! Create vlans
vlan database
vlan 10,15,20,30,100,200,210
vlan name 10 "mgmt"
vlan name 15 "vmgmt"
vlan name 20 "intsvc"
vlan name 30 "extsvc"
vlan name 100 "storage"
vlan name 200 "home"
vlan name 210 "vpn"
exit
! This interface is an unused uplink interface
interface 0/1
vlan participation include 10
exit
! This interface is the primary uplink interface.
! Stuff in the "home" vlan and "mgmt" vlan need to talk over the internet right now.
! This will be removed later when the cable modem runs through the new router.
interface 0/2
vlan participation include 10,200
exit
! 0/3-0/8 all look like this. They are access ports for management interfaces.
! They are currently also implicit members of vlan 1 so that they can talk to
! the internet. This is only for setup and will be removed in the near future.
! HINT: Configure a range of interfaces like this: interface 0/3-0/8
interface 0/3
spanning-tree edgeport
vlan pvid 10
vlan participation include 10
exit
interface 0/4
spanning-tree edgeport
vlan pvid 10
vlan participation include 10
exit
! ... these all look the same through 0/8 ...
! 0/9-0/12 and 0/13-0/16 are two four-port LAG connections
! These are excluded from all vlans on purpose
interface 0/9
vlan participation exclude 1,10,15,20,30,100,200,210
exit
interface 0/10
vlan participation exclude 1,10,15,20,30,100,200,210
exit
interface 0/11
vlan participation exclude 1,10,15,20,30,100,200,210
exit
interface 0/12
vlan participation exclude 1,10,15,20,30,100,200,210
exit
! ... 0/13-0/16 look the same ...
! OK, use case for 0/37 -0/48 is that these ports connect to existing
! devices in the home and are generally assumed to be not vlan-aware.
! These ports are configured as access ports with access to vlan 1 in order
! to get out on the internet. Again, that will change a little once the router
! is in place. If someone walked into the house and wanted a network port,
! they could plug into here, get a config via DHCP, etc....
interface 0/37
spanning-tree edgeport
vlan pvid 200
vlan acceptframe admituntaggedonly
vlan ingressfilter
vlan participation include 200
exit
! ... 0/38-0/48 are identical ...
! 0/49-0/50 are the two 10G SFP+ ports. These are currently connected
! to my NAS and a hypervisor. Soon, one of these ports will be used to
! trunk the storage VLAN to a LB6M switch, into which all six hypervisors
! and two NAS boxes will connect at 10G. For the moment, these are
! basically access ports for VLAN 100. Note explicit exclusion of VLAN 1.
interface 0/49
vlan pvid 100
vlan participation exclude 1
vlan participation include 100
exit
interface 0/50
vlan pvid 100
vlan participation exclude 1
vlan participation include 100
exit
! OK, now things get interesting...
! Here are the two LAG interfaces. Both are configured to run 802.3ad
! to systems running linux, and to do 802.1q trunking for a set of VLANs
! over the link. This took a while to figure out and get working. The key is
! the "no port-channel static" directive. This causes the link to be dynamic,
! which makes linux much happier on the other end. For a switch-to-switch
! LAG, it works fine in static mode as long as the config is the same on both
! ends. Both of these are also including VLAN 1 for internet uplink right now.
interface 3/20
no port-channel static
vlan participation exclude 100
vlan participation include 10,15,20,30,200,210
vlan tagging 1,10,15,20,30,200,210
exit
interface 3/21
no port-channel static
vlan participation include 10,15,20,30,100,200,210
vlan tagging 1,10,15,20,30,100,200,210
exit
