How to add a VLAN interface with ip link

Adding a VLAN interface with ip link add … type vlan creates a tagged child interface on top of an existing parent device. This is useful for placing one host on a tagged network, testing a new VLAN before making it persistent, or separating traffic on a shared Ethernet link without changing the physical cabling.

The VLAN device shares the parent NIC while carrying its own VLAN ID and interface name, such as lab0.100. Current ip-link(8) behavior supports VLAN devices created with a parent link, a device name, and the VLAN ID, and `ip -d link show` exposes the resulting VLAN protocol and tag details after creation.

The parent interface must already exist, and the VLAN ID must match the upstream switch or network design. The new VLAN device appears immediately, but it usually remains down until both the parent link and the VLAN child are brought up, and the change does not persist across reboot unless the normal network configuration also defines it.

  1. Confirm the parent interface exists before adding the VLAN child.
    $ ip link show dev lab0
    12: lab0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
        link/ether ee:ab:b3:eb:49:9b brd ff:ff:ff:ff:ff:ff
  2. Create the VLAN interface with the chosen VLAN ID.
    $ sudo ip link add link lab0 name lab0.100 type vlan id 100

    No output usually means the VLAN device was created successfully.

  3. Verify the new VLAN interface and its VLAN details.
    $ ip -d link show dev lab0.100
    13: lab0.100@lab0: <BROADCAST,NOARP,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
        link/ether ee:ab:b3:eb:49:9b brd ff:ff:ff:ff:ff:ff
        vlan protocol 802.1Q id 100 <REORDER_HDR>

    The M-DOWN flag indicates the VLAN child exists, but the parent link path is not ready to pass traffic yet.

  4. Bring the parent interface and the VLAN interface up before sending traffic across the tagged link.
    $ sudo ip link set dev lab0 up
    $ sudo ip link set dev lab0.100 up
  5. Add an address to the VLAN interface if the tagged network should be usable immediately.
    $ sudo ip address add 192.0.2.10/24 dev lab0.100
  6. Verify that the VLAN interface is up and carrying the expected address.
    $ ip -brief address show dev lab0.100
    lab0.100@lab0    UP             192.0.2.10/24 fe80::ecab:b3ff:feeb:499b/64