Hello! First forum post but have extensive network background. I'll try to keep this as abridged as possible.
My setup
My network (ATT fiber) requires EAP certificate-based authentication before any traffic will pass from the ONT to my firewall appliance. This works using Untangle firewall bot on bare metal and in my existing virtual infrastructure (ESXI 7.0) by using ATT certificates and WPA-supplicant with the identity certificate. I have two software firewalls that are duplicate images; one running on an ESXi hypervisor and a second running on a second duplicate hypervisor. Only one is powered on at any given time to avoid strange conflicts. This is done to provide a semi-on-demand redundancy. To accomplish this, the RJ45 from the ONT connects to a Netgear four-port dumb switch on port 1. Port 2 goes to Proxmox hypervisor running on a Protectli Vault. Port 3 goes to a port on a Dell R630 running ESXi. Both of said destination ports are PCI pass-thru configured to the appropriate VM. One additional point of interest: ATT's ONT traffic is tagged as being on VLAN0. Unsure if this is relevant.
Scenarios
1) The VM running on ESXi functions exactly as expected. The Untangle instance handles the certificate-based auth, and the firewall software then sends a DHCP renew request to the ONT pass-thru interface (eth1 in this case) and ATT issues in IP lease, and I'm off to the races.
2) The VM running on Proxmox on the second hypervisor issues the certificate-based auth and receives an 'auth successful' packet back from the interface, but when the software issues the DHCP renew request, it times out while waiting for a reply with the DHCP info.
3) This is my test scenario: I connect the RJ45 from the ONT device directly (eliminate the dumb switch) to the pass-thru configured nic port on the Proxmox hypervisor. Upon booting the Proxmox VM then, it functions exactly the same as the VM running on hypervisor one (ESXi)
I've tried multiple VM installs and machine types, and I created a VMBR1 bridge, added the Protectli port to it, and then added VMBR1 to the VM and met with exactly the same pair of results; with a switch, no DHCP reply. and without it works as described above.
My motivator here is to get away from commercial software after VMWare discussed its new customer model.
If anyone can assist, I would be forever grateful. I'm to the point where I am out of options short of trying paid support ticket.
If I committed something, my apologies. Diagram provided.
Thanks,
My setup
My network (ATT fiber) requires EAP certificate-based authentication before any traffic will pass from the ONT to my firewall appliance. This works using Untangle firewall bot on bare metal and in my existing virtual infrastructure (ESXI 7.0) by using ATT certificates and WPA-supplicant with the identity certificate. I have two software firewalls that are duplicate images; one running on an ESXi hypervisor and a second running on a second duplicate hypervisor. Only one is powered on at any given time to avoid strange conflicts. This is done to provide a semi-on-demand redundancy. To accomplish this, the RJ45 from the ONT connects to a Netgear four-port dumb switch on port 1. Port 2 goes to Proxmox hypervisor running on a Protectli Vault. Port 3 goes to a port on a Dell R630 running ESXi. Both of said destination ports are PCI pass-thru configured to the appropriate VM. One additional point of interest: ATT's ONT traffic is tagged as being on VLAN0. Unsure if this is relevant.
Scenarios
1) The VM running on ESXi functions exactly as expected. The Untangle instance handles the certificate-based auth, and the firewall software then sends a DHCP renew request to the ONT pass-thru interface (eth1 in this case) and ATT issues in IP lease, and I'm off to the races.
2) The VM running on Proxmox on the second hypervisor issues the certificate-based auth and receives an 'auth successful' packet back from the interface, but when the software issues the DHCP renew request, it times out while waiting for a reply with the DHCP info.
3) This is my test scenario: I connect the RJ45 from the ONT device directly (eliminate the dumb switch) to the pass-thru configured nic port on the Proxmox hypervisor. Upon booting the Proxmox VM then, it functions exactly the same as the VM running on hypervisor one (ESXi)
I've tried multiple VM installs and machine types, and I created a VMBR1 bridge, added the Protectli port to it, and then added VMBR1 to the VM and met with exactly the same pair of results; with a switch, no DHCP reply. and without it works as described above.
My motivator here is to get away from commercial software after VMWare discussed its new customer model.
If anyone can assist, I would be forever grateful. I'm to the point where I am out of options short of trying paid support ticket.
If I committed something, my apologies. Diagram provided.
Thanks,
Last edited: