Glossary		Print Page		Document Feedback		Support & Services		Pluribus Networks		Pluribus Blog		LinkedIn		Facebook		Twitter

Understanding and Configuring VLANs

A Virtual Local Area Network (VLAN) enables devices to be segmented into logically separate broadcast domains within the same LAN. VLANs improve network performance by directing network traffic only to the parts of the network that need to receive it. Network segments so created keep traffic isolated based on the respective VLAN IDs associated to the transmitted frames. Applying targeted security features to specific network areas is also made simpler through the use of VLANs.

As per the standards, NetVisor OS uses the 12-bit field in the header of each packet as a VLAN identifier or VLAN tag. The maximum number of VLANs that can be defined is 4092. VLANs 4093, 4094, and 4095 are reserved for internal use while VLAN 1 is the default fabric VLAN for untagged traffic. Untagged packets can be mapped to any VLAN, but NetVisor OS maps this traffic to VLAN 1 by default.

Configuring an untagged VLAN is necessary while connecting a switch to devices that do not support IEEE802.1Q VLAN tags. The ports on a switch can be configured to automatically map untagged packets to a specific VLAN. NetVisor OS also allows you to block untagged traffic on a port basis, that is, the untagged VLAN on a port can be removed or deleted.

About VLAN 1

VLAN 1 is enabled on all ports by default. However, VLAN 1 can be removed from any port on which it is the untagged VLAN. Now, the port has no untagged VLANs and all untagged traffic is dropped on that port.
To generalize the point above, if VLAN x is the untagged VLAN for a port and if VLAN x is removed from that port, then the port has no untagged VLAN and all untagged traffic is dropped on that port.
VLAN 1 can also function as a tagged VLAN for a port. This happens automatically in cases where VLAN 1 is the default untagged VLAN, and then another VLAN is configured as an untagged VLAN on the port.
VLAN 1 cannot be created or deleted. VLAN 1 configuration is stored in persistent storage.

The default fabric VLAN can be changed from VLAN 1 to another VLAN ID using the command fabric-local-modify.For example, to set VLAN 20 as the default fabric VLAN, use the command:

CLI (network-admin@Leaf1) > fabric-local-modify vlan 20

Warning: If you create a VLAN with scope fabric and configure it as the untagged VLAN on all ports, it can disrupt the fabric communication.

Note: The untagged VLAN feature is not the same as the default VLAN using the IEEE 802.1Q tag 1.

The vlan-create command creates VLANs on the current switch.

CLI(network-admin@Leaf1) > vlan-create

vlan-create	Creates a VLAN. You can create a VLAN either by specifying a VLAN ID or by specifying a range of VLAN IDs.
id 2...4092	Specify the VLAN ID between 2 and 4092. Note: VLAN 0 and 1 represents all untagged or non-VLAN traffic, VLANs 4093, 4094, and 4095 are reserved for internal use.
range vlan-list	Specify the range of VLAN IDs. Use this parameter if you want to specify a VLAN range instead of a VLAN ID.
scope [local\|cluster\|fabric]	Specify the VLAN scope as local, cluster, or fabric.
Specify any of the following options:
vnet vnet-name	Specify the vNET name for this VLAN. Note: A vNET segregates a physical fabric into many logical networks, each with separate resources, network services, and Quality of Service (QoS) guarantees.
vxlan 1..16777215	Specify the VXLAN identifier for the tunnel.
auto-vxlan\|no-auto-vxlan	Specify if you want to enable or disable auto-vxlan. Enabling this option automatically assigns a user-defined VLAN/VNI mapping to all VTEP connections in the fabric. If the vxlan option is not specified, the software assigns a VNI automatically.
vxlan-mode [standard\|transparent\|qinq-access]	Specify the VXLAN encapsulation mode as standard, transparent, or Q-in-Q.
replicators [vtep-group name\|none]	Specify the replicator group. Provide a VTEP group name to add a replicator. Specify none to not add a replicator or remove a configured replicator.
public-vlan 2..4092	Specify the Public VLAN for vNET VLAN.
description description-string	Provide a VLAN description.
stats\|no-stats	Use the options to enable or disable statistics collection for the VLANs being created.
ports port-list	Specify the ports assigned to the VLAN as list separated by commas.
port-desc port-desc-string	Specify a port description to be assigned to the VLAN.
untagged-ports port-list	Specify the untagged ports assigned to the VLAN as a list separated by commas.
untagged-port-desc untagged-port-desc-string	Specify a description for untagged ports.

Note: NetVisor OS allows you to create a large number of VLANs by using the vlan-create command and the range keyword. However, in large network topologies with several nodes with heavy CPU traffic, the CLI may timeout if you create large number of VLANs. In such scenarios, try creating smaller number of VLANs.

By default, all ports are tagged on a newly created VLAN. However, if you want to specify select ports that should be trunked, then use the optional parameter ports with a comma separated list of ports, or specify a range of ports.

In some cases, you may not want a VLAN to be created on all ports. You can specify the port parameter as none to apply the VLAN only to the internal ports. For example:

CLI (network-admin@Leaf1) > vlan-create id 35 scope fabric ports none

To delete an existing VLAN, use the command:

CLI (network-admin@Leaf1) > vlan-delete

vlan-delete	Deletes a VLAN either by ID or by a range of IDs.
id 2...4092	Specify the VLAN ID that you want to delete.
range vlan-list	Specify the range of VLAN IDs that you want to delete. Use this parameter instead of id, if you want to specify a VLAN range.
Specify the following option:
vnet vnet-name	Specify the name of the vNET from which the VLANs are to be deleted.

Configuration of an existing VLAN can be modified using the vlan-modify command.

CLI (network-admin@Leaf1) >vlan-modify

vlan-modify	Modify a VLAN by specifying the VLAN ID.
id 2...4092	Specify the VLAN ID that you intend to modify.
between 1 and 4 of the following options:
description description-string	Provide a VLAN description.
vxlan 1..16777215	Specify the VXLAN identifier for the tunnel.
replicators [vtep-group name \| none]	Specify the replicator group. Provide a VTEP group name to add a replicator. Specify none to not add a replicator or remove a configured replicator.
vnet vnet name	Specify the vNET name for this VLAN.
public-vlan 2..4092	Specify the public VLAN ID for vNET VLAN. Note: Public VLAN ID can only be specified for private VLANs.

For example, to modify VLAN 25 description from blue to red:

CLI (network-admin@Leaf1) > vlan-modify id 25 description red

This description can be removed from VLAN25 using the command:

CLI (network-admin@Leaf1) > vlan-modify id 25 description ""

NetVisor OS allows the addition of ports to a VLAN through the vlan-port-add command.

CLI (network-admin@Leaf1) > vlan-port-add

vlan-port-add	Add ports to VLANs.
Specify one of the following VLAN parameters:
vlan-id 2..4092	Specify the VLAN ID to which ports are to be added.
vlan-range vlan-list	Specify the range of VLAN IDs to which ports are to be added.
vlan-vnet vnet-name	Specify the vNET for the VLANs to which the ports are to be added.
Provide the following port arguments:
switch switch-name	Specify the name of the switch on which the ports are located.
ports port-list	Specify the ports that you want to add to the VLAN as a list separated by commas.
port-desc port-desc-string	Specify the port description of the port that you want to add to the VLAN.
[untagged \| tagged]	Specify either of the options to configure the ports as untagged or tagged ports.

For example, to configure ports 17 and 18 to accept untagged packets and map them to VLAN 595, use the following command:

CLI (network-admin@Leaf1) > vlan-port-add vlan-id 595 ports 17,18 untagged

To map ports on different switches into the scope fabric VLAN, use the following command:

CLI (network-admin@Leaf1) > vlan-port-add vlan-id 1-4095 switch switch-name ports port-list

To add ports with the description red to VLAN 70, use the command:

CLI (network-admin@switch) > vlan-port-add vlan-id 70 port-desc red

Ports can be removed from a VLAN through the vlan-port-remove command.

CLI (network-admin@Leaf1) > vlan-port-remove

vlan-port-remove	Remove ports from VLANs.
Specify one of the following VLAN selectors:
vlan-id 2..4092	Specify the VLAN ID from which ports are to be removed.
vlan-range vlan-list	Specify the range of VLAN IDs from which ports are to be removed
vlan-vnet vnet name	Specify the vNET for the VLANs from which ports are to be removed.
Provide the following port arguments:
switch switch name	Specify the name of the switch on which the ports are located.
port port list	Specify the ports that you want to remove from the VLAN as a list separated by commas.
port-desc port-desc-string	Specify the port description of the port that you want to remove from the VLAN.

The vlan-show command displays the VLAN information.

CLI (network-admin@Leaf1) > vlan-show

vlan-show	Display VLAN information.
Specify one of the following VLAN sectors:
id 2..4092	Specify the VLAN ID for which the information has to be displayed.
range vlan-list	Specify the range of VLAN IDs for which the information has to be displayed.
vnet vnet name	Specify the vNET for which VLAN information has to be displayed.
type [public \| private]	Specify either of the type options to display information for public VLANs or private VLANs.
vxlan 1..16777215	Specify the VXLAN identifier for the tunnel.
vxlan-mode [standard \| transparent \| qinq-access]	Specify any of the VXLAN modes to display information for standard, transparent, or q-in-q modes.
hw-vpn hw-vpn-number	Specify the hardware VPN number to display the related information.
hw-mcast-group hw-mcast-group-number	Specify the hardware multi-cast group number to display the related information.
replicators [vtep-group name \| none]	Provide a VTEP group name to view the VLAN information for that replicator group. Specify none to view the information on VLANs that do not involve replicator groups.
repl-vtep ip-address	Specify the IP address of the replicator VTEP to view the related information.
public-vlan 2..4092	Specify the public VLAN ID for vNET VLAN to view the related information.
scope [local \| cluster \| fabric]	Provide any of the scope options to view the information on VLANs with that specified scope.
description description-string	Specify a description to view the information on VLANs with that specific description.
active [yes \| no]	Specify yes to view information on active VLANs. Specify no to view information on inactive VLANs.
stats\|no-stats	Specify VLAN statistics.
vrg vrg-name	Specify the VRG assigned to VLAN.
ports port-list	Specify the ports assigned to VLAN.
port-desc port-desc-string	Specify the port description.
untagged-ports port-list	Specify the untagged ports assigned to VLAN.
untagged-port-desc untagged-port-desc-string	The untagged ports assigned to VLAN.
active-edge-ports port-list	Specify the active edge ports assigned to VLAN.

For example:

CLI (network-admin@Leaf1) > vlan-show layout vertical

switch: leaf1

id: 1

type: public

auto-vxlan: no

replicators: none

scope: local

description: default-1

active: yes

stats: yes

ports: 2-72

untagged-ports: 2-69

active-edge-ports: 69-70

CLI (network-admin@Leaf1) > vlan-show format all layout vertical

switch: leaf1

id: 1

type: public

auto-vxlan: no

hw-vpn: 0

hw-mcast-group: 0

replicators: none

repl-vtep: ::

scope: local

description: default-1

active: yes

stats: yes

vrg: 0:0

ports: 2-72

untagged-ports: 2-69

active-edge-ports: 69

To associate multiple VLANs with a port, use the port-vlan-add command:

ports port-number	Specify the port number.
port-desc port-desc-string	Specify the description to add the port with that description to the VLAN.
Specify one or both of the following options:
vnet vnet-name	Specify the name of the VNET for the port.
vlans vlans-list	Specify the list of VLANs to associate with the port.
untagged-vlan vlan-id	Specify an untagged VLAN to apply to the port. The value can be from 0-4095.

For example, to associate the VLANs 10 and 12 with port 25, use the command:

CLI (network-admin@switch) > port-vlan-add port 25 vlans 10,12

Use the port-vlan-show command to display this configuration.

CLI (network-admin@switch) > port-vlan-show

port-vlan-show	Display ports and the associated VLANs.
vnet vnet-name	The name of the vNET.
bezel-port bezel-port-string	The bezel port number.
ports port-list	The list of ports.
vlans vlans-list	The list of VLANs associated with the port.
untagged-vlan vlan-id	The untagged VLANs associated with the port.
description description-string	The VLAN description.
port-desc port-desc-string	The port description.
active-vlans vlan-list	The active VLAN list.

CLI (network-admin@switch) > port-vlan-show

switch bezel-port port vlans untagged-vlan description active-vlans

------ ---------- ---- ----- ------------- ----------- ------------

switch 25 25 10,12 1 none

Use the port-vlan-remove command to remove a port from the VLANs.

port-vlan-remove	Removes a port from VLANs.
vlans vlans-list	Specify the list of VLANs.
vnet vnet-name	Specify the name of the vNET.
port port-number	Specify the port to remove.
port-desc port-desc-string	Specify the port description to remove the port with that description.

For example, you can remove the ports with the description green from VLANs 45 and 46 by using the command:

CLI (network-admin@switch) > port-vlan-remove vlans 45,46 port-desc green

Network traffic statistics per VLAN can be displayed using the vlan-stats-show command. This command may be useful when troubleshooting network issues.

CLI (network-admin@Leaf1) > vlan-stats-show format all layout vertical

switch: Leaf2

time: 10:51:02

vlan: 1

vnet:

ibytes: 36.2T

ipkts: 89.0G

idrops-bytes: 119M

idrops-pkts: 313K

obytes: 0

opkts: 0

odrops-bytes: 0

odrops-pkts: 0

switch: Leaf2

time: 10:51:02

vlan: 35

vnet:

ibytes: 10.8K

ipkts: 154

idrops-bytes: 0

idrops-pkts: 0

obytes: 0

opkts: 0

odrops-bytes: 0

odrops-pkts: 0

switch: Leaf1

time: 10:51:02

vlan: 1

vnet:

ibytes: 34.9T

ipkts: 84.6G

idrops-bytes: 3.03M

idrops-pkts: 5.69K

obytes: 0

opkts: 0

odrops-bytes: 0

odrops-pkts: 0

The output displays the following information:

switch — switch name
time — when the output was generated
VLAN ID — ID assigned to the VLAN
vnet — the vNET assigned to the VLAN
incoming and outgoing bytes — in K (Kilobytes), M (Megabytes), or G (Gigabytes)
incoming and outgoing packets — number of packets incoming and outgoing
incoming and outgoing dropped bytes — in K (Kilobytes), M (Megabytes), or G (Gigabytes)
incoming and outgoing dropped packets — number of dropped packets incoming and outgoing