1

We have a group of clients connects to a Arista switch with DHCP enabled. And we want to setup an additional private VLAN so that those clients can communicate to each other through pre-defined static IPs. So that those communication packets do not go out of switch.

After experimenting with switch configuration, I can create VLAN1 for DHCP and VLAN2 for static IP traffic. But I can only assign a port(ethernet interface) to either VLAN1 or VLAN2 but not both. For example, Et51 below connected to DHCP server. If Et12 is assigned to VLAN1, it can get an IP from DHCP but no longer talk to Et13 through static IP.

#show vlan
VLAN  Name                             Status    Ports
----- -------------------------------- --------- -------------------------------
1     default                          active    Et51
2     StaticIPVLAN.                    active    Et12, Et13

I wonder if my approach is wrong or there are some additional VLAN configuration needed?

Thanks

3
  • 1
    Some PCs can trunk, and some cannot. Unfortunately, host configurations are off-topic here. You could try to ask about that on Server Fault for a business network. The switch interfaces would need to be set up as trunks with those two VLANs.
    – Ron Maupin
    Jul 26 at 22:10
  • Thank you, I will look into vlan trunk setting on switch configuration. Jul 26 at 22:51
  • Why would packets leave the switch when using the DHCP-assigned addresses?
    – rnxrx
    Aug 5 at 4:11

1 Answer 1

1

we want to setup an additional private VLAN so that those clients can communicate to each other through pre-defined static IPs.

Alternatively, you can set up address reservations on the DHCP server, so the host addresses don't ever change.

So that those communication packets do not go out of switch.

If both nodes are connected to the same switch their direct communication doesn't leave the switch anyway.

But I can only assign a port(ethernet interface) to either VLAN1 or VLAN2 but not both.

You can only assign a single untagged VLAN to any port. Additional VLANs need to be tagged on both the switch and the host, creating a VLAN trunk.

On the switch, a default access mode port doesn't permit tagging. You need to use switchport mode trunk on an interface. Then you can assign the untagged VLAN switchport trunk native vlan 1. By default, the other VLAN(s) should be allowed and tagged, or you'd explicitly define switchport trunk allowed vlan 1-2.

On the host, you need a VLAN-capable NIC and driver. With Linux you'd use the plain interface for the untagged/native VLAN and add a subinterface for the tagged VLAN. Windows isn't natively VLAN capable, so a vendor-specific tool needs to create an additional, virtual interface for a tagged VLAN. Note that host configurations and issues are explicitly off topic here.

A quick check whether VLANs and trunking work correctly is when the host MAC addresses show up in the desired VLAN on the switch: e.g. show mac address-table vlan 2.

1
  • Thank you very much for the information. Aug 1 at 22:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.