.
  • For this example, we've created a virtual machine that will have hybrid access to the Private Network by adding two Network Adapters to it.
    • Untagged Private Network
    • Tagged QinQ

Important: To confirm that the QinQ VLAN works across the private network, you need to configure another server and do a simple ping test to verify.

An example, where we had another server configured with 192.168.1.1 to verify that QinQ connectivity works.

Removal

Step 1: Delete Virtual switches if necessary

Go to "Host" -> "Networking" & select "Virtual switches" tab. From there, Delete the pre-created virtual switch "Internal".

Step 2: Delete the Port groups

Go to "Host" -> "Networking" & select "Port groups" tab. From there, Delete the pre-created Port group "Internal Vlan 100" that relates to the QinQ VLAN.

Leaseweb Rescue Mode (GRML)

Configuration

An example how to create QinQ VLAN interface using the "ifconfig" command

ip link add link eno2 name eno2.100 type vlan id 100
ip addr add 192.168.1.100/24 dev eno2.100
ip link set dev eno2.100 up

Removal

To remove VLAN 100 from the eno2 interface execute the following IP command.

ip link delete eno2.100

Leaseweb Rescue Mode (FreeBSD)

Configuration

An example how to create QinQ VLAN interface using the "ifconfig" command

ifconfig bge1.100 create vlan 100 vlandev bge1 inet 192.168.1.100/24

ifconfig vlan100 create
ifconfig vlan100 name bge1.100
ifconfig bge1.100 vlan 100 vlandev bge1 
ifconfig bge1.100 inet 192.168.1.100/24

Removal

To remove a VLAN interface execute the following command.

ifconfig {vlan-name} destroy

Troubleshooting

First and foremost, you need to have more than one servers configured with the same tagged QinQ VLAN Id within a single subnet to be inspect and troubleshoot any connectivity issues.

Ping

The most basic check is to ping another IP on the private network that has QinQ VLAN interface configured. You could also add the -I vlan100@eno2 (source interface option)

An example:

ping 192.168.1.1

Packet capture

Run tcpdump or other packet capture tool on a server QinQ VLAN interface. An example:

tcpdump -nnvvi eth0 'vlan and vlan and host 192.168.1.1'

With this sample command you'll be capturing VLAN and Non-VLAN Traffic within the private network at the same time.

The traffic within the private network is transparent. QinQ (802.1ad) just segments but not isolates the traffic.

Other

Check for existing firewall policies or rules in place that don't permit any traffic over the private network