Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i have a server with ESX5, have a Standar Switch(vswitch1) with one physical NIC attached, vswitch1 VLAN ID is set to All(4095) so it can see traffic on any VLAN, connected to vswitch1 i have 2 VM, Debian 6 and XP SP2 respectively. Untill now everythings OK, now, the interface config of the debian looks like this:

auto eth0
iface eth0 inet static
    address 192.168.106.250
    netmask 255.255.255.0

auto vlan52
iface vlan52 inet static
    address 11.10.1.65
    netmask 255.255.255.248
    vlan_raw_device eth0

i also activated modprobe 8021q and no iptables rules, so, i don't have nothing dropping packets
Now, in the XP VM, have this network config:

IP Address: 11.10.1.66
Subnet Mask: 255.255.255.248

IP Address: 192.168.106.251
Subnet Mask: 255.255.255.0

As you can see, the XP VM has 2 IP Address, so, ping from XP to 192.168.106.250 is OK, but, ping from XP to 11.10.1.65 fails, then in the XP VM using Wireshark, you can see something like this

Source                Destination           Protocol Length Info
11.10.1.66            11.10.1.65            ICMP     74     Echo (ping) request  id=0x0200, seq=2816/11, ttl=128
Vmware_aa:3d:e6       Broadcast             ARP      42     Who has 11.10.1.65?  Tell 11.10.1.66
Vmware_aa:3d:e1       Vmware_aa:3d:e6       ARP      60     11.10.1.65 is at 00:50:56:aa:3d:e1
11.10.1.66            11.10.1.65            ICMP     74     Echo (ping) request  id=0x0200, seq=1280/5, ttl=128
Vmware_aa:3d:e1       Broadcast             ARP      64     Who has 11.10.1.66?  Tell 11.10.1.65
Vmware_aa:3d:e1       Broadcast             ARP      64     Who has 11.10.1.66?  Tell 11.10.1.65
11.10.1.66            11.10.1.65            ICMP     74     Echo (ping) request  id=0x0200, seq=1536/6, ttl=128

And so on, but the ping doesn't work, i also tried with the putty to connect using ssh to 11.10.1.65 but it failed too.

I then decided to test with the physical network at work where i have 2 physical switch that share vlan IDs among(other people configured the switches, but i have access to the config), the vlan 52 exist on the switch and the debian have a vlan52 too, here are pieces of the switchs config

#SWITCH 1
vlan 51
  description DPC
vlan 52
  description OBEM
#
interface GigabitEthernet0/0/22
 description LAN_DPC
 port hybrid pvid vlan 51
 port hybrid untagged vlan 3 51 to 63
 ip-subnet-vlan enable


#SWITCH 2
vlan 51
  description DPC
vlan 52
  description OBEM
#
interface Ethernet0/0/1
 port hybrid pvid vlan 52
 port hybrid untagged vlan 51 to 52
#
interface GigabitEthernet0/0/1
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 50 to 52
 stp disable

The switches are Huawei Quidway S3300 Series

So, i connected my laptop to Ethernet0/0/1 of SWITCH 2, ping from my laptop(with ip 11.10.1.67) to 11.10.1.65, same result, even in the Wireshark capture.

I'm not an expert in switches config, i even don't fully know what some parts in the config means, for example port trunk allow-pass vlan 50 to 52 and port hybrid untagged vlan 51 to 52 maybe you can recommend a good docs about this.

But now, my real headeach, is how to make it work cuz i really need it, i need all this vlans to be passed through a single NIC of a firewall, and right now i'm really stuck, if you think i need to change somthing in the switches, i can do it, as i said i have access, so, hope you can help me

thanks

share|improve this question

1 Answer 1

up vote 1 down vote accepted

In huawei/H3C/HP world (all of them share more or less the same software) there are 3 kind of ports if we're talking about VLANs (802.1Q):

-Access port: You assign an access port to one VLAN ID so the switch knows internally that all traffic coming from that port belongs to that VLAN. Also will forward all broadcast traffic within that VLAN to that port You should connect a computer or final device to this kind of port, since the traffic going to and from the device is UNTAGGED.

interface Ethernet0/0/0
  port link-type access
  port default vlan XXX
#

-Trunk port: You assign a trunk port to several VLAN IDs. The traffic going out a trunk port is TAGGED except the traffic that belongs to the PVID (Port VLAN ID). Untagged incoming traffic will be assigned internally to the PVID and any tagged traffic that doesn't match the allowed VLANs will be discarded

interface Ethernet0/0/0
  port link-type trunk
  port trunk pvid vlan 100
  port trunk allow-pass vlan 2 3 200
#

-Hybrid port: This is new, something Huawei/H3C invented. In this mode, you can set any VLAN either TAGGED or UNTAGGED. From my POV, I find this mode quite useless, because it has no sense to send untagged traffic for more than one VLAN, because the other side of the connection cannot know which frame belong to which VLAN, can it? If you configure a set of VLAN IDs as TAGGED and one of them UNTAGGED and PVID, you have the same results as if you configure a trunk port. The only difference I could see is that ARP Broadcasts for a TAGGED VLAN on a Hybrid port are tagged and if you configure a Trunk port, all ARP Broadcasts go UNTAGGED

interface Ethernet0/0/0
  port link-type hybrid
  port hybrid tagged vlan XX XX XX
  port hybrid untagged vlan XX XX XX
  port hybrid pvid vlan XXX
#

NOW, I don't understand too much about VM machines, but if you get these concepts and refrain yourself from using hybrid ports I think you'll get the solution yourself. Just remember:

More than one VLAN on the same port: TRUNK, TAGGED VLANs (If the device connected to it is VLAN Capable, and VMWARE VMs are) Only one VLAN in a port: ACCESS, UNTAGGED VLAN.

Regards, Yul

share|improve this answer
    
Bro, the best explanation i've read about port link-type, could you recommend a good web or doc where i can read more about the world of vlans.....thanks anyway –  Kstro21 Dec 4 '12 at 13:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.