Trunks and access — what the operator controls at each end of the cable

The operator’s VyOS box has two roles on a VLAN link: as an access port (carrying traffic for one VLAN, untagged) or as a trunk port (carrying traffic for multiple VLANs, tagged). The configuration must match the switch port on the other end.

Access port on VyOS

[edit]
vyos@vyos# set interfaces ethernet eth0 vif 10 address '192.0.2.1/24'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

The interface has one sub-interface (VLAN 10). The parent eth0 carries untagged frames that the kernel treats as VLAN 10. This is the access port pattern from the operator’s side.

Trunk port on VyOS

[edit]
vyos@vyos# set interfaces ethernet eth0 vif 10 address '192.0.2.1/24'
[edit]
vyos@vyos# set interfaces ethernet eth0 vif 20 address '203.0.113.1/24'
[edit]
vyos@vyos# set interfaces ethernet eth0 vif 30 address '198.51.100.1/24'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

The interface has multiple sub-interfaces. The parent eth0 carries all three VLANs as tagged frames. The switch on the other end must be configured as a trunk port with the same VLANs.

Native VLAN on the parent

[edit]
vyos@vyos# set interfaces ethernet eth0 native-vlan '999'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

The native VLAN is the VLAN for untagged frames on the parent. Setting it to an unused value (999 is a common convention) mitigates VLAN-hopping attacks.

Matching the switch

The operator must ensure the VyOS and switch configurations match. A mismatch produces frames in the wrong VLAN.

How the result is validated

show interface ethernet
ip link show
tcpdump -i eth0 -e -n vlan <id>

The first shows the VyOS view; the second shows the kernel mapping; the third captures only specific VLAN frames.

How it fails

The production failure modes the engineer must recognise:

• VyOS trunk, switch access. The switch sends untagged frames. The VyOS kernel places them in the native VLAN; if no native VLAN is configured, the frames are dropped.
• VyOS access, switch trunk. The switch sends tagged frames. The VyOS kernel drops them because the access interface does not have a sub-interface for the tagged VLAN.
• Allowed VLAN mismatch. The switch’s trunk allows VLAN 10, 20, 30 but VyOS only has sub-interfaces for 10, 20. Frames for VLAN 30 are dropped at the switch.
• Native VLAN mismatch. VyOS native VLAN 999, switch native VLAN 1. Untagged frames are placed in different VLANs at each end.

Rollback

The recovery from a trunk/access mismatch:

• Configure both ends as the same type (both trunk, both access).
• Match allowed VLANs and native VLAN.
• Verify with tcpdump -e -n vlan <id>.

Production discipline

Cross-course references

The Proxmox course’s XXIX-Proxmox-Networking covers the host-side trunk configuration. The OPNsense course’s XIV-OPNsense-VLAN covers the equivalent configuration on the firewall side. The Linux course’s XIX-Linux-NetFoundations covers the kernel’s VLAN model.

Quiz