VLAN and LAGG

Summary

Connect your Ixolate Appliance successfully to a Managed Switch using OSI Layer 2 protocols like LAGG and VLAN.

Introduction

A VLAN (Virtual Local Area Network) allows to create separate Layer 2 networks within the same physical switch. This means you can segment a single physical network into multiple logical networks, keeping different groups of devices isolated from each other even though they are connected to the same switch.

VLAN are usually categorized as tagged and `untagged`:

• Tagged VLAN: Frames are sent with VLAN tags embedded in them. This allows multiple VLANs to be carried over a single network link, typically between switches or VLAN-aware devices. Tagged VLANs are used on trunk ports to identify which frame belongs to which VLAN.

• Untagged VLAN: Frames are sent without VLAN tags. The switch port assigns incoming untagged frames to a default VLAN. Untagged VLANs are typically used on access ports connected to end devices that are not VLAN-aware, such as computers.

Each VLAN will represent its own isolated network, connected by a VLAN-aware router like the Ixolate. Traffic that should cross VLAN boundaries must be routed and controlled via firewall rules. This is known as Inter-VLAN-Routing.

Attention

Attention

Do not mix tagged and untagged VLANs on the trunk connecting the Ixolate Appliance and the Managed Switch. Side effects include leaking Router Advertisements, DHCP, CARP and other broadcasts between tagged and untagged VLANs. This depends on the brand of the deployed switch, so avoiding untagged frames for trunk ports is the safest method. Additionally, the interface statistics of the untagged VLAN would show all traffic, which can be confusing.

Attention

Attention

Do not use a bridge interface to connect multiple ports to the same switch as this will create a network loop. Use a Layer 2 Link Aggregation protocol (LAGG) with LACP instead.

This guide will explain the best practice approach. Since switches from different vendors offer divergent configuration paths, only a guideline can be provided.

Setup Overview

In our basic setup, we have a Managed Switch and an Ixolate Appliance.

We need isolate:

• a LAN network with PCs, we assigned VLAN 5
• a DMZ network with Web Servers, we assigned VLAN 20
• a GUEST network with clients connecting to a Guest Wifi, we assigned VLAN 33

The Ixolate and the Switch are either connected with a single network cable, or with multiple network cables via Link Aggregation. The Port Mode describes the configuration of the Managed Switch ports.

Configuration

1. Setup LAGG Interface (optional)

See the section on LAGG for more details.

Attention

Attention

The member interfaces of a LAGG must be unassigned before creation. Check in Interfaces › Assignments and delete the assignment if necessary.

• Go to Interfaces › Devices › LAGG and add a new entry:

Afterwards, create the same LAGG interface on the Managed Switch and assign one or more physical interfaces to it. Connect the Ixolate Appliance and the Managed Switch via one or multiple network cables to establish the link layer. Verify the status of the LAGG interface as up before continuing.

2. Add VLAN Interfaces

See the section on VLAN for more details.

In our example setup we require tagged VLAN 5 (LAN), 20 (DMZ) and 33 (GUEST), and no untagged VLAN. If you skipped Step 1, create the VLAN directly on a physical interface like igc0.

• Go to Interfaces › Devices › VLAN and add new entries:

• Go to Interfaces › Assignments and assign the new VLAN interfaces. The parent interface should stay unassigned. In rare cases, the parent interface can be assigned without a network configuration, to allow manual link speed overrides.

• On the Managed Switch, create the same tagged VLANs on the LAGG or physical interface. Make sure there is no Native-VLAN-ID or default VLAN on the trunk port that connects to the Ixolate.

3. Create Networks on VLANs

To create connectivity between assigned VLAN interfaces via Inter-VLAN-Routing, configure a network on them. It is good practice to embed the VLAN IDs into the layer 3 networks, if possible.

Attention

Attention

Each VLAN interface requires a unique IPv4 and/or IPv6 network, conflicts will prevent Inter-VLAN-Routing. If you plan multiple sites that should be connected via VPN, you can reuse the same VLAN IDs, yet use unique IPv4 networks for each site of your organization.

With VLANs configured, PCs in LAN, Web Servers in DMZ and Guest Wifi clients in GUEST are isolated, even though they are connected to the same switch.

The Ixolate is responsible to route packets between VLANs.

It is the default gateway in VLAN 5, 20 and 33. It will receive packets with destination IP addresses to the other locally connected networks, and route according to its routing table. Access can be controlled with Firewall Rules, essentially creating different security zones.