Handling Two C4000X Giganet LANs via One Ethernet Port on a Linux Box

Configure Linux to handle two C4000X Giganet LANs on a single Ethernet port by assigning distinct VLAN IDs to each network segment. Use vconfig or ip link to create sub-interfaces, apply static IP addresses for each LAN, and enable IP forwarding with appropriate iptables rules to route traffic between the isolated segments while maintaining security.

Understanding the Hardware Constraints

The C4000X Giganet series typically operates as managed switches that support IEEE 802.1Q VLAN tagging. When you have two separate logical networks (LANs) that need to communicate with a central Linux server but must remain logically isolated from each other, using a single physical Ethernet interface is the most efficient approach. This setup avoids the need for additional hardware adapters and reduces cabling complexity.

Before proceeding, ensure your Linux distribution supports VLAN interfaces. Most modern distributions include the necessary kernel modules (8021q) by default. If not, install the vconfig utility or rely on the iproute2 suite which has become the standard for network configuration in recent years. The core concept relies on the switch port connecting to the Linux box being configured as a "trunk" port, allowing multiple VLAN tags to pass through a single cable.

Configuring the Switch Port

The first step occurs at the network switch level. You must configure the specific port connected to your Linux machine to allow traffic from both VLANs associated with the C4000X LANs. Typically, one VLAN ID will be assigned to LAN A and another to LAN B. For example, if LAN A uses VLAN 10 and LAN B uses VLAN 20, the switch port must be set to trunk mode.

In many managed switches, this involves setting the port to Tagged status for both VLAN 10 and VLAN 20. This ensures that frames leaving the switch towards the Linux box retain their VLAN tags. If the port is set to Untagged for one of the VLANs, the Linux box will receive untagged frames, which may conflict with your default network configuration. Therefore, consistency is key: either tag all relevant VLANs on that trunk port or carefully manage the native VLAN settings if your specific switch model requires it.

Creating Sub-Interfaces in Linux

Once the switch is ready, you need to tell Linux how to interpret the incoming tagged traffic. This is done by creating virtual sub-interfaces on your primary Ethernet device, such as eth0 or enp3s0. Using the ip command line tool, you can add these interfaces dynamically.

# Replace eth0 with your actual interface name
# Create VLAN 10 interface
ip link add link eth0 name eth0.10 type vlan id 10

# Create VLAN 20 interface
ip link add link eth0 name eth0.20 type vlan id 20

# Bring both interfaces up
ip link set eth0.10 up
ip link set eth0.20 up

This command creates two new logical interfaces: eth0.10 for the first LAN and eth0.20 for the second. These interfaces now exist alongside the physical eth0 interface but operate independently at the data link layer. Each sub-interface will filter packets based on the VLAN ID embedded in the Ethernet frame header.

Assigning IP Addresses and Routing

With the sub-interfaces active, you must assign IP addresses to them so they can communicate within their respective LANs. It is crucial to place each subnet on a different broadcast domain to prevent ARP conflicts. For instance, assign 192.168.10.1/24 to eth0.10 and 192.168.20.1/24 to eth0.20.

ip addr add 192.168.10.1/24 dev eth0.10
ip addr add 192.168.20.1/24 dev eth0.20

If you intend for devices in LAN A to communicate with devices in LAN B, you must enable IP forwarding in the Linux kernel. This turns the Linux box into a router between the two VLANs. Check the current status with:

sysctl net.ipv4.ip_forward

If it returns 0, enable it temporarily with:

sysctl -w net.ipv4.ip_forward=1

To make this persistent across reboots, add net.ipv4.ip_forward = 1 to /etc/sysctl.conf. However, before enabling forwarding, you should configure firewall rules to control what traffic is allowed between the two networks. Without restrictions, any device in LAN A could potentially access any service in LAN B, which may pose a security risk.

Persisting the Configuration

Dynamic commands executed via the terminal are lost upon reboot. To ensure your VLAN configuration survives a restart, you must modify your network configuration files. The method varies depending on your distribution.

• Debian/Ubuntu: Edit /etc/network/interfaces or use Netplan YAML files in newer versions. Define the physical interface as a bridge or plain interface, then define the VLAN interfaces with their respective IDs and IP addresses.
• RHEL/CentOS/Fedora: Use NetworkManager or the legacy /etc/sysconfig/network-scripts/ directory. Create files like ifcfg-eth0.10 and ifcfg-eth0.20 specifying the VLAN parent and ID.

After editing the configuration files, restart the networking service. Verify the setup by pinging a device in each LAN from the Linux box and checking the routing table with ip route to ensure correct paths are established.

Frequently Asked Questions

Can I use unmanaged switches for this setup?

No, unmanaged switches do not support VLAN tagging or trunk ports. You require a managed switch capable of configuring 802.1Q VLANs to separate the traffic streams logically over a single cable.

What happens if I don't enable IP forwarding?

Without IP forwarding, the Linux box will only act as a host for each VLAN separately. Devices in LAN A will not be able to reach devices in LAN B, effectively keeping the two networks completely isolated from each other.

How do I troubleshoot missing VLAN tags?

Use tcpdump -i eth0.10 to capture traffic on the specific sub-interface. If you see no packets, check the switch port configuration to ensure the VLAN is marked as "Tagged" on the trunk port rather than "Untagged."

Is bonding recommended for this scenario?

Bonding combines multiple physical links for redundancy or speed, but it does not inherently solve VLAN separation on a single link. For separating two distinct LANs on one port, VLAN sub-interfaces are the correct approach, whereas bonding is useful if you have multiple physical cables.

Can I assign multiple IPs to one VLAN interface?

Yes, you can alias multiple IP addresses to a single VLAN interface, but this is generally discouraged for separating distinct LANs. It is better to create separate VLAN IDs for each logical network to maintain clear broadcast domains and simplify firewall management.