Sample Header Ad - 728x90

How to create a linux vlan aware bridge with ingress packets untagged and egress packets tagged

1 vote
1 answer
5750 views
I am trying to implement an obscure workaround to a specific problem tied to a switch misconfiguration I observe in a real case scenario. Please just assume the following : - My system is plugged to a trunk link with a cisco switch ; - I can send tagged packets in a specific VLAN (not native vlan), it will be properly routed to the correct VLAN ; - I receive responses as untagged traffic, even though it is on a trunk and from not-native VLAN ; - I cannot modify the switch's configuration. What I am trying to perform is a way to use a single network interface on Debian, where I can send and receive traffic correctly to insert my traffic in the desired VLAN, even though the packets must be tagged going out and will be caught back untagged. To give an example, It is possible to ping a remote system with an ICMP echo request. Using my simple eth0 interface will have no effect, no ICMP echo reply will be seen back. However, if I tag my ICMP echo request in say VLAN 10, I will receive an untagged ICMP echo reply ! It works also with DHCP for example (the remote network do has a DHCP server). If I send a tagged DHCP discover packet, I will receive an untagged DHCP offer with the corresponding transaction ID. I know this is not normal behavior and it can end up in having packets being wrongly routed or assumed to be in a VLAN falsely. It is due to switches being misconfigured (I think it has something to do with native vlan mismatch somewhere). If I use a vlan subinterface (ip link add link type vlan ...), I will send tagged traffic but responses will never be routed back from the main interface to the sub interface because it expects traffic to be tagged back. I then discovered vlan aware bridges, which look like a proper solution to my problem, though I dont succeed in doing this with the bridge vlan add commands (pvid, vid, untagged or not, do I need to use a vlan sub-interface anyway ?). I only need to do this for a single VLAN at a time. It will not be possible to determine to which VLAN a packet is sent because of the tags missing. However, I can infer this VLAN tag based on IP address, STP and CDP traffic. I do not want to do anything automated, I dont want to guess the vlan, I just want to be able to force untagged traffic to be considered being in a chosen, arbitrary vlan, one at a time. Thank you !
Asked by Almandin (13 rep)
Feb 16, 2024, 02:45 PM
Last activity: Feb 20, 2024, 07:50 AM