linux网桥支持vlan filtering过滤功能后,咱们不仔再须要经过子接口的形式进行vlan划分,简化了vlan配置。linux
man bridge能够了解到,linux经过以下命令进行vlan filtering的配置:shell
bridge vlan { add | del } dev DEV vid VID [ pvid ] [ untagged ] [ self ] [ master ]
选项说明:ubuntu
pvid:端口的默认vlan,全部从该端口输入的没有携带vlan的报文,会被打上该vlan标签,该选项只对输入报文有效。ui
untagged:端口的untag vlan,输出报文携带该vlan时,会被剥离。code
通常状况下pvid和untagged是同时使用的,对应于cisco的switchport trunk native vlan接口
selfip
masterci
这两个选项在帮助手册上是这么解释的:terminal
self the vlan is configured on the specified physical device. Required if the device is the bridge device. master the vlan is configured on the software bridge (default).
个人理解是:self表示该vlan是添加再bridge设备上的,并且给桥添加vlan时必须且只能携带该选项,不然会报错:it
ubuntu@VM-126-137-ubuntu:~$ sudo ip link add Bridge up type bridge vlan_filtering 1 ubuntu@VM-126-137-ubuntu:~/bgp-lab$ sudo bridge vlan add vid 100 dev Bridge self ubuntu@VM-126-137-ubuntu:~/bgp-lab$ ubuntu@VM-126-137-ubuntu:~/$ sudo bridge vlan add vid 100 dev Bridge master RTNETLINK answers: Operation not supported ubuntu@VM-126-137-ubuntu:~/$ sudo bridge vlan add vid 100 dev Bridge RTNETLINK answers: Operation not supported ubuntu@VM-126-137-ubuntu:~/$
master表示该vlan是添加再bridge的端口设备上的,该选项是默认的,给桥上的端口添加vlan时能够不指定该参数。
ubuntu@ubuntu:~/$ sudo ip link del Bridge ubuntu@ubuntu:~/$ sudo ip link add Bridge up type bridge vlan_filtering 1 ubuntu@ubuntu:~/$ sudo ip link set eth1 master Bridge ubuntu@ubuntu:~/$ sudo bridge vlan add vid 100 dev Bridge self ubuntu@ubuntu:~/$ sudo bridge vlan add vid 100 dev eth1 ubuntu@ubuntu:~/$ sudo bridge vlan add vid 100 dev eth1 master ubuntu@ubuntu:~/$ ubuntu@ubuntu:~/$ sudo bridge vlan add vid 100 dev eth1 self RTNETLINK answers: Operation not supported ubuntu@ubuntu:~/$ ubuntu@ubuntu:~/$ sudo bridge vlan show port vlan ids eth1 1 PVID Egress Untagged 100 Bridge 1 PVID Egress Untagged 100 ubuntu@ubuntu:~/$
添加桥时,默认会以 pvid untagged形式添加的默认vlan 1中,不少厂商会把vlan 1做为保留vlan,不容许用户配置。
ubuntu@ubuntu:~/$ sudo ip link del Bridge ubuntu@ubuntu:~/$ sudo bridge vlan show port vlan ids ubuntu@ubuntu:~/$ sudo ip link add Bridge up type bridge vlan_filtering 1 ubuntu@ubuntu:~/$ sudo bridge vlan show port vlan ids Bridge 1 PVID Egress Untagged ubuntu@ubuntu:~/$
端口加入桥时,也会默认以 pvid untagged形式添加的默认vlan 1中,
ubuntu@ubuntu:~/$ sudo ip link del Bridge ubuntu@ubuntu:~/$ sudo ip link add Bridge up type bridge vlan_filtering 1 ubuntu@ubuntu:~/$ sudo ip link set eth1 master Bridge ubuntu@ubuntu:~/$ sudo bridge vlan show port vlan ids eth1 1 PVID Egress Untagged Bridge 1 PVID Egress Untagged ubuntu@ubuntu:~/$
也能够删除默认vlan 1
ubuntu@ubuntu:~/$ sudo bridge vlan del vid 1 dev enp4s0f0 master ubuntu@ubuntu:~/$ sudo bridge vlan show port vlan ids enp129s0f0np0 enp129s0f1np1 enp4s0f0 100 Bridge 1 PVID Egress Untagged 100 ubuntu@ubuntu:~/$ sudo bridge vlan del vid 1 dev Bridge self ubuntu@ubuntu:~/$ sudo bridge vlan show port vlan ids enp4s0f0 100 Bridge 100 ubuntu@ubuntu:~/$
ubuntu@ubuntu:~/$ sudo ip link add Bridge up type bridge vlan_filtering 1 ubuntu@ubuntu:~/$ sudo ip link set eth1 master Bridge ubuntu@ubuntu:~/$ sudo bridge vlan add vid 100 dev Bridge self ubuntu@ubuntu:~/$ sudo bridge vlan add vid 100 dev eth1 master ubuntu@ubuntu:~/$ sudo ip link add link Bridge name Vlan100 up type vlan id 100 ubuntu@ubuntu:~/$ sudo ip addr add 10.0.2.1/24 dev Vlan100 ubuntu@ubuntu:~/$ sudo bridge vlan show port vlan ids eth1 1 PVID Egress Untagged 100 Bridge 1 PVID Egress Untagged 100 ubuntu@ubuntu:~/$
SWITCH# exit SWITCH> enable SWITCH# show vlan +-----------+--------------+---------+----------------+-----------------------+ | VLAN ID | IP Address | Ports | Port Tagging | DHCP Helper Address | +===========+==============+=========+================+=======================+ +-----------+--------------+---------+----------------+-----------------------+ SWITCH# configure terminal SWITCH(config)# vlan 100 SWITCH(config)# interface eth25GE 47 SWITCH(config-if)# switchport mode access trunk SWITCH(config-if)# switchport mode trunk SWITCH(config-if)# switchport trunk allowd vlan add 100 SWITCH(config-if)# exit SWITCH(config)# interface vlan 100 SWITCH(config-if)# ip address 10.0.2.2/24 Add Vlan100 into default VRF SWITCH(config-if)#
SWITCH(config-if)# do ping 10.0.2.1 PING 10.0.2.1 (10.0.2.1) 56(84) bytes of data. 64 bytes from 10.0.2.1: icmp_seq=1 ttl=64 time=0.196 ms 64 bytes from 10.0.2.1: icmp_seq=2 ttl=64 time=0.219 ms 64 bytes from 10.0.2.1: icmp_seq=3 ttl=64 time=0.150 ms ^C SWITCH(config-if)# --- 10.0.2.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2032ms rtt min/avg/max/mdev = 0.150/0.188/0.219/0.030 ms SWITCH(config-if)# ubuntu@ubuntu:~/$ ping 10.0.2.2 PING 10.0.2.2 (10.0.2.2) 56(84) bytes of data. 64 bytes from 10.0.2.2: icmp_seq=1 ttl=64 time=0.308 ms 64 bytes from 10.0.2.2: icmp_seq=2 ttl=64 time=0.245 ms 64 bytes from 10.0.2.2: icmp_seq=3 ttl=64 time=0.262 ms ^C --- 10.0.2.2 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2031ms rtt min/avg/max/mdev = 0.245/0.271/0.308/0.032 ms ubuntu@ubuntu:~/$