0

I'm using VyOS 1.1.8.

I am having following set up in GNS3: Simulation

Devices connected to Switch1 are working properly. PC1 can ping PC3 and vice versa. They can obtain IP via DHCP.

PC2 can't be pinged even by the router: furthermore, it can't even ping its gateway. However, it can get its ip from DHCP.

What is wrong with my setup that nodes in Switch2 link can get their IP via DHCP, though can't send/receive packets?

Here are the settings:

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface        IP Address                        S/L  Description
---------        ----------                        ---  -----------
eth0             -                                 A/D
eth1             -                                 u/u
eth1.1           192.168.16.1/24                   u/u
eth1.2           192.168.21.1/24                   u/u
eth2             -                                 u/u
eth2.1           192.168.16.2/24                   u/u
eth3             -                                 A/D
lo               127.0.0.1/8                       u/u
                 ::1/128
vyos@vyos# show service dhcp
 disabled false
 shared-network-name VLAN1 {
     subnet 192.168.16.0/24 {
         default-router 192.168.16.1
         dns-server 8.8.8.8
         domain-name "VLAN 1"
         start 192.168.16.20 {
             stop 192.168.16.100
         }
     }
 }
 shared-network-name VLAN2 {
     subnet 192.168.21.0/24 {
         default-router 192.168.21.1
         dns-server 8.8.8.8
         domain-name "VLAN 2"
         start 192.168.21.20 {
             stop 192.168.21.100
         }
     }
 }

eth1 = Floor A/Switch1

eth1.1 = Floor A/VLAN1

eth1.2 = Floor A/VLAN2

eth2 = Floor B/Switch2

eth2.1 = Floor B/VLAN1

Here are the network settings once PCs obtain their IP via DHCP:

PC1> ip dhcp
DDORA IP 192.168.16.20/24 GW 192.168.16.1

PC1> show ip

NAME        : PC1[1]
IP/MASK     : 192.168.16.20/24
GATEWAY     : 192.168.16.1
DNS         : 8.8.8.8
DHCP SERVER : 192.168.16.1
DHCP LEASE  : 86390, 86400/43200/75600
DOMAIN NAME : VLAN 1
MAC         : 00:50:79:66:68:00
LPORT       : 10010
RHOST:PORT  : 127.0.0.1:10011
MTU:        : 1500
PC2> ip dhcp
DDORA IP 192.168.16.21/24 GW 192.168.16.1

PC2> show ip

NAME        : PC2[1]
IP/MASK     : 192.168.16.21/24
GATEWAY     : 192.168.16.1
DNS         : 8.8.8.8
DHCP SERVER : 192.168.16.2
DHCP LEASE  : 86396, 86400/43200/75600
DOMAIN NAME : VLAN 1
MAC         : 00:50:79:66:68:01
LPORT       : 10012
RHOST:PORT  : 127.0.0.1:10013
MTU:        : 1500
PC3> ip dhcp
DDORA IP 192.168.21.20/24 GW 192.168.21.1

PC3> show ip

NAME        : PC3[1]
IP/MASK     : 192.168.21.20/24
GATEWAY     : 192.168.21.1
DNS         : 8.8.8.8
DHCP SERVER : 192.168.21.1
DHCP LEASE  : 86395, 86400/43200/75600
DOMAIN NAME : VLAN 2
MAC         : 00:50:79:66:68:02
LPORT       : 10018
RHOST:PORT  : 127.0.0.1:10019
MTU:        : 1500

IP route:

vyos@vyos:~$ show ip route
Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,
       I - ISIS, B - BGP, > - selected route, * - FIB route

C>* 127.0.0.0/8 is directly connected, lo
C * 192.168.16.0/24 is directly connected, eth2.1
C>* 192.168.16.0/24 is directly connected, eth1.1
C>* 192.168.21.0/24 is directly connected, eth1.2
2
  • That's technically an illegal configuration -- two routed interfaces within the same subnet -- but linux is a bad router and will allow it. (linux is a host not router, but it does play one on TV.)
    – Ricky
    Jan 4 at 2:38
  • Hi, would you be kind to explain what's wrong with it such configuration? Why's it bad to use two routed interfaces within the same subnet? Jan 4 at 13:39

1 Answer 1

0

This is normal. By default interfaces within VyOs are not bridged. That means interfaces eth1 and eth2 are in two different switching domains.

I.E eth1 vlan 1 and eth2 vlan 1 are two independent VLANS.

To connect them together you need first to bridge them.

You can do it this way:

interfaces {
    bridge br0 {
        address 192.168.16.1/24
    }
   ethernet eth1 {
        vif 1 {
            bridge-group {
                bridge br0
            }

   ethernet eth2 {
        vif 1 {
            bridge-group {
                bridge br0
            }

Another option, probably better, depending on you needs, would be to first bridge the two ethernet interfaces, then declare the VLANs on this bridge:

interfaces {
       bridge br0 {
            vif 1 {
                address 192.168.16.1/24
            }
       }
       ethernet eth1 {
            bridge-group {
                bridge br0
            }
       }
       ethernet eth2 {
            bridge-group {
                bridge br0
            }
       
}

Because in this way you bridge the interfaces once for all and then can declare any number on VLANs on the bridge, while in the first method you need to declare a bridge for each VLAN.

3
  • Thanks - now nodes within VLAN1 can exchange packets. Though, packets from PC3 (VLAN2) can't reach PC2 (VLAN1). Am I getting it right that I should add VLAN2 to the same bridge? Is there any drawback of doing so? Jan 3 at 13:35
  • No, packet between PC2 and PC3 (I.E between VLAN1 and VLAN) should be routed by the VyOS router and it is the case by default. If you are familiar with tcpdump you can use it on VyOs (use 'sudo tcpdump'). If you are not, well... learn it :) it is a mandatory competency in the networking world. In your setup you need to ensure that on switch 1 the interface that connects the VyOs is in trunk mode.
    – JFL
    Jan 3 at 13:41
  • I can confirm that everything's working now. Realised that VLAN2 had address missing - no wonder it couldn't send/receive packets. Thank you very much! :) Jan 3 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.