Procedure

1. Display the network interfaces:

   # nmcli device status
   DEVICE   TYPE      STATE         CONNECTION
   enp1s0   ethernet  disconnected  enp1s0
   bridge0  bridge    connected     bridge0
   bond0    bond      connected     bond0
   ...

2. Create the VLAN interface. For example, to create a VLAN interface named vlan10 that uses enp1s0 as its parent interface and that tags packets with VLAN ID 10, enter:

   # nmcli connection add type vlan con-name vlan10 ifname vlan10 vlan.parent enp1s0 vlan.id 10

   Note that the VLAN must be within the range from 0 to 4094.

3. By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. Optionally, set a different MTU value:

   # nmcli connection modify vlan10 802-3-ethernet.mtu 2000

4. Configure the IP settings of the VLAN device. Skip this step if you want to use this VLAN device as a port of other devices.

   1. Configure the IPv4 settings. For example, to set a static IPv4 address, network mask, default gateway, and DNS server to the vlan10 connection, enter:

      # nmcli connection modify vlan10 ipv4.addresses '192.0.2.1/24'
      # nmcli connection modify vlan10 ipv4.gateway '192.0.2.254'
      # nmcli connection modify vlan10 ipv4.dns '192.0.2.253'
      # nmcli connection modify vlan10 ipv4.method manual

   2. Configure the IPv6 settings. For example, to set a static IPv6 address, network mask, default gateway, and DNS server to the vlan10 connection, enter:

      # nmcli connection modify vlan10 ipv6.addresses '2001:db8:1::1/32'
      # nmcli connection modify vlan10 ipv6.gateway '2001:db8:1::fffe'
      # nmcli connection modify vlan10 ipv6.dns '2001:db8:1::fffd'
      # nmcli connection modify vlan10 ipv6.method manual

5. Activate the connection:

   # nmcli connection up vlan10

Verification steps

1. Verify the settings:

   # ip -d addr show vlan10
   4: vlan10@enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
       link/ether 52:54:00:d5:e0:fb brd ff:ff:ff:ff:ff:ff promiscuity 0
       vlan protocol 802.1Q id 10 <REORDER_HDR> numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute vlan10
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::1/32 scope global noprefixroute
          valid_lft forever preferred_lft forever
       inet6 fe80::8dd7:9030:6f8e:89e6/64 scope link noprefixroute
          valid_lft forever preferred_lft forever

Procedure

1. Open a terminal, and enter nm-connection-editor:

   $ nm-connection-editor

2. Click the + button to add a new connection.
3. Select the VLAN connection type, and click Create.

4. On the VLAN tab:

   1. Select the parent interface.
   2. Select the VLAN id. Note that the VLAN must be within the range from 0 to 4094.
   3. By default, the VLAN connection inherits the maximum transmission unit (MTU) from the parent interface. Optionally, set a different MTU value.

   4. Optionally, set the name of the VLAN interface and further VLAN-specific options.

      

5. Configure the IP settings of the VLAN device. Skip this step if you want to use this VLAN device as a port of other devices.

   1. On the IPv4 Settings tab, configure the IPv4 settings. For example, set a static IPv4 address, network mask, default gateway, and DNS server:
   2. On the IPv6 Settings tab, configure the IPv6 settings. For example, set a static IPv6 address, network mask, default gateway, and DNS server:
6. Click Save to save the VLAN connection.
7. Close nm-connection-editor.

Verification steps

1. Verify the settings:

   # ip -d addr show vlan10
   4: vlan10@enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
       link/ether 52:54:00:d5:e0:fb brd ff:ff:ff:ff:ff:ff promiscuity 0
       vlan protocol 802.1Q id 10 <REORDER_HDR> numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
       inet 192.0.2.1/24 brd 192.0.2.255 scope global noprefixroute vlan10
          valid_lft forever preferred_lft forever
       inet6 2001:db8:1::1/32 scope global noprefixroute
          valid_lft forever preferred_lft forever
       inet6 fe80::8dd7:9030:6f8e:89e6/64 scope link noprefixroute
          valid_lft forever preferred_lft forever

Procedure

1. Create a YAML file, for example ~/create-vlan.yml, with the following contents:

   ---
   interfaces:
   - name: vlan10
     type: vlan
     state: up
     ipv4:
       enabled: true
       address:
       - ip: 192.0.2.1
         prefix-length: 24
       dhcp: false
     ipv6:
       enabled: true
       address:
       - ip: 2001:db8:1::1
         prefix-length: 64
       autoconf: false
       dhcp: false
     vlan:
       base-iface: enp1s0
       id: 10
   - name: enp1s0
     type: ethernet
     state: up
   
   routes:
     config:
     - destination: 0.0.0.0/0
       next-hop-address: 192.0.2.254
       next-hop-interface: vlan10
     - destination: ::/0
       next-hop-address: 2001:db8:1::fffe
       next-hop-interface: vlan10
   
   dns-resolver:
     config:
       search:
       - example.com
       server:
       - 192.0.2.200
       - 2001:db8:1::ffbb

2. Apply the settings to the system:

   # nmstatectl apply ~/create-vlan.yml

Verification steps

1. Display the status of the devices and connections:

   # nmcli device status
   DEVICE      TYPE      STATE      CONNECTION
   vlan10      vlan      connected  vlan10

2. Display all settings of the connection profile:

   # nmcli connection show vlan10
   connection.id:              vlan10
   connection.uuid:            1722970f-788e-4f81-bd7d-a86bf21c9df5
   connection.stable-id:       --
   connection.type:            vlan
   connection.interface-name:  vlan10
   ...

3. Display the connection settings in YAML format:

   # nmstatectl show vlan0

Procedure

1. If the host on which you want to execute the instructions in the playbook is not yet inventoried, add the IP or name of this host to the /etc/ansible/hosts Ansible inventory file:

   node.example.com

2. Create the ~/vlan-ethernet.yml playbook with the following content:

   ---
   - name: Configure a VLAN that uses an Ethernet connection
     hosts: node.example.com
     become: true
     tasks:
     - include_role:
         name: linux-system-roles.network
   
       vars:
         network_connections:
           # Add an Ethernet profile for the underlying device of the VLAN
           - name: enp1s0
             type: ethernet
   	  interface_name: enp1s0
   	  autoconnect: yes
             state: up
   	  ip:
   	    dhcp4: no
   	    auto6: no
   
           # Define the VLAN profile
           - name: vlan10
             type: vlan
             ip:
               address:
                 - "192.0.2.1/24"
                 - "2001:db8:1::1/64"
               gateway4: 192.0.2.254
               gateway6: 2001:db8:1::fffe
               dns:
                 - 192.0.2.200
                 - 2001:db8:1::ffbb
               dns_search:
                 - example.com
             vlan_id: 10
   	  parent: enp1s0
             state: up

   The parent attribute in the VLAN profile configures the VLAN to operate on top of the enp1s0 device.

3. Run the playbook:

   • To connect as root user to the managed host, enter:

     # ansible-playbook -u root ~/vlan-ethernet.yml

   • To connect as a user to the managed host, enter:

     # ansible-playbook -u user_name --ask-become-pass ~/vlan-ethernet.yml

     The --ask-become-pass option makes sure that the ansible-playbook command prompts for the sudo password of the user defined in the -u user_name option.

   If you do not specify the -u user_name option, ansible-playbook connects to the managed host as the user that is currently logged in to the control node.