[Bridge] MAC learning and VLAN

[Bridge] MAC learning and VLAN

[Joakim Tjernlund]

I got 2 VLANs:
 eth0.1, eth0.2
in a bridge br0

eth0.1 receives packages and learns the remote MAC addresses however
eth0.2 never receives any pkgs from the same hosts as eth0.1

Looking into the bride one can see that the bridge has not learned
any MAC addresses over eth0.2 so I cannot send any pkgs
back to the host over eth0.2(except broadcast).

Is this expected? I had hoped that the MAC learning in the bridge was global
so any MACs learned over eth0.1 could be used by eth0.2 too.

  Jocke

Re: [Bridge] MAC learning and VLAN

[Benny Amorsen]

Joakim Tjernlund <joakim.tjernlund@transmode.se> writes:

> Is this expected? I had hoped that the MAC learning in the bridge was global
> so any MACs learned over eth0.1 could be used by eth0.2 too.

eth0.1 and eth0.2 are entirely separate interfaces. The behaviour is
exactly the same whether you use two VLAN's or two physical interfaces.

Imagine replacing eth0.1 with eth1 and eth0.2 with eth2. If a certain
MAC address is learned on eth1, it would be wrong to send packets
destined for that MAC address through eth2. That's pretty much the point
of bridging.


/Benny

Re: [Bridge] MAC learning and VLAN

[Joakim Tjernlund]

Benny Amorsen <benny+usenet@amorsen.dk> wrote on 19/08/2009 14:42:13:
>
> Joakim Tjernlund <joakim.tjernlund@transmode.se> writes:
>
> > Is this expected? I had hoped that the MAC learning in the bridge was global
> > so any MACs learned over eth0.1 could be used by eth0.2 too.
>
> eth0.1 and eth0.2 are entirely separate interfaces. The behaviour is
> exactly the same whether you use two VLAN's or two physical interfaces.

Yes, this appears how linux impl. VLANs but I wonder if this
is how VLAN aware switch would impl. it? Looing into 802.1Q it
sees this is referred to as SVL resp. IVL? I guess linux only
supports IVL?

>
> Imagine replacing eth0.1 with eth1 and eth0.2 with eth2. If a certain
> MAC address is learned on eth1, it would be wrong to send packets
> destined for that MAC address through eth2. That's pretty much the point
> of bridging.

Yes it would be wrong, but eth0.1 and eth0.2 are on the same physical LAN
and could share learned MAC addresses but as it is impl. in linux
it does not seem possible.

Re: [Bridge] MAC learning and VLAN

[Benny Amorsen]

Joakim Tjernlund <joakim.tjernlund@transmode.se> writes:

> Yes, this appears how linux impl. VLANs but I wonder if this
> is how VLAN aware switch would impl. it? Looing into 802.1Q it
> sees this is referred to as SVL resp. IVL? I guess linux only
> supports IVL?

Generally a VLAN aware switch is unable to bridge between different
VLAN's. You would be unable to configure your example except on the
fanciest of switches.

>> Imagine replacing eth0.1 with eth1 and eth0.2 with eth2. If a certain
>> MAC address is learned on eth1, it would be wrong to send packets
>> destined for that MAC address through eth2. That's pretty much the point
>> of bridging.
>
> Yes it would be wrong, but eth0.1 and eth0.2 are on the same physical LAN
> and could share learned MAC addresses but as it is impl. in linux
> it does not seem possible.

What would be the point? What is it you're trying to accomplish? If the
machines can communicate on VLAN 1, why do you want them to send traffic
on VLAN 2 instead?


/Benny

Re: [Bridge] MAC learning and VLAN

[Joakim Tjernlund]

Benny Amorsen <benny+usenet@amorsen.dk> wrote on 19/08/2009 16:17:14:
>
> Joakim Tjernlund <joakim.tjernlund@transmode.se> writes:
>
> > Yes, this appears how linux impl. VLANs but I wonder if this
> > is how VLAN aware switch would impl. it? Looing into 802.1Q it
> > sees this is referred to as SVL resp. IVL? I guess linux only
> > supports IVL?
>
> Generally a VLAN aware switch is unable to bridge between different
> VLAN's. You would be unable to configure your example except on the
> fanciest of switches.
>
> >> Imagine replacing eth0.1 with eth1 and eth0.2 with eth2. If a certain
> >> MAC address is learned on eth1, it would be wrong to send packets
> >> destined for that MAC address through eth2. That's pretty much the point
> >> of bridging.
> >
> > Yes it would be wrong, but eth0.1 and eth0.2 are on the same physical LAN
> > and could share learned MAC addresses but as it is impl. in linux
> > it does not seem possible.
>
> What would be the point? What is it you're trying to accomplish? If the
> machines can communicate on VLAN 1, why do you want them to send traffic
> on VLAN 2 instead?

trying to do private VLAN, http://tools.ietf.org/html/draft-sanjib-private-vlan-10,
using ebtables. It does not seem to be enough to only filter
pkgs. Isolated port are special and, as I understand it, they only
receive pkgs from the uplink via the primary VLAN and only
TX onto the isolated VLAN on the uplink(forget about other ports, it is
the uplink that is the problem)

Re: [Bridge] MAC learning and VLAN

[Benny Amorsen]

Joakim Tjernlund <joakim.tjernlund@transmode.se> writes:

> trying to do private VLAN, http://tools.ietf.org/html/draft-sanjib-private-vlan-10,
> using ebtables. It does not seem to be enough to only filter
> pkgs. Isolated port are special and, as I understand it, they only
> receive pkgs from the uplink via the primary VLAN and only
> TX onto the isolated VLAN on the uplink(forget about other ports, it is
> the uplink that is the problem)

You are trying to make private VLAN's, and at the same time you're
mixing in 802.1q tagging... I think you should start with making
everything work using physical interfaces only.


/Benny

Re: [Bridge] MAC learning and VLAN

[Joakim Tjernlund]

Benny Amorsen <benny+usenet@amorsen.dk> wrote on 19/08/2009 18:40:10:
>
> Joakim Tjernlund <joakim.tjernlund@transmode.se> writes:
>
> > trying to do private VLAN, http://tools.ietf.org/html/draft-sanjib-private-vlan-10,
> > using ebtables. It does not seem to be enough to only filter
> > pkgs. Isolated port are special and, as I understand it, they only
> > receive pkgs from the uplink via the primary VLAN and only
> > TX onto the isolated VLAN on the uplink(forget about other ports, it is
> > the uplink that is the problem)
>
> You are trying to make private VLAN's, and at the same time you're
> mixing in 802.1q tagging... I think you should start with making
> everything work using physical interfaces only.

ehh, 802.1q tagging is required for PVLAN. I have one uplink
to another switch. You have to treat the Isolated/Primary VLANs
especially though.