IPAM & DHCP Features - Tmanok

[Tmanok]

Me again,

As noted in another post on the Networking and Firewall forum, I am in the process of setting up EVPN and VXLAN. Recently, while preparing my documentation and the hypervisor nodes, I noticed that IPAM and DHCP may still have some feature limitations. Could someone more familiar with PVE's IPAM and DHCP implementations for SDN answer or confirm some questions here?

• Automatic DHCP appears to be Simple-zone only: Does this mean that enabling DHCP in the VNet settings still requires every overlay guest to be statically configured by hand, including MTU 1450?
• It looks like if I add a NIC to a VM or CT on a DHCP-enabled subnet, IPAM allocates the address at that moment, not at "lease time" with dnsmasq like I would have expected.
• I noticed that when a guest starts, PVE writes a MAC-to-IP mapping into the zone's ethers file. Is this the IPAM replacement of DHCP leasing? It's very clever if it is.
• As a result of the above two situations if I remove the NIC or destroy the guest, are both the IPAM entry and the DHCP mapping are deleted? I have yet to test this but it came to mind to ask.

Thanks!


Tmanok

 

[ggoller]

1) Yes, dhcp only works with simple zones; evpn/vxlan guests need static ips or external dhcp, and you must handle the guest mtu yourself.
2) Yes, PVE allocates and reserves the ip when the nic is added, not when the guest requests a dhcp lease.
3) Yes, the ethers file maps the ipam-reserved ip to the guest’s mac -- dnsmasq still keeps normal lease state.
4) The ipam entry is deleted when the nic or guest is removed, but the ethers entry may remain until the file is updated again.

 

[Tmanok]

Thanks, ggoller!!

One last question:

1) Yes, dhcp only works with simple zones; evpn/vxlan guests need static ips or external dhcp, and you must handle the guest mtu yourself.

Does that mean dnsmasq will or won't help me with evpn+vxlan guests? When you say external dhcp are you meaning more like KeaDHCP?

Follow-up question:
If the answer is dnsmasq won't help; Is it in the roadmap (long term is fine) to add the capability for it to work?
Thank you!


Tmanok

 

[ggoller]

By “external,” I meant not managed by PVE. You can still run dnsmasq yourself, and it should work fine. Expanding dhcp support beyond simple zones is on the roadmap and we're working on it.