My setup has 6 physical network interfaces on each node.
Two of these interfaces are configured using Linux bonding, then connected to a VLAN-aware bridge interface on which the VMs are connected and another, non-VLAN aware bridge through which the hosts have network access. This is the "front"...