> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# L2 Switching and Management VLAN on a Single Interface

> Use case showing how to configure a Switch virtual network with access VLANs and a management VLAN sub-interface on a single physical port, available in EVE-OS 14.5.2-LTS and later.

## Introduction

This use case demonstrates how to combine a Switch virtual network with access VLANs and an EVE-OS management VLAN sub-interface on a single physical Ethernet port. This configuration is available in EVE-OS (Edge Virtualization Engine) 14.5.2-LTS and later.

Prior to EVE-OS 14.5.2-LTS, VLAN sub-interfaces and access VLANs required separate physical ports. VLAN sub-interfaces were only supported with Local virtual networks (Scenario 1), and access VLANs were only supported with Switch virtual networks (Scenario 2).

**Scenario 1: VLAN sub-interface with Local virtual networks**

![Scenario 1: eth0 with a VLAN sub-interface for EVE-OS management and Local virtual networks for application traffic.](https://mintcdn.com/zededa/nH470gZ2VKSQBZu8/new-ui/infrastructure-services/virtual-networks/images/l2_switching_scenario_1.png?fit=max\&auto=format\&n=nH470gZ2VKSQBZu8\&q=85\&s=e554567b14a871e8c361c6444e63166b)

**Scenario 2: Access VLAN with Switch virtual network**

![Scenario 2: eth1 with a Switch virtual network using access VLANs for application traffic.](https://mintcdn.com/zededa/nH470gZ2VKSQBZu8/new-ui/infrastructure-services/virtual-networks/images/l2_switching_scenario_2.png?fit=max\&auto=format\&n=nH470gZ2VKSQBZu8\&q=85\&s=ec44b3e0df11bceacab4b1b69a3ae1cc)

Starting with EVE-OS 14.5.2-LTS, you can use both on the same physical port, which is useful when the node has only one physical interface or when you want to consolidate traffic onto fewer ports.

For background on VLAN types and virtual network types, see [Virtual Networks Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks.md).

### Prerequisites

* EVE-OS 14.5.2-LTS or later on the target node.
* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* A node with at least one physical Ethernet port onboarded to Edge Infrastructure Services.
* A Switch virtual network created on the node. See [Create a Virtual Network](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/create-a-virtual-network.md).
* An upstream switch configured with a trunk port to carry management, application, and untagged traffic.
* Two edge applications ready to deploy.

## Example Scenario

The node has a single physical Ethernet port: eth0. The upstream switch is configured with one trunk port. The traffic is segmented as follows:

* **VLAN 10 (management)**: a VLAN sub-interface on eth0 carries EVE-OS management traffic.
* **VLAN 100 (Application 4 access)**: an access VLAN on the Switch virtual network isolates Application 4.
* **Trunk traffic**: Application 3 connects to the Switch virtual network as a trunk port and receives broadcast, unknown unicast, and multicast traffic from all VLANs.

**Scenario 3: VLAN sub-interface and Switch virtual network on a single port (EVE-OS 14.5.2-LTS and later)**

![Scenario 3: eth0 with VLAN 10 for EVE-OS management, a Switch virtual network with Application 3 on a trunk port and Application 4 on VLAN 100 access, all carried over a single trunk port to the upstream switch.](https://mintcdn.com/zededa/nH470gZ2VKSQBZu8/new-ui/infrastructure-services/virtual-networks/images/l2_switching_scenario_3.png?fit=max\&auto=format\&n=nH470gZ2VKSQBZu8\&q=85\&s=4996add7a4919999c2a28a27ba984cc9)

**Note:** Access VLAN is the preferred configuration method for application traffic isolation. Using a VLAN sub-interface on a Switch virtual network is also supported but has lower performance than an access VLAN.

## Step 1: Configure the Node Adapter

Configure eth0 with a management VLAN sub-interface. The access VLAN for Application 4 is configured at deployment time, not at the adapter level.

1. Open **Infrastructure > Fleet > Nodes**.
2. Select the node and click the **Configure node** (gear) icon.
3. In the configuration sidebar, open **Adapters > NICs**.
4. For eth0, set **Interface Usage** to **App Shared** (this allows both VLAN-tagged and untagged traffic on the port), expand the adapter options, and click **VLAN Details**.
5. Add a VLAN sub-interface for management: set **Logical Label** to `eth0.10`, **VLAN ID** to `10`, and **Interface Usage** to **Management**.
6. Click **Save Changes**.

The access VLAN 100 for Application 4 is set during application deployment, not in the adapter configuration.

**Note:** Do not attach the Switch virtual network to a VLAN sub-interface and simultaneously configure an access VLAN on the same Switch virtual network. EVE-OS returns an error and does not create the virtual network if both are configured at the same time.

## Step 2: Deploy Application Instances

### Deploy Application 3 (trunk)

Deploy Application 3 without an access VLAN. It attaches to the Switch virtual network as a trunk port.

1. Deploy Application 3 using [Deploy an Application Instance](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/deploy-an-application-instance.md).
2. In the **Adapters and Networks** section, select the Switch virtual network on eth0.
3. Do not configure an access VLAN.
4. Complete the deployment.

Application 3 receives trunk traffic on eth0, including broadcast, unknown unicast, and multicast traffic from all VLANs flowing through the Switch virtual network.

### Deploy Application 4 (VLAN 100 access)

Deploy Application 4 with access VLAN 100. The access VLAN isolates this application from traffic on other VLANs.

1. Deploy Application 4 using [Deploy an Application Instance](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/deploy-an-application-instance.md).
2. In the **Adapters and Networks** section, select the Switch virtual network on eth0.
3. Expand the adapter options.
4. In the **Access VLAN ID** field, enter `100`.
5. Complete the deployment.

Application 4 receives only VLAN 100 traffic and is isolated from applications on other VLANs.

## Result

After completing this configuration, a single physical port (eth0) simultaneously handles:

* EVE-OS management traffic on VLAN 10, isolated from application traffic.
* Application 4 traffic on VLAN 100, isolated from other applications.
* Application 3 traffic as a trunk port, receiving all VLANs flowing through the Switch virtual network.

## Next Steps

> [card] [Virtual Networks Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks.md)
>
> Reference documentation on VLANs, VLAN sub-interfaces, and Switch virtual networks.

> [card] [L2 Switching with Access VLANs](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/l2-switching-with-access-vlans.md)
>
> A use case using Switch virtual networks with multiple VLANs across separate ports.

> [card] [VLAN Port Segmentation](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/vlan-port-segmentation.md)
>
> A use case using VLAN sub-interfaces with Local virtual networks.

> [card] [Manage a Virtual Network](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/manage-a-virtual-network.md)
>
> Update configuration after creation.