// Module included in the following assemblies:
//
// * virt/vm_networking/virt-connecting-vm-to-linux-bridge.adoc

:_mod-docs-content-type: PROCEDURE
[id="virt-creating-linux-bridge-nad-cli_{context}"]
= Creating a Linux bridge NAD by using the CLI

[role="_abstract"]
You can create a network attachment definition (NAD) to provide layer-2 networking to pods and virtual machines (VMs) by using the command line.

The NAD and the VM must be in the same namespace.

[WARNING]
====
Configuring IP address management (IPAM) in a network attachment definition for VMs is not supported.
====

.Prerequisites

* You have installed the {oc-first}.

.Procedure

. Add the VM to the `NetworkAttachmentDefinition` configuration, as in the following example:
+
[source,yaml]
----
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: bridge-network
  annotations:
    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/br1
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "bridge-network",
      "type": "bridge",
      "bridge": "br1",
      "macspoofchk": false,
      "vlan": 100,
      "disableContainerInterface": true,
      "preserveDefaultVlan": false
    }
----
+
[NOTE]
====
OSA interfaces on {ibm-z-name} do not support VLAN filtering and VLAN-tagged traffic is dropped. Avoid using VLAN-tagged NADs with OSA interfaces.
====
+
** `metadata.name` defines the name for the `NetworkAttachmentDefinition` object.
** `metadata.annotations.k8s.v1.cni.cncf.io/resourceName` is optional and defines the annotation key-value pair for node selection for the bridge configured on some nodes. If you add this annotation to your network attachment definition, your virtual machine instances will only run on the nodes that have the defined bridge connected.
** `spec.config.name` defines the name for the configuration. It is recommended to match the configuration name to the `name` value of the network attachment definition.
** `spec.config.type` defines the actual name of the Container Network Interface (CNI) plugin that provides the network for this network attachment definition. Do not change this field unless you want to use a different CNI.
** `spec.config.bridge` defines the name of the Linux bridge configured on the node. The name should match the interface bridge name defined in the `NodeNetworkConfigurationPolicy` manifest.
** `spec.config.macspoofchk` is optional and defines a flag to enable the MAC spoof check. When set to `true`, you cannot change the MAC address of the pod or guest interface. This attribute allows only a single MAC address to exit the pod, which provides security against a MAC spoofing attack.
** `spec.config.vlan` is optional and defines the VLAN tag. No additional VLAN configuration is required on the node network configuration policy.
** `spec.config.disableContainerInterface` is optional. When set to `true`, the Bridge CNI plug-in skips creating a standard container virtual ethernet (`veth`) interface inside the pod's network namespace. This enables the virtualization networking backend to attach the layer-2 interface directly to the guest VM instead of a standard container.
** `spec.config.preserveDefaultVlan` is optional and defines whether the VM connects to the bridge through the default VLAN. The default value is `true`.

. Optional: If you want to connect a VM to the native network, configure the Linux bridge `NetworkAttachmentDefinition` manifest without specifying any VLAN:
+
[source,yaml]
----
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: bridge-network
  annotations:
    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/br1
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "bridge-network",
      "type": "bridge",
      "bridge": "br1",
      "macspoofchk": false,
      "disableContainerInterface": true
    }
----

. Create the network attachment definition:
+
[source,terminal]
----
$ oc create -f network-attachment-definition.yaml
----
+
where:
+
`network-attachment-definition.yaml`:: Specifies the file name of the network attachment definition manifest.

.Verification

* Verify that the network attachment definition was created by running the following command:
+
[source,terminal]
----
$ oc get network-attachment-definition bridge-network
----
