> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# VLAN Port Segmentation for Local Virtual Networks

> Segment node traffic with VLAN sub-interfaces on physical ports and Local virtual networks to isolate management traffic and separate app workloads.

## Introduction

This use case demonstrates how to segment traffic on a node using VLAN sub-interfaces on physical ports and Local virtual networks. VLAN sub-interfaces let you separate management traffic from application traffic, or isolate different application workloads from each other, on the same physical port.

For background on VLAN support and virtual network types, see [Virtual Networks Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks.md).

### Prerequisites

* EVE-OS (Edge Virtualization Engine) 14.5.0-LTS or later on the target node.
* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* A node with at least three physical Ethernet ports onboarded to Edge Infrastructure Services.
* Three Local virtual networks and one Switch virtual network created on the node. See [Create a Virtual Network](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/create-a-virtual-network.md).
* Four edge applications ready to deploy.
* An upstream switch configured with trunk ports to carry traffic for multiple VLANs.

## Example Scenario

The node has three physical Ethernet ports: eth0, eth2, and eth3. The traffic is segmented as follows:

* **eth0** carries management traffic on VLAN 10 and application traffic for Application 1 on VLAN 20. The port is configured as VLANs Only, so untagged traffic on eth0 is dropped.
* **eth2** carries application traffic for Application 2 on VLAN 30 and untagged traffic for Application 3.
* **eth3** connects to a Switch virtual network. Application 4 uses an access VLAN (VLAN 100) on the Switch virtual network.

![Diagram showing the node with eth0 carrying VLAN 10 management and VLAN 20 for Application 1, eth2 carrying VLAN 30 for Application 2 and untagged traffic for Application 3, and eth3 connecting to a Switch virtual network with Application 4 on VLAN 100.](https://mintcdn.com/zededa/nH470gZ2VKSQBZu8/new-ui/infrastructure-services/virtual-networks/images/virtual-networks:vlan-port-segmentation.gif?s=a4a3b3e797eec07986ebca171b114ad7)

## Step 1: Configure Node Adapter VLANs

Configure the VLAN sub-interfaces on the node adapters.

1. Open **Infrastructure > Fleet > Nodes** and select the target node.
2. Select **Configure node** in the page header to open the configuration overlay.
3. In the configuration overlay, open the **Adapters** section.

### Configure eth0

eth0 is used exclusively for VLAN-tagged traffic. Untagged traffic on this port is dropped.

1. Set **Interface Usage** to **VLANs Only**.
2. Expand the adapter options and click **VLAN Details**.
3. Add the first VLAN sub-interface: set **Logical Label** to `eth0.10`, **VLAN ID** to `10`, and **Interface Usage** to **Management** (this sub-interface carries EVE-OS management traffic).
4. Click **Add Another VLAN** and add the second sub-interface: set **Logical Label** to `eth0.20`, **VLAN ID** to `20`, and **Interface Usage** to **App Shared** (this sub-interface carries Application 1 traffic).
5. Click **Save**.

### Configure eth2

eth2 carries both VLAN-tagged traffic for Application 2 and untagged traffic for Application 3.

1. Set **Interface Usage** to **App Shared** (the port handles both tagged and untagged traffic).
2. Expand the adapter options and click **VLAN Details**.
3. Add a VLAN sub-interface: set **Logical Label** to `eth2.30`, **VLAN ID** to `30`, and **Interface Usage** to **App Shared**.
4. Click **Save Changes**.

### Configure eth3

eth3 connects to the Switch virtual network. The access VLAN for Application 4 is configured during application deployment, not at the adapter level.

1. Set **Interface Usage** to **App Shared**.
2. Click **Save**.

## Step 2: Assign Virtual Network Ports

Assign the correct VLAN sub-interface to each Local virtual network.

1. In the sidebar, click **Infrastructure > Workloads > Virtual Networks**.

**Application 1 virtual network (VLAN 20)**

1. Click the Local virtual network you want to use for Application 1 traffic.
2. Click the **Configure** button (gear icon).
3. In the **Interface** sub-tab, set the **Port** to **eth0.20 (VLAN 20)**.
4. Click **Save Changes**.

**Application 2 virtual network (VLAN 30)**

1. Click the Local virtual network you want to use for Application 2 traffic.
2. Click the **Configure** button.
3. In the **Interface** sub-tab, set the **Port** to **eth2.30 (VLAN 30)**.
4. Click **Save Changes**.

**Application 3 virtual network (untagged)**

1. Click the Local virtual network you want to use for Application 3 traffic.
2. Click the **Configure** button.
3. In the **Interface** sub-tab, set the **Port** to **eth2** (the parent interface, for untagged traffic).
4. Click **Save Changes**.

**Switch virtual network (eth3)**

The Switch virtual network for eth3 uses the port configured at creation. No update is needed here.

## Step 3: Deploy Application 4 with an Access VLAN

The access VLAN for Application 4 is configured on the network adapter during application deployment, not on the Switch virtual network itself.

1. Deploy Application 4 using [Deploy an Application Instance](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/deploy-an-application-instance.md).
2. In the **Adapters and Networks** section, select the Switch virtual network for the adapter on eth3, expand the adapter options, and enter `100` in the **Access VLAN ID** field.
3. Complete the deployment.

## Result

After completing this configuration:

* EVE-OS management traffic runs on the dedicated VLAN 10 sub-interface of eth0, isolated from application traffic.
* Application 1 traffic uses VLAN 20 on eth0, isolated from the management VLAN.
* Application 2 traffic uses VLAN 30 on eth2, isolated from untagged Application 3 traffic that also uses eth2.
* Application 4 connects to the Switch virtual network on eth3 with VLAN 100 access port isolation.

## Next Steps

> [card] [Virtual Networks Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks.md)
>
> Reference documentation on VLANs, adapter configuration, and virtual network types.

> [card] [L2 Switching with Access VLANs](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/l2-switching-with-access-vlans.md)
>
> A related use case using Switch virtual networks with access VLANs.

> [card] [L2 Switching and Management VLAN on a Single Interface](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/l2-switching-and-management-vlan.md)
>
> A use case that combines access VLANs and management VLAN sub-interfaces on a single port (available in EVE-OS 14.5.2-LTS and later).

> [card] [Create a Virtual Network](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/create-a-virtual-network.md)
>
> The full virtual network creation walkthrough.