Sunday, June 28, 2015

Windows VLAN Stripping - Intel(R) PRO/1000 PT Quad Port NIC w GNS3



It's been widely know that Windows OS's by default, will strip VLAN tags as they enter the stack. It's driver dependent really....and some nic driver are designed to cope with it, and some not. Luckily, my Intel(R) PRO/1000 PT Quad Port LP Server Adapter (aka "HP NC364T PCI EXPRESS QUAD-PORT GIGABIT SERVER ADAPTER") is able to deal with this annoyance with a couple of simple settings.

First, you want to set you Priority and VLAN settings to enabled for both..


























Second is a registry key and setting. In the case of the Intel Quad, there'll be 4 of these...one for each physical interface:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006]

"MonitorModeEnabled"=dword:00000001


You want to create the DWORD value "MonitorModeEnabled" under the above key and set it to 1. Note that the numbered end of the key name "00nn" will be different on your system- one of mine is 0006.

That's it.... give your machine a reboot and you'll be passing VLAN tags through your Windows systems to your virtual machines or for example, GNS3 labs. This is huge to able able to attach your virtual GNS3 routers to say, your real physical switch stack and trunk VLAN tags as normal for labbing etc.....


As an example, I labbed a little MPLS network recently, and took a capture to make sure my physical laptop, plugged in to a real switch port in VLAN 40, was not having the tags stripped after the above changes.



I sent a ping from the laptop, through the switch port, out the trunk connected to my Quad 2 nic, into my GNS3 network....to the CE-5 loopback at 5.5.5.5...... proof that VLAN tags are now in tact!

Here's a capture of the ping below. And incidentally, you'll want to set your destination Cisco SPAN port with dot1q encapsulation, like this....or it will get stripped there as well. Hope this helps somebody....

monitor session 1 source interface Fa0/48

monitor session 1 destination interface Fa0/47 encapsulation dot1q









No comments:

Post a Comment