VLANs

Virtual LANs (VLANs, IEEE 802.1Q) split one physical network into several isolated Layer 2 networks. Each frame carries a VLAN ID between 1 and 4094, and switches deliver it only to ports that belong to that VLAN. This lets one physical NIC carry the host's management traffic and the traffic of many virtual machine networks, each kept apart from the others.

Vapor offers two ways to use VLANs:

• Open vSwitch (OVS) — recommended for virtual machine networking. VLANs are set on OVS ports (vPorts) and on the portgroups of libvirt networks, and one bridge can carry any number of VLANs.
• Linux VLAN interfaces — a sub-interface such as eth0.10 per VLAN. Suitable for giving the host an address on a VLAN, or for a simple Linux bridge setup with one VLAN per bridge. See Linux VLAN interfaces.

The rest of this page covers OVS.

---

How VLANs work in Open vSwitch

On an OVS bridge, VLANs are a property of each port, not of the bridge. Three kinds of port take part:

Port	What it is	Where its VLAN is set
Uplink	A system vPort for the physical NIC (for example eno1)	Network > Virtual Switch > vPorts
Host port	An internal vPort that carries a host IP address, such as the management address	Network > Virtual Switch > vPorts
VM port	A vnetN port that libvirt creates for each VM NIC while the VM runs	The portgroup of the libvirt network the NIC is attached to

Each port has a VLAN mode:

VLAN mode	Fields	Behaviour
access	Tag	Carries one VLAN, untagged. Frames entering the port join the tag's VLAN; frames leaving it have the tag removed. Frames that arrive already tagged are dropped.
trunk	Trunks	Carries the listed VLANs, tagged. An empty list means every VLAN.
native-untagged	Tag and Trunks	A trunk that also carries the Tag VLAN untagged. Untagged frames entering the port join that VLAN.
native-tagged	Tag and Trunks	As native-untagged, but frames of the native VLAN leave the port tagged.
Auto (default)	Tag or Trunks	Access if a tag is set, otherwise trunk.

A port with no tag and no trunks is a trunk for every VLAN. Untagged frames it receives are in VLAN 0, which no tagged port belongs to. This is why a VM NIC that never received a VLAN cannot reach anything on a VLAN.

When you change a port's VLAN mode, Vapor clears the setting the new mode does not use: switching to trunk removes the tag, switching to access removes the trunks.

---

Choosing the uplink mode

The uplink must match how the physical switch port is configured. Agree this with your network team before you start.

Physical switch port	Uplink vPort (eno1)	VLANs the host can use
Access port, VLAN 104 (untagged)	access, Tag 104	Only 104
802.1Q trunk, VLANs 104, 105, 106 tagged	trunk, Trunks 104,105,106	104, 105, 106
Trunk with native VLAN 104 untagged, 105 and 106 tagged	native-untagged, Tag 104, Trunks 104,105,106	104, 105, 106

An access uplink is the simplest setup, but it limits the host to one VLAN, and adding a second one later means reconfiguring both the switch and the host. If there is any chance you will need more than one VLAN, use a trunk from the start.

Never set the host's IP address on the uplink NIC or on the bridge itself. Once a NIC is a bridge member it works at Layer 2 only, and the bridge's own port has no tag, so it sits in VLAN 0. Put host addresses on internal vPorts, as described below.

---

Example: management and VMs on the same VLAN

This is the most common production layout: one NIC, VLAN 104 for both the Vapor web UI and the VMs, with room to add more VLANs later.

awbr0 (VS Bridge)
 ├─ eno1    system vPort    trunk, trunks 104        (no IP)
 ├─ mgmt0   internal vPort  tag 104, "management"   ← host management IP
 └─ vnetN   VM ports        tag 104                 ← from the network's portgroup

Do this from the console

Moving the management address onto a new port drops the connection you are working over. Use the server's console or out-of-band management (iDRAC, iLO, IPMI) for steps 2 to 4, or have a second way into the host.

1. Configure the switch port

Ask your network team to make the host's switch port an 802.1Q trunk that carries VLAN 104 tagged. If the switch must send VLAN 104 untagged, use native-untagged in step 3 instead of trunk.

2. Create the bridge

1. Go to Network > Virtual Switch.
2. Click Create VS Bridge and name it, for example awbr0.

3. Add the uplink

1. Under vPorts, click Create vPort.
2. Set VS Bridge to awbr0, vPort Type to system, and select eno1 under Interfaces. The vPort name is the interface name.
3. Set VLAN Mode to trunk and Trunks to 104. Leave Tag empty.
4. Leave Remove IP addresses from these interfaces ticked, so no address is left on eno1.

4. Add the management port

1. Click Create vPort again.
2. Set VS Bridge to awbr0, vPort Type to internal, and vPort Name to mgmt0.
3. Set VLAN Mode to access and Tag to 104.
4. Under Service Tags, tick management.
5. Go to Network > Interfaces, open mgmt0, and use Add IP to give it the host's management address and gateway.

Vapor saves the port's VLAN settings with the port. If the host loses the port after a hard power-off, a boot service recreates it with its tag before the network comes up, so the management address stays on VLAN 104.

5. Create the VM network

1. Go to Virtualization > Networks and create a network named, for example, vlan104.
2. Set Backend Type to Open vSwitch (OVS), Forwarding Mode to Bridge, and Host Bridge Name to awbr0.
3. Add a portgroup named pg-104 with VLAN Tags 104, and tick Set as default for this network.

Marking the portgroup as default is what makes this safe: every VM NIC attached to vlan104 gets VLAN 104 without anyone having to pick the portgroup.

6. Attach VMs

In the create-VM wizard, add a NIC on the vlan104 network. The Portgroup (optional) field shows Network default (pg-104), which is what you want. You can leave it as it is.

7. Check it

See Checking the configuration.

---

Example: several VLANs on one NIC

To give VMs a choice of VLANs, extend the layout above.

1. Have the switch port carry every VLAN you need, for example 104, 105 and 106.
2. Edit the eno1 vPort and set Trunks to 104,105,106.
3. Create a libvirt network for each VLAN, each on awbr0 with one default portgroup:

Network	Default portgroup	VLAN Tags
vlan104	pg-104	104
vlan105	pg-105	105
vlan106	pg-106	106

Choosing the network now chooses the VLAN. If the host also needs an address on another VLAN, for example a storage network, add another internal vPort with that tag and the matching service tag.

One network with several portgroups

Instead of one network per VLAN, you can create a single network with one portgroup per VLAN: pg-104 (default), pg-105, pg-106. Each VM NIC then has to select its portgroup, and a NIC that selects none lands on the default VLAN. This keeps the network list short, but makes it easier to put a VM on the wrong VLAN, so prefer one network per VLAN unless you have many VLANs.

VMs that need several VLANs

A router or firewall VM that handles VLAN tagging itself needs a trunk. Add a portgroup with Enable VLAN trunking ticked and VLAN Tags 104,105,106, and attach the VM's NIC to it. The VM then receives those VLANs tagged.

---

Portgroups and running VMs

A VM NIC's VLAN is taken from the first of these that has one:

1. A VLAN set on the NIC itself in the VM's definition
2. The portgroup the NIC selects, or the network's default portgroup if it selects none
3. The network's own VLAN

When you edit a network, or create, edit or delete one of its portgroups, Vapor moves the NICs of running VMs to the VLAN the change gives them. You do not need to restart the VMs. Keep in mind:

• Deleting the default portgroup takes VMs that relied on it off that VLAN immediately. Mark another portgroup as default first.
• Renaming a portgroup leaves NICs that selected it by its old name on their current VLAN, and those VMs will fail to start until their NIC is pointed at an existing portgroup.
• NICs with their own VLAN are not affected by portgroup changes.

Do not set tags on vnetN vPorts by hand. libvirt deletes and recreates those ports every time a VM starts, stops or migrates, so a manual tag is lost at the next of these, and the port name can change. Set the VLAN on the portgroup instead.

---

Live migration

A VM keeps its network and portgroup names when it migrates, and the destination host applies its own definition of them. For VMs to stay on the right VLAN after migration:

• Every host must have the networks with the same names, the same portgroups, and the same VLAN tags.
• Every host's uplink must carry the VLANs those portgroups use.

A missing portgroup stops the migration. A portgroup with a different tag on the destination moves the VM to that VLAN without warning.

---

Checking the configuration

On the host, check the VLAN settings of every port on the bridge:

ovs-vsctl --columns=name,tag,trunks,vlan_mode list Port

For the layout above, expect eno1 with trunks [104] and vlan_mode trunk, mgmt0 with tag 104, and each running VM's vnetN with tag 104.

To see which port belongs to a VM and the VLAN libvirt gave it:

virsh domiflist <vm-name>
virsh dumpxml <vm-name> | grep -A3 "<vlan>"

Then test from both ends: ping the VM's address from another machine on VLAN 104, and ping the VLAN's gateway from inside the VM.

---

Troubleshooting

The VM has no network access, but the host does. Its NIC is probably untagged. Check its vnetN port: an empty tag and empty trunks mean the NIC got no VLAN. Either mark a portgroup as default on the VM's network or select a portgroup on the NIC. The create-VM wizard warns when a NIC on an Open vSwitch network would join it untagged.

A tag set by hand on a vnetN port disappeared. This is expected; see Portgroups and running VMs.

The host became unreachable after moving the management address. From the console, check that the switch port carries the VLAN tagged (or natively, with native-untagged), that the uplink's trunks include it, and that the internal vPort has the right tag and holds the address. An address left on the uplink NIC or the bridge does not work.

VMs on two hosts on the same VLAN cannot reach each other. Check that both uplinks carry the VLAN, and that the switch ports between the hosts allow it.

A port's VLAN change is refused. A trunk port cannot have a tag, and an access port cannot have trunks. For a trunk that also carries an untagged VLAN, use native-untagged or native-tagged.

---

Linux VLAN interfaces

If the host's switch port is a trunk and you are not using OVS, you can create a VLAN sub-interface for each VLAN.

1. Go to Network > VLANs.
2. Click Create VLAN.
3. Select the parent interface (for example eth0 or a bond).
4. Enter the VLAN ID (1 to 4094).

Vapor creates a sub-interface such as eth0.10 for VLAN 10. You can give it an IP address, or make it a member of a Linux bridge so the VMs attached to that bridge are on VLAN 10. Each VLAN needs its own sub-interface and bridge, so for more than a couple of VLANs, OVS is easier to manage.