Creating VLANs on KVM with OpenVswitch
VLAN is a crucial L2 network technology for increasing broadcast domain at the end it gives you better network utilization and security. If you are familiar with vmWare technology you can create a port group on a dVS or Standard switch. But If you need to segregate your network on KVM hypervisor, you need some other packages . In this tutorial I will show you how to create VLANs by using openvswitch and integrating it to KVM.
For this post, I assume that you already had openvswitch installed on your system. If not, follow here . I am also assuming that you have a physical NIC to bridge it to your virtual bridge(switch) which is created via openvswitch. By doing that you can connect to the outside world.
tesla@ankara:~$ sudo ovs-vsctl -V
ovs-vsctl (Open vSwitch) 2.12.0
DB Schema 8.0.0
Creating a Virtual Bridge with Openvswitch
$ sudo ovs-vsctl add-br OVS0
Adding Physcical NIC to OVS0 Bridge
sudo ovs-vsctl add-port OVS0 enp0s31f6
In order to integrate the bridge which is created by openvswitch to KVM, we need to create XML configuration file which needed to be defined on KVM. You can see my configuration below.
<network>
<name>OVS0</name>
<forward mode='bridge'/>
<bridge name='OVS0'/>
<virtualport type='openvswitch'/>
<portgroup name='VLAN10'>
<vlan>
<tag id='10'/>
</vlan>
</portgroup>
<portgroup name='VLAN20'>
<vlan>
<tag id='20'/>
</vlan>
</portgroup>
<portgroup name='VLAN30'>
<vlan>
<tag id='30'/>
</vlan>
</portgroup>
<portgroup name='VLAN40'>
<vlan>
<tag id='40'/>
</vlan>
</portgroup>
<portgroup name='VLAN99'>
<vlan>
<tag id='99'/>
</vlan>
</portgroup>
<portgroup name='VLAN100'>
<vlan>
<tag id='100'/>
</vlan>
</portgroup>
<portgroup name='TRUNK'>
<vlan trunk='yes'>
<tag id='10'/>
<tag id='20'/>
<tag id='30'/>
<tag id='40'/>
<tag id='99'/>
<tag id='100'/>
</vlan>
</portgroup>
</network>
As per XML configuration above, we are creating a VLAN ID: 10, 20, 30, 40, 99 and 100.
Defining the configuration with virsh
virsh # net-define --file OVS0.xml
Network OVS0 defined from OVS0.xml
virsh # net-autostart --network OVS0
Network OVS0 marked as autostarted
virsh # net-list
Name State Autostart Persistent
--------------------------------------------
default active yes yes
OVS0 active yes yes
After defining it, you will see that your XML file modified by KVM with uuid.
<!--
WARNING: THIS IS AN AUTO-GENERATED FILE. CHANGES TO IT ARE LIKELY TO BE
OVERWRITTEN AND LOST. Changes to this xml configuration should be made using:
virsh net-edit OVS0
or other application using the libvirt API.
-->
<network>
<name>OVS0</name>
<uuid>a38bdd43-7fba-4e23-98f1-8c0ab83cff2c</uuid>
<forward mode='bridge'/>
<bridge name='OVS0'/>
<virtualport type='openvswitch'/>
<portgroup name='VLAN10'>
<vlan>
<tag id='10'/>
</vlan>
</portgroup>
<portgroup name='VLAN20'>
<vlan>
<tag id='20'/>
</vlan>
</portgroup>
<portgroup name='VLAN30'>
<vlan>
<tag id='30'/>
</vlan>
</portgroup>
<portgroup name='VLAN40'>
<vlan>
<tag id='40'/>
</vlan>
</portgroup>
<portgroup name='VLAN99'>
<vlan>
<tag id='99'/>
</vlan>
</portgroup>
<portgroup name='VLAN100'>
<vlan>
<tag id='100'/>
</vlan>
</portgroup>
<portgroup name='TRUNK'>
<vlan trunk='yes'>
<tag id='10'/>
<tag id='20'/>
<tag id='30'/>
<tag id='40'/>
<tag id='99'/>
<tag id='100'/>
</vlan>
</portgroup>
</network>
Experiments
Let’s check on virt-manager if we are able to see the port groups.