I m trying to extend a layer 2 network (Vlans) over a layer 3 network using vxlan tunnels ... i set up a lab where i have two VMs where,
- I created a vxlan tunnel between the 2 main interfaces of the VMs
- I created 2 vlan sub-interfaces under the second interface for each machine
- I linked each vlan sub interface with the vxlan sub interface in separate bridges for each machine
- I assigned an ip to every bridge (192.168.100.1/24 , 192.168.100.2/24 and 192.168.100.3/24 , 192.168.100.4/24)
===> now when itry to ping from one bridge to another in (same vlan tag) it doesn t work
[root@Asguard ~]# ping 192.168.100.1 -I 192.168.100.3
PING 192.168.100.1 (192.168.100.1) from 192.168.100.3 : 56(84) bytes of data.
From 192.168.100.3 icmp_seq=10 Destination Host Unreachable
ping: sendmsg: No route to host
From 192.168.100.3 icmp_seq=11 Destination Host Unreachable
From 192.168.100.3 icmp_seq=12 Destination Host Unreachable
From 192.168.100.3 icmp_seq=14 Destination Host Unreachable
From 192.168.100.3 icmp_seq=15 Destination Host Unreachable
From 192.168.100.3 icmp_seq=16 Destination Host Unreachable
From 192.168.100.3 icmp_seq=17 Destination Host Unreachable
this is the script i run in each VM
VM1 :
#!/bin/bash
Bridge and interface setup
ip link add br10 type bridge
ip link add br20 type bridge
ip link set br10 up
ip link set br20 up
VLAN 10 on bridge br10
ip link add link enp0s9 name enp0s9.10 type vlan id 10
ip link set enp0s9.10 master br10
ip link set enp0s9.10 up
VLAN 20 on bridge br20
ip link add link enp0s9 name enp0s9.20 type vlan id 20
ip link set enp0s9.20 master br20
ip link set enp0s9.20 up
VXLAN on both bridges
ip link set vxlan1000 master br10
ip link set vxlan1000 up
#ip link add vxlan1000_2 type vxlan id 1000 dev enp0s3 remote 10.1.25.235 dstport 4789
ip link set vxlan1000 master br20
ip link set vxlan1000 up
ip addr add 192.168.100.1/24 dev br10
ip addr add 192.168.100.2/24 dev br20
VM2
#!/bin/bash
Bridge and interface setup
ip link add br11 type bridge
ip link add br22 type bridge
ip link set br11 up
ip link set br22 up
VLAN 10 on bridge br10
ip link add link enp0s8 name enp0s8.10 type vlan id 10
ip link set enp0s8.10 master br11
ip link set enp0s8.10 up
VLAN 20 on bridge br20
ip link add link enp0s8 name enp0s8.20 type vlan id 20
ip link set enp0s8.20 master br22
ip link set enp0s8.20 up
VXLAN on both bridges
ip link add vxlan1001 type vxlan id 1000 dev enp0s3 remote 10.1.25.31 dstport 4789
ip link set vxlan1001 master br11
ip link set vxlan1001 up
#ip link add vxlan1000_2 type vxlan id 1000 dev enp0s3 remote 10.1.25.235 dstport 4789
ip link set vxlan1001 master br22
ip link set vxlan1001 up
ip addr add 192.168.100.3/24 dev br11
ip addr add 192.168.100.4/24 dev br22
!!! i want to know how linux handle the tagging and encapsulation to make them work together to make the vxlan extention
UPDATE for the last answer
Thank you for your answer. I apologize if my initial question didn’t fully convey my intentions, so I’ll clarify what I aimed to achieve in my initial setup:
- I set up two VMs to simulate Linux routers.
- Each VM has two physical interfaces:
The first interface on each VM (enp0s3), in a Layer 2 network, is used to simulate a public IP and serve as the overlay tunnel interface for VXLAN.
On enp0s3, I created a VTEP (VXLAN interface for encapsulation and decapsulation of traffic), assuming we’re in a Layer 3 network.
- The second physical interface on each VM (e.g., enp0s8 or enp0s9) serves as the router's trunk port, where I can connect to internal VLANs (or directly to a switch trunk port).
- I then created VLAN sub-interfaces on these interfaces (enp0s8 and enp0s9), assigning two VLANs per VM.
- In each VM, I enslaved the VXLAN sub-interface and the VLAN sub-interfaces to the same bridge (let’s say br0), hoping that tagged traffic would:
Pass through the bridge, keeping the tag intact.
Reach the VXLAN interface attached to the bridge, where it would be encapsulated with the tag preserved.
Traverse the tunnel to the second VTEP, which is enslaved to the bridge with the VLANs, then be decapsulated and routed to the appropriate VLAN based on its tag.
Moving Forward with a New Setup:
I’ll try a new setup based on your recommendations:
I’ll enable VLAN filtering for VLAN traffic segregation.
From your suggestion:So what you should do to use a VXLAN link as the trunk instead? Obviously, on vm1, you should "un-enslave" host0 from the bridge (note that you also need to "move" the IP address assignment, I mean like 192.168.181.111/24, let it be static or DHCP, from the bridge back to host0), then create the VXLAN that connects to vm2, and enslave the VXLAN to the bridge. And on vm2, you should remove the VLAN interfaces created on host0, and after creating the VXLAN that connects to vm1, you create VLAN interfaces on it instead in similar manner.
If I understood correctly, I can create VLANs directly on the VXLAN interface itself. I’ll experiment with this approach.
P.S. I hope this helps clarify my goals for this lab. I’ll explore alternative methods based on your suggestions and see how they work, thanks.
