# VLAN Modes and Traffic Behavior in HVM Standard Networks

The topic describes various VLAN Modes.

## Access Mode (Default)

The OVS bridge handles VLAN tagging transparently. The VM receives untagged Ethernet frames and remains unaware of VLAN assignments.

- UI fields: VLAN ID = 200, VLAN Trunks = (empty), Trunk Only = off
- Traffic flow:

  - Egress (VM to network): The VM sends an untagged frame, and the OVS bridge inserts the VLAN 200 tag before forwarding it to the uplink.
  - Ingress (network to VM): OVS receives a VLAN 200 tagged frame, removes the tag, and delivers an untagged frame to the VM.

## Hybrid Mode (Native VLAN + Trunk VLANs)

The system uses VLAN 0 as an untagged passthrough marker in the port group XML. The upstream switch handles the native VLAN, while the VM processes trunked VLANs using sub-interfaces.

- UI fields: VLAN ID = 300, VLAN Trunks = 100, 200, Trunk Only = off
- Traffic flow:

  - Egress (untagged): The VM sends an untagged frame, OVS passes it through, and the upstream switch assigns it to the native VLAN (300).
  - Egress (tagged): The VM sends tagged frames (for example, VLAN 100), and OVS forwards them unchanged if they match the trunk list.
  - Ingress (native VLAN): The upstream switch delivers untagged frames, and OVS forwards them untagged to the VM.
  - Ingress (trunk VLANs):] OVS passes tagged frames directly to the VM, and the guest OS routes them to the corresponding sub-interfaces.

## Trunk-Only Mode (All VLANs Tagged)

The system tags all VLAN traffic, including the primary VLAN. The VM must handle all VLAN tagging using sub-interfaces.

Case 1 : With Trunk VLANs

- UI fields: VLAN ID = 300, VLAN Trunks = 100, 200, Trunk Only = on

Case 2 :Without Trunk VLANs

- UI fields: VLAN ID = 100, VLAN Trunks = (empty), Trunk Only = on
- Traffic flow:
  - Egress: The VM sends tagged frames via VLAN sub-interfaces, and OVS forwards them with tags intact.
  - Ingress: OVS receives tagged frames and sends them unchanged to the VM.
  - Untagged traffic: The system drops untagged frames because no native VLAN exists.

## OVS Port Configuration Summary

The system applies VLAN tagging behavior based on the selected mode:

- Access: Applies a single VLAN tag (or no tagging in transparent mode).
- Hybrid: Combines untagged native VLAN traffic with tagged trunk VLANs.
- Trunk-only: Tags all VLAN traffic with no native VLAN.

## Known Behavior : Guest OS ARP Flux

The system enforces VLAN isolation at Layer 2, but Linux VMs may still respond across VLANs due to the default ARP behavior.

The Linux kernel responds to ARP requests for any locally assigned IP address across interfaces unless configured otherwise. This behavior is expected and does not indicate an issue with OVS or the physical network.

Required fix (on VM): Configure ARP settings using sysctl to enforce strict per-VLAN isolation:

```
```
sysctl -w net.ipv4.conf.all.arp_ignore=1  
sysctl -w net.ipv4.conf.all.arp_announce=2
```
```
