What is the appropriate VLAN configuration for this?

Question

We have a group of clients connects to a Arista switch with DHCP enabled. And we want to setup an additional private VLAN so that those clients can communicate to each other through pre-defined static IPs. So that those communication packets do not go out of switch.

After experimenting with switch configuration, I can create VLAN1 for DHCP and VLAN2 for static IP traffic. But I can only assign a port(ethernet interface) to either VLAN1 or VLAN2 but not both. For example, Et51 below connected to DHCP server. If Et12 is assigned to VLAN1, it can get an IP from DHCP but no longer talk to Et13 through static IP.

#show vlan
VLAN  Name                             Status    Ports
----- -------------------------------- --------- -------------------------------
1     default                          active    Et51
2     StaticIPVLAN.                    active    Et12, Et13

I wonder if my approach is wrong or there are some additional VLAN configuration needed?

Thanks

Answer 1

we want to setup an additional private VLAN so that those clients can communicate to each other through pre-defined static IPs.

Alternatively, you can set up address reservations on the DHCP server, so the host addresses don't ever change.

So that those communication packets do not go out of switch.

If both nodes are connected to the same switch their direct communication doesn't leave the switch anyway.

But I can only assign a port(ethernet interface) to either VLAN1 or VLAN2 but not both.

You can only assign a single untagged VLAN to any port. Additional VLANs need to be tagged on both the switch and the host, creating a VLAN trunk.

On the switch, a default access mode port doesn't permit tagging. You need to use switchport mode trunk on an interface. Then you can assign the untagged VLAN switchport trunk native vlan 1. By default, the other VLAN(s) should be allowed and tagged, or you'd explicitly define switchport trunk allowed vlan 1-2.

On the host, you need a VLAN-capable NIC and driver. With Linux you'd use the plain interface for the untagged/native VLAN and add a subinterface for the tagged VLAN. Windows isn't natively VLAN capable, so a vendor-specific tool needs to create an additional, virtual interface for a tagged VLAN. Note that host configurations and issues are explicitly off topic here.

A quick check whether VLANs and trunking work correctly is when the host MAC addresses show up in the desired VLAN on the switch: e.g. show mac address-table vlan 2.