Re: [Xen-users] Secure VLANs

[Jonathan Tripathy <jonnyt@xxxxxxxxxxx>]

On 05/01/11 22:48, Javier Guerra Giraldez wrote:
> On Wed, Jan 5, 2011 at 5:21 PM, Jonathan Tripathy<jonnyt@xxxxxxxxxxx>  wrote:
> > So in the context of Xen, given that a trunk port on the switch would
> > connect to Dom0, all I have to make sure is that the DomUs arn't connected
> > to a bridge in the Dom0 with a VLAN ID the same as the native VLAN ID of the
> > switch trunk port?
> On Linux, VLAN and bridge functionalities are separate things.
>
> regarding VLANs:
> you have your physical interface (eth0), and then add VLAN interfaces to it:
>
>    vconfig add eth0 12
>
> creates a new interface that you can see with ifconfig, probably
> called vlan12.  traffic on this new interface will come out tagged via
> eth0, and (if the rest of the network is ok), will be able to
> communicate only with devices on VLAN 12.
>
> so, in your startup scripts you should add all the vlan interfaces you
> need, it will be just as if you had a lot of ethernet NICs
>
>
> regarding bridges:
> linux's sowftware bridges don't manage VLANs, it's not like physical
> bridges where you have one bridge and configure each port.
>
> so, what you do is create several bridges, one for each VLAN, and then
> add only one vlan interface to each bridge.  for example, to prepare
> for VLAN 12:
>
>    vconfig add eth0 12
>    brctl addbr br12
>    brctl addif br12 vlan12
>
> now you have a bridge called br12 that is connected to your external
> VLAN 12 and nothing else.  then just add the DomU's interface to this
> bridge if they need to connect to VLAN 12
Hi Javier,

Thank you for the info. I think this has cleared up my confusion.

So, it is the linux vconfig utility that strips all vlan tags coming 
into the Dom0 and conversely, tags traffic coming out?
And provided that on my trunk lines (i.e. switch to Dom0, switch to 
switch and VLAN-aware firewall to switch) I either disable native VLAN 
(PVID) *or* make sure that the native VLAN ID on the trunk ports are not 
the same as any customer VLAN ID, then VLAN hopping can't occur?
Thanks

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users