Multiple Network Interfaces or Single Trunk Interface?

[thomas-hn]

Hello,

if a PVE VM shall be connected to multiple subnets, is it preferred to add multiple network interfaces to the VM and letting PVE handle the VLAN filtering or would it be better to simply give a single network interface to the VM and forwarding a whole trunk to the VM?

For me, the variant with multiple network interfaces looks a bit cleaner and makes the configuration in the VM - maybe - a bit simpler. However, when migrating a VM it could be easier to simply have a trunk that has to be connected to the VM.

Is there any best practice (assumed that the system running in the VM can handle both)?
What do you think about this? How do you handle this in your setups?

Thanks a lot in advance,

Thomas

 

[gurubert]

It depends on how much you can trust the VM. If it gets the trunk with all the VLANs the VM can always configure an additional interface in a VLAN it does not belong in. Separate vNICs does not have this issue.