Documentation/faq/vlan.rst

   1 ..
   2       Licensed under the Apache License, Version 2.0 (the "License"); you may
   3       not use this file except in compliance with the License. You may obtain
   4       a copy of the License at
   5
   6           http://www.apache.org/licenses/LICENSE-2.0
   7
   8       Unless required by applicable law or agreed to in writing, software
   9       distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  10       WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  11       License for the specific language governing permissions and limitations
  12       under the License.
  13
  14       Convention for heading levels in Open vSwitch documentation:
  15
  16       =======  Heading 0 (reserved for the title in a document)
  17       -------  Heading 1
  18       ~~~~~~~  Heading 2
  19       +++++++  Heading 3
  20       '''''''  Heading 4
  21
  22       Avoid deeper levels because they do not render well.
  23
  24 =====
  25 VLANs
  26 =====
  27
  28 Q: What's a VLAN?
  29
  30     A: At the simplest level, a VLAN (short for "virtual LAN") is a way to
  31     partition a single switch into multiple switches.  Suppose, for example,
  32     that you have two groups of machines, group A and group B.  You want the
  33     machines in group A to be able to talk to each other, and you want the
  34     machine in group B to be able to talk to each other, but you don't want the
  35     machines in group A to be able to talk to the machines in group B.  You can
  36     do this with two switches, by plugging the machines in group A into one
  37     switch and the machines in group B into the other switch.
  38
  39     If you only have one switch, then you can use VLANs to do the same thing,
  40     by configuring the ports for machines in group A as VLAN "access ports" for
  41     one VLAN and the ports for group B as "access ports" for a different VLAN.
  42     The switch will only forward packets between ports that are assigned to the
  43     same VLAN, so this effectively subdivides your single switch into two
  44     independent switches, one for each group of machines.
  45
  46     So far we haven't said anything about VLAN headers.  With access ports,
  47     like we've described so far, no VLAN header is present in the Ethernet
  48     frame.  This means that the machines (or switches) connected to access
  49     ports need not be aware that VLANs are involved, just like in the case
  50     where we use two different physical switches.
  51
  52     Now suppose that you have a whole bunch of switches in your network,
  53     instead of just one, and that some machines in group A are connected
  54     directly to both switches 1 and 2.  To allow these machines to talk to each
  55     other, you could add an access port for group A's VLAN to switch 1 and
  56     another to switch 2, and then connect an Ethernet cable between those
  57     ports.  That works fine, but it doesn't scale well as the number of
  58     switches and the number of VLANs increases, because you use up a lot of
  59     valuable switch ports just connecting together your VLANs.
  60
  61     This is where VLAN headers come in.  Instead of using one cable and two
  62     ports per VLAN to connect a pair of switches, we configure a port on each
  63     switch as a VLAN "trunk port".  Packets sent and received on a trunk port
  64     carry a VLAN header that says what VLAN the packet belongs to, so that only
  65     two ports total are required to connect the switches, regardless of the
  66     number of VLANs in use.  Normally, only switches (either physical or
  67     virtual) are connected to a trunk port, not individual hosts, because
  68     individual hosts don't expect to see a VLAN header in the traffic that they
  69     receive.
  70
  71     None of the above discussion says anything about particular VLAN numbers.
  72     This is because VLAN numbers are completely arbitrary.  One must only
  73     ensure that a given VLAN is numbered consistently throughout a network and
  74     that different VLANs are given different numbers.  (That said, VLAN 0 is
  75     usually synonymous with a packet that has no VLAN header, and VLAN 4095 is
  76     reserved.)
  77
  78 Q: VLANs don't work.
  79
  80     A: Many drivers in Linux kernels before version 3.3 had VLAN-related bugs.
  81     If you are having problems with VLANs that you suspect to be driver
  82     related, then you have several options:
  83
  84     - Upgrade to Linux 3.3 or later.
  85
  86     - Build and install a fixed version of the particular driver that is
  87       causing trouble, if one is available.
  88
  89     - Use a NIC whose driver does not have VLAN problems.
  90
  91     - Use "VLAN splinters", a feature in Open vSwitch 1.4 upto 2.5 that works
  92       around bugs in kernel drivers.  To enable VLAN splinters on interface
  93       eth0, use the command::
  94
  95           $ ovs-vsctl set interface eth0 other-config:enable-vlan-splinters=true
  96
  97       For VLAN splinters to be effective, Open vSwitch must know which VLANs
  98       are in use.  See the "VLAN splinters" section in the Interface table in
  99       ovs-vswitchd.conf.db(5) for details on how Open vSwitch infers in-use
 100       VLANs.
 101
 102       VLAN splinters increase memory use and reduce performance, so use them
 103       only if needed.
 104
 105     - Apply the "vlan workaround" patch from the XenServer kernel patch queue,
 106       build Open vSwitch against this patched kernel, and then use
 107       ovs-vlan-bug-workaround(8) to enable the VLAN workaround for each
 108       interface whose driver is buggy.
 109
 110       (This is a nontrivial exercise, so this option is included only for
 111       completeness.)
 112
 113     It is not always easy to tell whether a Linux kernel driver has buggy VLAN
 114     support.  The ovs-vlan-test(8) and ovs-test(8) utilities can help you test.
 115     See their manpages for details.  Of the two utilities, ovs-test(8) is newer
 116     and more thorough, but ovs-vlan-test(8) may be easier to use.
 117
 118 Q: VLANs still don't work.  I've tested the driver so I know that it's OK.
 119
 120     A: Do you have VLANs enabled on the physical switch that OVS is attached
 121     to?  Make sure that the port is configured to trunk the VLAN or VLANs that
 122     you are using with OVS.
 123
 124 Q: Outgoing VLAN-tagged traffic goes through OVS to my physical switch
 125 and to its destination host, but OVS seems to drop incoming return
 126 traffic.
 127
 128     A: It's possible that you have the VLAN configured on your physical switch
 129     as the "native" VLAN.  In this mode, the switch treats incoming packets
 130     either tagged with the native VLAN or untagged as part of the native VLAN.
 131     It may also send outgoing packets in the native VLAN without a VLAN tag.
 132
 133     If this is the case, you have two choices:
 134
 135     - Change the physical switch port configuration to tag packets it forwards
 136       to OVS with the native VLAN instead of forwarding them untagged.
 137
 138     - Change the OVS configuration for the physical port to a native VLAN mode.
 139       For example, the following sets up a bridge with port eth0 in
 140       "native-tagged" mode in VLAN 9::
 141
 142           $ ovs-vsctl add-br br0 $ ovs-vsctl add-port br0 eth0 tag=9
 143           vlan_mode=native-tagged
 144
 145       In this situation, "native-untagged" mode will probably work equally
 146       well.  Refer to the documentation for the Port table in
 147       ovs-vswitchd.conf.db(5) for more information.
 148
 149 Q: I added a pair of VMs on different VLANs, like this::
 150
 151     $ ovs-vsctl add-br br0
 152     $ ovs-vsctl add-port br0 eth0
 153     $ ovs-vsctl add-port br0 tap0 tag=9
 154     $ ovs-vsctl add-port br0 tap1 tag=10
 155
 156 but the VMs can't access each other, the external network, or the Internet.
 157
 158     A: It is to be expected that the VMs can't access each other.  VLANs are a
 159     means to partition a network.  When you configured tap0 and tap1 as access
 160     ports for different VLANs, you indicated that they should be isolated from
 161     each other.
 162
 163     As for the external network and the Internet, it seems likely that the
 164     machines you are trying to access are not on VLAN 9 (or 10) and that the
 165     Internet is not available on VLAN 9 (or 10).
 166
 167 Q: I added a pair of VMs on the same VLAN, like this::
 168
 169     $ ovs-vsctl add-br br0
 170     $ ovs-vsctl add-port br0 eth0
 171     $ ovs-vsctl add-port br0 tap0 tag=9
 172     $ ovs-vsctl add-port br0 tap1 tag=9
 173
 174 The VMs can access each other, but not the external network or the Internet.
 175
 176     A: It seems likely that the machines you are trying to access in the
 177     external network are not on VLAN 9 and that the Internet is not available
 178     on VLAN 9.  Also, ensure VLAN 9 is set up as an allowed trunk VLAN on the
 179     upstream switch port to which eth0 is connected.
 180
 181 Q: Can I configure an IP address on a VLAN?
 182
 183     A: Yes.  Use an "internal port" configured as an access port.  For example,
 184     the following configures IP address 192.168.0.7 on VLAN 9.  That is, OVS
 185     will forward packets from eth0 to 192.168.0.7 only if they have an 802.1Q
 186     header with VLAN 9.  Conversely, traffic forwarded from 192.168.0.7 to eth0
 187     will be tagged with an 802.1Q header with VLAN 9::
 188
 189         $ ovs-vsctl add-br br0
 190         $ ovs-vsctl add-port br0 eth0
 191         $ ovs-vsctl add-port br0 vlan9 tag=9 \
 192             -- set interface vlan9 type=internal
 193         $ ip addr add 192.168.0.7/24 dev vlan9
 194         $ ip link set vlan0 up
 195
 196     See also the following question.
 197
 198 Q: I configured one IP address on VLAN 0 and another on VLAN 9, like this::
 199
 200     $ ovs-vsctl add-br br0
 201     $ ovs-vsctl add-port br0 eth0
 202     $ ip addr add 192.168.0.5/24 dev br0
 203     $ ip link set br0 up
 204     $ ovs-vsctl add-port br0 vlan9 tag=9 -- set interface vlan9 type=internal
 205     $ ip addr add 192.168.0.9/24 dev vlan9
 206     $ ip link set vlan0 up
 207
 208 but other hosts that are only on VLAN 0 can reach the IP address configured on
 209 VLAN 9.  What's going on?
 210
 211     A: `RFC 1122 section 3.3.4.2 "Multihoming Requirements"
 212     <https://tools.ietf.org/html/rfc1122>`__ describes two approaches to IP
 213     address handling in Internet hosts:
 214
 215     - In the "Strong ES Model", where an ES is a host ("End System"), an IP
 216       address is primarily associated with a particular interface.  The host
 217       discards packets that arrive on interface A if they are destined for an
 218       IP address that is configured on interface B.  The host never sends
 219       packets from interface A using a source address configured on interface
 220       B.
 221
 222     - In the "Weak ES Model", an IP address is primarily associated with a
 223       host.  The host accepts packets that arrive on any interface if they are
 224       destined for any of the host's IP addresses, even if the address is
 225       configured on some interface other than the one on which it arrived.  The
 226       host does not restrict itself to sending packets from an IP address
 227       associated with the originating interface.
 228
 229     Linux uses the weak ES model.  That means that when packets destined to the
 230     VLAN 9 IP address arrive on eth0 and are bridged to br0, the kernel IP
 231     stack accepts them there for the VLAN 9 IP address, even though they were
 232     not received on vlan9, the network device for vlan9.
 233
 234     To simulate the strong ES model on Linux, one may add iptables rule to
 235     filter packets based on source and destination address and adjust ARP
 236     configuration with sysctls.
 237
 238     BSD uses the strong ES model.
 239
 240 Q: My OpenFlow controller doesn't see the VLANs that I expect.
 241
 242     A: The configuration for VLANs in the Open vSwitch database (e.g. via
 243     ovs-vsctl) only affects traffic that goes through Open vSwitch's
 244     implementation of the OpenFlow "normal switching" action.  By default, when
 245     Open vSwitch isn't connected to a controller and nothing has been manually
 246     configured in the flow table, all traffic goes through the "normal
 247     switching" action.  But, if you set up OpenFlow flows on your own, through
 248     a controller or using ovs-ofctl or through other means, then you have to
 249     implement VLAN handling yourself.
 250
 251     You can use "normal switching" as a component of your OpenFlow actions,
 252     e.g. by putting "normal" into the lists of actions on ovs-ofctl or by
 253     outputting to OFPP_NORMAL from an OpenFlow controller.  In situations where
 254     this is not suitable, you can implement VLAN handling yourself, e.g.:
 255
 256     - If a packet comes in on an access port, and the flow table needs to send
 257       it out on a trunk port, then the flow can add the appropriate VLAN tag
 258       with the "mod_vlan_vid" action.
 259
 260     - If a packet comes in on a trunk port, and the flow table needs to send it
 261       out on an access port, then the flow can strip the VLAN tag with the
 262       "strip_vlan" action.
 263
 264 Q: I configured ports on a bridge as access ports with different VLAN tags,
 265 like this::
 266
 267     $ ovs-vsctl add-br br0
 268     $ ovs-vsctl set-controller br0 tcp:192.168.0.10:6653
 269     $ ovs-vsctl add-port br0 eth0
 270     $ ovs-vsctl add-port br0 tap0 tag=9
 271     $ ovs-vsctl add-port br0 tap1 tag=10
 272
 273 but the VMs running behind tap0 and tap1 can still communicate, that is, they
 274 are not isolated from each other even though they are on different VLANs.
 275
 276     A: Do you have a controller configured on br0 (as the commands above do)?
 277     If so, then this is a variant on the previous question, "My OpenFlow
 278     controller doesn't see the VLANs that I expect," and you can refer to the
 279     answer there for more information.
 280
 281 Q: How MAC learning works with VLANs?
 282
 283     A: Open vSwitch implements Independent VLAN Learning (IVL) for
 284     ``OFPP_NORMAL`` action, e.g. it logically has separate learning tables for
 285     each VLANs.