LLDP between VM and Switches

M

MaKo1978

New Member
May 7, 2025
4
0
1
Hi Experts,

I'm new to Proxmox and I just migrated my ESXi Hypervisor to PVE after all the Broadcom confusions ...
Bottom Line: I should have done that much earlier!

At least I have only one issue that I wasn't yet able to solve with this forum or other sources I found: LLDP between VM and Switches.

First my setup:
LAN <-> eno1 <-> vmbr0 <-> vmbr0.XX <-> vmbrXX <-> VM

To clarify this:
The hardware NIC eno1 is connected to the LAN.
vmbr0 is the bridge between eno1 and multiple VLAN interfaces vmbr0.XX
vmbrXX is a bridge between the VLAN interface and the VM

I build this set up to easily choose a vmbrXX interface in VM creation without keeping in mind to select a correct VLAN tag during VM creation.
I also tested it with a VM directly connected to vmbr0 without success.

I have read discussions and articles like https://forum.proxmox.com/threads/lldp-frames-between-vms-using-linux-bridge.95029/

I see the LLDP packets in a tcpdump on eno1 -> good
after doing echo '0x4000' > /sys/class/net/vmbr0/bridge/group_fwd_mask I also see them in a tcpdump on vmbr0.
But I never see them on vmbr0.27 or vmbr27 or on the VM itself.
Even if the VM is directly connected with a VLAN Tag "XX" to vmbr0, I can't see the lldp packets.
I'm pretty sure in ESXi with a vSwitch I was able to see these packets in a VM.
Since LLDP is a L2 protocol, it should be sent also to the VLAN interfaces but for some reason they are not.
I also tried to set echo "0x4000" > /sys/class/net/vmbr0.XX/brport/group_fwd_mask and echo "0x4000" > /sys/class/net/tapXXXiX/brport/group_fwd_mask but also no success.

I installed the lldpd on the PVE host and I was able to see the local lldp packets from the PVE host sent to the VMs but unfortunately I want the hypervisor to be "invisible" to the network.

Any idea if this is possible with PVE and a Linux bridge?

Thanks a lot,
Marco
 
I did some more tests ...

Today I bridged one interface of a VM into "vmbr0" without configuring a VLAN ID in PVE.
As soon as I executed echo '0x4000' > /sys/class/net/vmbr0/bridge/group_fwd_mask, I can see the LLDP frames on the tapXXXiY interface.
If I now add a VLAN ID in PVE, I can't see them any more on the tap interface but still on vmbr0.

For me this looks good regarding the VLAN behavior as only traffic for the specific VLAN is sent to this (tagged) port.

But is there a way to also forward L2 traffic to such tagged interfaces?
Running an echo "0x4000" > /sys/class/net/tapXXXi1/brport/group_fwd_mask does not help.

From my perspective, L2 traffic should arrive on a tagged port as well as on untagged ports as they are/may be relevant for all L3 devices on that physical port.

Question would be: What about OVS Bridges? Do they behave similar or different?
I'm pretty sure that in ESXi the vSwitches behave more like a switch than like a bridge.
 
Last edited:
Did some more tests:
1748606574314.png

If I now execute echo "0x4000" > /sys/class/net/vmbr0/bridge/group_fwd_mask I can see LLDP frames on eno1 and vmbr0 as written above, but not on the tap interface.

Looking at the bridge configuration shows that only VLAN28 is attached (which is correct):
root@pve:~# bridge vlan show dev tap100i1
port vlan-id
tap100i1 28 PVID Egress Untagged

If I now manually add VLAN1 (the "PVID Egress Untagged" vlan of eno1 and vmbr0) to this interface:
root@pve:~# bridge vlan add dev tap100i1 vid 1
root@pve:~# bridge vlan show dev tap100i1
port vlan-id
tap100i1 1
28 PVID Egress Untagged

I am seeing LLDP frames on "tap100i1".
Since I do not use the VLAN "1" for anything on my network this sounds like a working solution for me.
Do you see any downsides on this set up? And what would be the best way to implement this in a reboot save way?
The tap interfaces are not configured in /etc/network/interfaces so I can't use any post-up commands.
 
The only difference I see now (and I'm not sure if this will cause any issues) is that LLDP frames from VMs are tagged with the vlan id:

Hardware Switch:
15:15:04.798252 xx:xx:xx:xx:xx:xx > 01:80:c2:00:00:0e, ethertype LLDP (0x88cc), length 88: LLDP, length 74

PVE VM:
15:15:06.088090 bc:24:11:xx:xx:xx > 01:80:c2:00:00:0e, ethertype 802.1Q (0x8100), length 168: vlan 28, p 0, ethertype LLDP (0x88cc), LLDP, length 150
 
You must log in or register to reply here.
Top Bottom