Bridging a vlan trunk with a gif tunnel?

[Hauke Fath]

Hi,

I am trying to network a remote site with a main site through a bridged
gif tunnel, and it doesn't work for me. The if_bridge(4) man page
sounds deceptively easy. Browsing the web, what came up didn't help;
<https://lists.freebsd.org/pipermail/freebsd-net/2017-November/049278.html>
sounded vaguely related.

In the past, I have set up a similar link by tunneling ip over gif, but
routing turned out to be intricate, and I figured just bridging the
exclave with the main site would save me routing issues, plus I could
stick with the existing subnets.

The setup:

The main site runs a filtering router (freebsd 11, pf) to connect a
dozen subnets via vlans over an ix(4) trunk. The router serves dhcp to
several of those subnets. The trunk is bridged to the gif tunnel
interface:


cloned_interfaces="gif0 bridge0"

ifconfig_bridge0="addm ix0 addm gif0 up"
ifconfig_gif0="tunnel 130.83.aa.bb 130.83.cc.dd mtu 1500 up"
ifconfig_ix0="up"


The exclave bridge machine connects a trunk with three subnets over a
gif(4) tunnel:

cloned_interfaces="gif0 bridge0"

ifconfig_bridge0="addm em1 addm gif0 up"
ifconfig_gif0="tunnel 130.83.cc.dd 130.83.aa.bb mtu 1500 up"
ifconfig_em1="up"


Bridge sysctls on both machines:

# sysctl net.link.bridge
net.link.bridge.ipfw: 0
net.link.bridge.allow_llz_overlap: 0
net.link.bridge.inherit_mac: 0
net.link.bridge.log_stp: 0
net.link.bridge.pfil_local_phys: 0
net.link.bridge.pfil_member: 0
net.link.bridge.ipfw_arp: 0
net.link.bridge.pfil_bridge: 0
net.link.bridge.pfil_onlyip: 0
#

After finding and setting the above sysctls, the setup connects both
segments of each bridged vlan successfully, in that I can ping and
ssh-login from a machine on one segment to a machine on the other (or
rather, I could, until the latter machine's dhcp lease ran out, and I
am off-site). But there is no connection between the exclave segments
and the main-site router interfaces, neither for dhcp nor ip
connectivity.

So while an exclave machine is requesting an ip address through dhcp
(which the main router is expected to serve)

bridge0:
14:00:52.129710 d8:cb:8a:6e:74:29 (oui Unknown) > Broadcast, ethertype
802.1Q (0x8100), length 380: vlan 7, p 0, ethertype IPv4,
0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from
d8:cb:8a:6e:74:29 (oui Unknown), length 334

at the same time the main router calls that machine to identify

ix0:
14:00:00.866778 a0:36:9f:25:62:d4 (oui Unknown) > Broadcast, ethertype
802.1Q (0x8100), length 46: vlan 7, p 0, ethertype ARP, Request who-has
Plaike.nt.e-technik.tu-darmstadt.de tell 130.83.228.62, length 28

In short, the main router vlan interfaces do not see traffic coming to
their trunk via gif and bridge, nor can they send traffic that way.

Is there a magic knob that I have overlooked that will enable this
connection, or what else could I be missing?

Cheerio,
hauke

[Hauke Fath]

Post by Hauke Fath
The main site runs a filtering router (freebsd 11, pf) to connect a
dozen subnets via vlans over an ix(4) trunk. The router serves dhcp to
several of those subnets. The trunk is bridged to the gif tunnel

FTR:

%ifconfig bridge0
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0
mtu 1500
ether 02:eb:25:ed:5e:00
nd6 options=9<PERFORMNUD,IFDISABLED>
groups: bridge
id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
member: gif0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 9 priority 128 path cost 55
member: ix0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 1 priority 128 path cost 2000
%

[Hauke Fath]

Post by Hauke Fath
In short, the main router vlan interfaces do not see traffic coming to
their trunk via gif and bridge, nor can they send traffic that way.

In the light of
<https://lists.freebsd.org/pipermail/freebsd-net/2015-August/043036.html>,
I have re-created one of the vlans in question as a child of the
bridge instead of the ix0 - it didn't make a difference.

# ifconfig ix0.7 destroy
# ifconfig ix0.7 create vlan 7 vlandev bridge0 inet 130.83.228.62/26
# ifconfig ix0.7
ix0.7: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu
1500
options=200001<RXCSUM,RXCSUM_IPV6>
ether a0:36:9f:25:62:d4
inet 130.83.228.62 netmask 0xffffffc0 broadcast 130.83.228.63
inet6 fe80::a236:9fff:fe25:62d4%ix0.7 prefixlen 64 scopeid 0xe
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
media: Ethernet autoselect (10Gbase-T <full-duplex>)
status: active
vlan: 7 vlanpcp: 0 parent interface: ix0
groups: vlan
#

Note the parent interface listed is still ix0.

Cheerio,
hauke

[Eugene Grosbein]

Post by Hauke Fath
I am trying to network a remote site with a main site through a bridged
gif tunnel, and it doesn't work for me.

gif(4) supports only untagged frames when added to a bridge.
You need to create gif-per-vlan or switch to newer vxlan(4).

Post by Hauke Fath
In the past, I have set up a similar link by tunneling ip over gif, but
routing turned out to be intricate

what problems do you have with routing over gif? It works just fine for me.

Post by Hauke Fath
and I figured just bridging the exclave with the main site would save me routing issues,

And bring in bridging issues that are more severe.

Post by Hauke Fath
plus I could stick with the existing subnets.

And have extra overhead to pass +14 bytes of headers of MAC addresses per frame.

Single gif+bridge does not support trunks.

[Hauke Fath]

Post by Eugene Grosbein

Post by Hauke Fath
I am trying to network a remote site with a main site through a bridged
gif tunnel, and it doesn't work for me.

gif(4) supports only untagged frames when added to a bridge.

Well, as I said, bridging the trunk from the gif tunnel to the hardware
ix interface works, in that the attached switch sorts it out and
machines on both sides connect. It's the router's vlan interfaces that
do not communicate with the bridge.

Post by Eugene Grosbein
You need to create gif-per-vlan

... three vlans, one ip.

Post by Eugene Grosbein
or switch to newer vxlan(4).

That wouldn't work with the switches, would it, like vlans?

Post by Eugene Grosbein

Post by Hauke Fath
In the past, I have set up a similar link by tunneling ip over gif, but
routing turned out to be intricate

what problems do you have with routing over gif? It works just fine for me.

Routing requires new subnets, with acl changes rippling through the
whole installation. Since the university is essentially out of public
ipv4 space, we would have to NAT those subnets. Plus, with the past
setup, we got asymmetric routing, with some machines not reachable from
the other side - I successfully forgot the gory details, it's been a
while.

Post by Eugene Grosbein

Post by Hauke Fath
and I figured just bridging the exclave with the main site would save me routing issues,

And bring in bridging issues that are more severe.

Like what, besides the shortcomings of if_bridge(4)?

Post by Eugene Grosbein

Post by Hauke Fath
plus I could stick with the existing subnets.

And have extra overhead to pass +14 bytes of headers of MAC addresses per frame.
Single gif+bridge does not support trunks.

I'll take that, and look into a routing setup. Thanks for your answers,
even if I don't like them. ;)

Cheerio,
hauke

[Eugene Grosbein]

Post by Hauke Fath

Post by Eugene Grosbein
or switch to newer vxlan(4).

That wouldn't work with the switches, would it, like vlans?

vxlan is not instead of vlans, it is instead of gifs
vxlan is designed to pass trunks over routed network forming its own tunnel.
Just read its manual page.

Post by Hauke Fath

Post by Eugene Grosbein

Post by Hauke Fath
and I figured just bridging the exclave with the main site would
save me routing issues,

And bring in bridging issues that are more severe.

Like what, besides the shortcomings of if_bridge(4)?

Loops, broadcast storms spreading too far over long and slower links,
applications and kernels not adopting automatically for "not LAN" conditions
like they do in case of separate IP networks, extra overhead and timing issues,
poor manageability of if_bridge (unable to show/manage its forwarding tables
as opposed to newer vxlan) comparing to rich set of methods developed
for routing tables etc.

[Julian Elischer]

Post by Eugene Grosbein

Post by Hauke Fath
I am trying to network a remote site with a main site through a bridged
gif tunnel, and it doesn't work for me.

gif(4) supports only untagged frames when added to a bridge.
You need to create gif-per-vlan or switch to newer vxlan(4).

I have in the past implemented this using netgraph and vnet
but it was quite a log time ago and I forget many of the details
The vnet jail was so that the gif tunnel effectively left from
"another machine" (it was the same machine with a vnet jail)
The reason was so that net failures were "one hop away" and
therefore not so hard to work around.

Post by Eugene Grosbein

Post by Hauke Fath
In the past, I have set up a similar link by tunneling ip over gif, but
routing turned out to be intricate

what problems do you have with routing over gif? It works just fine for me.

Post by Hauke Fath
and I figured just bridging the exclave with the main site would save me routing issues,

And bring in bridging issues that are more severe.

Post by Hauke Fath
plus I could stick with the existing subnets.

And have extra overhead to pass +14 bytes of headers of MAC addresses per frame.
Single gif+bridge does not support trunks.
_______________________________________________
https://lists.freebsd.org/mailman/listinfo/freebsd-net