Below is using VyOS 1.5-rolling-202310240118.
Im currently trying to reconstruct my VyOS template so it will be using VLANs on bridges instead of directly on physical interfaces (the later have already been confirmed to be working).
That is instead of configure “interface ethernet ethX” with a vif (or setting address without a vif), I will create a vif on a bridge and then make physical interfaces members to this bridge (and define which VLANs will be exposed to each member along which should be 802.1Q tagged and untagged (only one can be untagged per physical interface)).
The advantage is that with a bridge you can put the same VLAN on several physical interfaces making the configuration more like how you setup a L3-switch with switchports from other vendors.
And then you can select which VLANs will be pure layer2 VLANs and which will have a VLAN-interface configured to be used as gateway for the hosts who belongs to this VLAN. Along with which will be 802.1Q tagged and which will be untagged.
Using L3-switches from other vendors you would do something like:
To create the VLANs:
vlan 99, 100, 200, 300
And then if you want to set IP-address for such VLAN you would do:
interface Vlan99
description MGMT
ip address 192.168.56.2/24
vrf MGMT
!
And finally attach this VLAN to a physical interface and select if this should be 802.1Q tagged or untagged in both directions:
interface Ethernet0
description MGMT
switchport access vlan 99
switchport trunk native vlan 99
switchport trunk allowed vlan 99, 100, 200, 300
switchport mode trunk
vrf MGMT
!
In above example if you will only do untagged traffic then just the “switchport access” would be defined while if you would mix and want vlan 99 to be the untagged vlan (in both directions) you would use the “switchport trunk” lines and finally if vlan 99 would only exist as a tagged vlan you would remove that “switchport trunk native vlan” line. Also dont forget to change the operation with “switchport mode”.
Now… when I attempt to do the above in VyOS I fail… that is use a template where I in the end define that vlan 99 would be untagged on a particular member interface.
My MGMT-interface cannot ping any other host and other hosts cannot ping the MGMT-interface of VyOS, no arp shows up.
Digging through the manual I found this:
https://docs.vyos.io/en/latest/configuration/interfaces/bridge.html#enable-vlan-aware-bridge
It is not valid to use the vif 1 option for VLAN aware bridges because VLAN aware bridges assume that all unlabeled packets belong to the default VLAN 1 member and that the VLAN ID of the bridge’s parent interface is always 1
Which is also confirmed if looking in /usr/lib/python3/dist-packages/vyos/ifconfig/bridge.py who at around line 312 says:
# VLAN of bridge parent interface is always 1. VLAN 1 is the default
# VLAN for all unlabeled packets.
and then the command:
cmd = f'bridge vlan add dev {self.ifname} vid 1 pvid untagged self'
I assume my problem could be related to above because what I try to do when it comes to the MGMT-interface is to set it up as with any other VLAN-interface.
Even if this isnt necessary (I could just ignore using a bridge for that and configure it directly on the physical interface instead) I would use the same method no matter what kind of interface I am configuring (MGMT, WAN, LAN etc) and also have the advantage of having the MGMT-interface as a vif in a bridge which gives I can easily enable 2 (or more) physical interfaces to be part of the MGMT or for that matter select if it should be tagged or untagged at which member interface.
Or am I doing something wrong with my current attempt in VyOS?
The current config looks like this:
set interfaces bridge br0 description 'VRF_MGMT'
set interfaces bridge br0 enable-vlan
set interfaces bridge br0 member interface eth0 allowed-vlan '99'
set interfaces bridge br0 member interface eth0 native-vlan '99'
set interfaces bridge br0 vif 99 address '192.168.56.2/24'
set interfaces bridge br0 vif 99 description 'MGMT'
set interfaces bridge br0 vif 99 vrf 'VRF_MGMT'
set interfaces bridge br0 vrf 'VRF_MGMT'
The current idea is that br0 is used by VRF_MGMT and br1 is used by VRF_INTERNET (as in one bridge per VRF).
I mean sure I could just ignore defining vif 99 and configure IP-address directly on the br0 but this would break the idea of using “same template no matter what kind of purpose” (as in first define vif in each bridge, then define which vif will be used at which member (physical interface) and finally if that vif would be 802.1Q tagged or untagged on that member).
Doing a bridge vlan show it looks ok?
vyos@vyos:~$ bridge vlan show
port vlan-id
eth0 99 PVID Egress Untagged
eth1 100 PVID Egress Untagged
eth2 200 PVID Egress Untagged
eth3 300 PVID Egress Untagged
br0 1 PVID Egress Untagged
99
br1 1 PVID Egress Untagged
100
200
300
I think the error is when VyOS receives the packets - it will then internally put untagged ethernet frames as VLAN 1 which of course wont work.
I want whatever untagged is received on member eth0 to be put into VLAN 99.
So Im guessing I might be missing something here?
