> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# L2 Switching with Access VLANs

> Use case showing how to configure a Switch virtual network with access VLANs to isolate application traffic by VLAN, with a VyOS router instance providing DHCP and inter-VLAN routing.

## Introduction

EVE-OS (Edge Virtualization Engine) implements a Switch virtual network as a fully transparent Layer 2 bridge. By default, all application instance ports attached to a Switch virtual network are trunk ports that carry 802.1Q-tagged and untagged traffic. The **Access VLAN ID** field in the application instance deployment wizard lets you configure an access port: the application sees only traffic for the assigned VLAN, and EVE-OS handles tagging and stripping transparently. Access VLAN ID values must be between 2 and 4093.

This use case demonstrates how to use access VLANs on a Switch virtual network to isolate groups of application instances by VLAN, while a VyOS router instance on a trunk port provides DHCP, NAT, and inter-VLAN routing.

For background on Switch virtual networks, see [Virtual Networks Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks.md).

### Prerequisites

* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* A node onboarded to Edge Infrastructure Services.
* Application images for the VyOS router, Ubuntu containers, and Ubuntu virtual machines available in your enterprise.

## Example Scenario

The node runs a single Switch virtual network with the following application instances attached:

* **VyOS router**: connects as a trunk port, receiving all tagged and untagged traffic. It provides DHCP for all VLANs, performs NAT, and routes traffic between VLANs.
* **Container 1 and Container 2**: connect with access VLAN 100. They receive IP addresses in the 20.1.1.0/24 range from the VyOS DHCP server.
* **Ubuntu VM**: connects with access VLAN 200. It receives an IP address in the 30.1.1.0/24 range from the VyOS DHCP server.
* **Ubuntu VM (no VLAN)**: connects as a trunk port with no access VLAN configured. It receives an IP address in the 40.1.1.0/24 range from the VyOS trunk interface.

![Diagram showing a Switch virtual network with a VyOS router on a trunk port, Container 1 and Container 2 on VLAN 100, an Ubuntu VM on VLAN 200, and an Ubuntu VM with no VLAN configured.](https://mintcdn.com/zededa/nH470gZ2VKSQBZu8/new-ui/infrastructure-services/virtual-networks/images/l2-switching-with-access-vlans.png?fit=max\&auto=format\&n=nH470gZ2VKSQBZu8\&q=85\&s=807f3954df338dee08480d31535635ed)

## Create the Switch Virtual Network

1. In the sidebar, click **Infrastructure > Workloads > Virtual Networks**.
2. Select the contextual **+** create action to open the creation wizard.
3. Select **Switch** as the virtual network type.
4. Configure the **Identity** section with a name and title.
5. In the **Details** section, set the **Target Type** to **Node** and select the node.
6. In the **Node Port** field, select the physical port to use as the external uplink for the Switch virtual network. Leave this blank if no external uplink is required.
7. Click **Create**.

## Deploy the Application Instances

When deploying each application instance, configure the network adapter in the **Adapters and Networks** section of the deployment wizard. For access VLAN instances, expand the adapter options after selecting the Switch virtual network to reveal the **Access VLAN ID** field.

### VyOS router (trunk)

1. Deploy the VyOS application instance using [Deploy an Application Instance](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/deploy-an-application-instance.md).
2. In the **Adapters and Networks** section, select the Switch virtual network for the network adapter.
3. Do not configure an access VLAN. The adapter connects as a trunk port and receives all tagged and untagged traffic.
4. Complete the deployment.

After the instance starts, configure the VyOS router internally to create `eth1.100` and `eth1.200` subinterfaces for VLAN 100 and VLAN 200, enable a DHCP server on each subinterface, and configure routing between VLANs.

### Container 1 and Container 2 (VLAN 100)

For each container:

1. Deploy the Ubuntu container using [Deploy an Application Instance](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/deploy-an-application-instance.md).
2. In the **Adapters and Networks** section, select the Switch virtual network for the network adapter.
3. Expand the adapter options and enter `100` in the **Access VLAN ID** field.
4. Complete the deployment.

Container 1 receives IP address 20.1.1.2 and Container 2 receives IP address 20.1.1.3 from the VyOS DHCP server on the eth1.100 subinterface. The two containers can communicate with each other within VLAN 100.

### Ubuntu VM (VLAN 200)

1. Deploy the Ubuntu VM using [Deploy an Application Instance](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/deploy-an-application-instance.md).
2. In the **Adapters and Networks** section, select the Switch virtual network for the network adapter.
3. Expand the adapter options and enter `200` in the **Access VLAN ID** field.
4. Complete the deployment.

The VM receives an IP address in the 30.1.1.0/24 range from the VyOS DHCP server on the eth1.200 subinterface.

### Ubuntu VM (no VLAN)

1. Deploy the Ubuntu VM using [Deploy an Application Instance](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/deploy-an-application-instance.md).
2. In the **Adapters and Networks** section, select the Switch virtual network for the network adapter.
3. Do not configure an access VLAN. The adapter connects as a trunk port.
4. Complete the deployment.

The VM receives an IP address in the 40.1.1.0/24 range from the VyOS trunk interface DHCP configuration.

## Result

After completing this configuration:

* Container 1 and Container 2 are isolated on VLAN 100 and can communicate with each other within that VLAN.
* The Ubuntu VM is isolated on VLAN 200 and cannot communicate directly with the VLAN 100 containers without routing through the VyOS instance.
* The Ubuntu VM without an access VLAN configured connects as a trunk port and receives all tagged and untagged traffic.
* The VyOS router routes traffic between all VLANs and provides internet access through NAT.

## Next Steps

> [card] [Virtual Networks Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks.md)
>
> Reference documentation on Switch virtual network behavior and VLAN support.

> [card] [L2 Switching and Management VLAN on a Single Interface](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/l2-switching-and-management-vlan.md)
>
> A use case that combines a Switch virtual network and a management VLAN sub-interface on a single physical port (EVE-OS 14.5.2-LTS and later).

> [card] [VLAN Port Segmentation](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/vlan-port-segmentation.md)
>
> A use case that segments traffic using VLAN sub-interfaces on Local virtual networks.

> [card] [Manage a Virtual Network](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/manage-a-virtual-network.md)
>
> Update or delete the virtual network after creation.