VLANs and failure domains in cluster networks

VLANs are the standard way to separate cluster networks on a single physical switch. This lesson covers how to configure them and how to design for failure domains.

What VLANs are

A VLAN (Virtual LAN) is a layer 2 broadcast domain. Multiple VLANs can share one physical switch but are isolated from each other. Tagged VLANs (802.1Q) carry multiple VLANs on one cable.

Configure VLANs on Linux

# Install
sudo apt install vlan

# Create a VLAN interface
sudo ip link add link eth0 name eth0.100 type vlan id 100
sudo ip addr add 10.0.0.10/24 dev eth0.100
sudo ip link set eth0.100 up

Or in /etc/network/interfaces:

auto eth0.100
iface eth0.100 inet static
    address 10.0.0.10
    netmask 255.255.255.0
    vlan-raw-device eth0

Trunk vs access

• Trunk port: a switch port that carries multiple VLANs (802.1Q tagged). Used between switches and to hosts that need multiple VLANs.
• Access port: a switch port that carries one VLAN (untagged). Used for hosts that need one network.

For cluster hosts with multiple networks, the host NIC is usually a trunk (multiple VLANs) and the switch port is configured for 802.1Q tagging.

Failure domains with VLANs

VLANs provide logical separation but share physical infrastructure. For failure domain separation:

• Multiple switches (stacked or MLAG).
• Multiple uplinks per host (LACP bonding).
• VLANs across the redundant infrastructure.

The discipline: VLANs for logical separation, redundant hardware for failure domain separation.

VLANs in cluster networks

For a 2-host cluster with three networks:

• VLAN 10: management (BMC, console).
• VLAN 20: application (user traffic).
• VLAN 30: storage (DRBD, Ceph).

Each VLAN on a separate switch port or trunk port. The switch is configured with VLAN 10, 20, 30 on the trunk.

Knowledge check