Discover how to create your VLANs, inter-VLANs, and your trunk interfaces! Get started with multilayer switching using Juniper's EX series.
Real-world use case
You need to segment your corporate network: here's how to create VLANs, inter-VLANs, and trunk interfaces under Junos.
JunOS: Virtual Local Area Network (VLAN)
A virtual local area network (VLAN) is an independent, logical computer network. VLANs are essential in the following cases, since they let you:
- Manage the network more effectively.
- Optimize bandwidth.
- Reduce collision domains.
- Strengthen security.
The following example explains VLAN/tagged VLAN networking under JunOS 12.3R8.7 (standard IEEE 802.1Q) with layer-3 switches (EX3300). Here, the routing mode is called Multilayer Switching.
In this tutorial, we'll cover certain points such as: the default VLAN, tagged VLANs, and trunk links between two virtual chassis of Juniper hardware over SFP+ (10G).
Understanding the default VLAN under JunOS
By default, on a Juniper switch, there's a VLAN named: default, and it encompasses all ports in bridge mode. For example, it lets small businesses avoid having to worry about the initial port configuration. It's directly operational.
Here's an example initial configuration (configure mode):
show interfaces
interfaces {
ge-0/0/0 {
unit 0 {
family ethernet-switching {
}
}
ge-0/0/1 {
unit 0 {
family ethernet-switching;
}
For reference, you'll notice that the lldp protocol is enabled to exchange information between ports. The rstp protocol is also present in the initial configuration (in case of a loop):
show protocoles
}
rstp;
lldp {
interface all;
}
Remember that the default VLAN doesn't use a VLAN ID (no tag), you can check this with the following command:
show vlans
Name Tag Interfaces
default
ge-0/0/1.0, ge-0/0/3.0, ge-0/0/4.0, ge-0/0/5.0, ge-0/0/6.0, ge-0/0/7.0, ge-0/0/8.0, ge-0/0/9.0, ge-0/0/10.0, ge-0/0/11.0, ge-0/0/12.0, ge-0/0/13.0, ge-0/0/14.0,
ge-0/0/15.0, ge-0/0/16.0, ge-0/0/17.0, ge-0/0/18.0, ge-0/0/19.0, ge-0/0/20.0, ge-0/0/21.0, ge-0/0/22.0, ge-0/0/23.0, ge-0/0/24.0, ge-0/0/25.0, ge-0/0/26.0, ge-0/0/27.0,
ge-0/0/28.0, ge-0/0/29.0, ge-0/0/30.0, ge-0/0/31.0, ge-0/0/32.0, ge-0/0/33.0, ge-0/0/34.0, ge-0/0/35.0, ge-0/0/36.0, ge-0/0/37.0, ge-0/0/38.0, ge-0/0/39.0, ge-0/0/40.0,
ge-0/0/41.0, ge-0/0/42.0, ge-0/0/43.0, ge-0/0/44.0, ge-0/0/45.0, ge-0/0/46.0, ge-0/0/47.0, ge-1/0/0.0, ge-1/0/1.0, ge-1/0/23.0
Configuring VLANs
We'll create various tagged VLANs (VLAN ID) as shown in the table below:
Interfacesge-0/0/0ge-0/1/0ge-0/2/0ge-0/3/0ge-0/4/0ge-0/3/0ge-0/4/0VLAN ID10203040506070VLANadminserversprintersuserswirelessvoipguest
Creating the various tagged VLANs is done with the following command (configure mode):
set vlans admin vlan-id 10
set vlans servers vlan-id 20
set vlans printers vlan-id 30
set vlans users vlan-id 40
set vlans wireless vlan-id 50
set vlans voip vlan-id 60
set vlans invite vlan-id 70
Here, we need to configure our various interfaces to belong to the selected VLAN, and there are two approaches to configuring an interface within a VLAN:
- Method 1: Add the member VLAN via the interface's configuration.
set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members admin
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members servers
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members printers
set interfaces ge-0/0/3 unit 0 family ethernet-switching vlan members users
set interfaces ge-0/0/4 unit 0 family ethernet-switching vlan members wireless
set interfaces ge-0/0/5 unit 0 family ethernet-switching vlan members voip
set interfaces ge-0/0/6 unit 0 family ethernet-switching vlan members invite
Run a check on your interface:
show configuration interfaces ge-0/0/0
unit 0 {
family ethernet-switching {
vlan {
members admin;
}
}
}
- Method 2: Add the interface via the member VLAN's configuration.
set vlans admin interface ge-0/0/0
set vlans servers interface ge-0/0/1
set vlans printers interface ge-0/0/2
set vlans users interface ge-0/0/3
set vlans wirless interface ge-0/0/4
set vlans voip interface ge-0/0/5
set vlans invite interface ge-0/0/6
The difference here is that the VLAN's configuration isn't available on the interface, only via the following command:
show vlan admin interface
To wrap up, whichever method you use makes no difference. We've seen how to create VLANs and assign a VLAN to an interface. Now the goal is to do inter-VLAN routing.
Tip: it's possible to group several interfaces into a VLAN very simply, here's an example:
set interfaces interface-range users unit 0 family ethernet-switching vlan members users
set interfaces interface-range users member-range ge-0/0/3 to ge-0/0/6
Configuring inter-VLAN routing interfaces.
Explaining inter-VLAN routing, or a routed VLAN interface (RVI) at Juniper, lets us make VLANs communicate with each other. Let's take an example with the servers and users VLANs. We want users to be able to access the servers.
We'll first create two VLAN interfaces with the logical unit (unit) of our VLAN IDs, like this:
set interfaces vlan unit 20 family inet address 192.168.20.1/24
set interfaces vlan unit 40 family inet address 192.168.40.1/24
Now we can link our VLAN interfaces to the RVI in order to make our two VLANs communicate:
set vlans serveurs l3-interface vlan.20
set vlans users l3-interface vlan.40
Try it out and connect a host to VLAN ID 20, then to VLAN ID 40, and run the command:
show interfaces terse | match vlan
vlan up up
vlan.20 up up inet 192.168.20.1/24
vlan.40 up up inet 192.168.40.1/24
Your two hosts should now be able to reach each other with a simple ping.
Configuring trunk links
In my case, one virtual chassis is an EX3300, and the other an EX4200, connected via SFP+ (10G).
First, we'll configure the SFP+ (xe) interface in trunk mode, as shown below:
set interfaces xe-0/1/0 unit 0 family ethernet-switching port-mode trunk
Then we'll allow our various VLANs to use the trunk link:
set interfaces xe-0/1/0 unit 0 family ethernet-switching vlan members [serveurs users]
Remember that as long as you don't explicitly add a VLAN member to the (xe) interface, no TCP/IP data will pass through it!
I encourage you to repeat the same steps on your other switch (or chassis) to finish this tutorial and let your VLANs flow through!
This walkthrough ends here, and for more information, head to this address: Understanding bridge mode and VLANs on EX switches.
Conclusion
This tutorial covers creating tagged VLANs under JunOS, associating them with interfaces using the two available methods, as well as setting up inter-VLAN routing (RVI) and trunk links between chassis. These elements form the essential foundation for segmenting and enabling communication across a Juniper network in a secure and organized way. A solid grasp of VLANs and inter-VLAN routing then makes it easier to build more complex network architectures.