VLAN mit Linux und Open vSwitch

Zielbeschreibung

• Der Cisco-Port Ethernet1/1 ist als 802.1Q-Trunk konfiguriert.
• Der Linux-Rechner verwendet das Interface enp0s8.
• Drei VLANs werden getaggt übertragen:
• Ethernet1/2 und Ethernet1/3 → LAN
• Ethernet1/4 und Ethernet1/5 → SERVER
• Ethernet1/6 und Ethernet1/7 → MGMT
  • VLAN 1 → 172.27.2XX.0/24 → MGMT
  • VLAN 21 → 10.88.2XX.0/24 → DMZ
  • VLAN 22 → 172.26.2XX.0/24 → LAN
  • VLAN 23 → 10.2XX.1.0/24 → SERVER

Plan

[Bearbeiten]

Voraussetzungen auf Debian/Linux

VLAN-Paket installieren

• apt install vlan

VLAN-Modul laden

• sudo modprobe 8021q

Modul beim Booten automatisch laden

• echo 8021q | sudo tee -a /etc/modules

/etc/network/interfaces

#MGMT
auto enp0s8
iface enp0s8 inet static
 address 172.26.56.1/24


#DMZ
auto enp0s8.21
iface enp0s8.21 inet static
 address 10.88.2XX.1/24
 vlan-raw-device enp0s8 
 post-up ip rule add fwmark 0x2 lookup 100
 post-up ip route add default via 10.88.2XX.4 table 100

#LAN
auto enp0s8.22
iface enp0s8.22 inet static
 address 172.26.2XX.1/24
 vlan-raw-device enp0s8 


#SERVER
auto enp0s8.23
iface enp0s8.23 inet static
 address 10.2XX.1.1/24
 vlan-raw-device enp0s8 

Zum Open vSwitch

• ssh localhost -p 2222

oder im Notfall

• nc localhost 2222

Logindaten

• user: kit
• pass: kit
• root: mit sudo -i

VLAN zuordnen

• ovs-vsctl add-port sw0 port1 tag=1 trunks=21,22,23 vlan_mode=native-untagged
• ovs-vsctl del-port sw0 port2 tag=21
• ovs-vsctl add-port sw0 port3 tag=21
• ovs-vsctl add-port sw0 port3 tag=21
• ovs-vsctl add-port sw0 port4 tag=21
• ovs-vsctl add-port sw0 port5 tag=21
• ovs-vsctl add-port sw0 port6 tag=21
• ovs-vsctl add-port sw0 port7 tag=21
• ovs-vsctl add-port sw0 port8 tag=21
• ovs-vsctl add-port sw0 port9 tag=21
• ovs-vsctl add-port sw0 port10 tag=22
• ovs-vsctl add-port sw0 port11 tag=22
• ovs-vsctl add-port sw0 port12 tag=22
• ovs-vsctl add-port sw0 port13 tag=22
• ovs-vsctl add-port sw0 port14 tag=23
• ovs-vsctl add-port sw0 port15 tag=23
• ovs-vsctl add-port sw0 port16 tag=23

Vlan Interfaces anlegen

• ovs-vsctl add-port sw0 mgmt tag=1 -- set interface mgmt type=internal*
• ovs-vsctl add-port sw0 dmz tag=21 -- set interface dmz type=internal
• ovs-vsctl add-port sw0 lan tag=22 -- set interface lan type=internal
• ovs-vsctl add-port sw0 server tag=23 -- set interface server type=internal

MGMT IP setzen

• cat >> /etc/network/interfaces << 'EOF'

auto mgmt
iface mgmt inet static
    address 172.26.2XX.2/26
    gateway 172.26.2XX.1
    dns-nameservers 10.88.2XX.21
    dns-search it2XX.int
EOF

• ifup mgmt

TODO Anpassungen

• Firewall
• DHCP Server
• Sonst nochwas?