Proxmox assigning incorrect NIC to host

[mysicksi]

Hi all,

I'm attempting to configure dual SPAN ports to my Security Onion VM. However, when I attempt to assign vmbr3 as another interface, vmbr2's MAC shows as duplicate, so I cannot capture the intended traffic. As you can see, eth2 and eth1 share a common MAC address.



Steps taken to validate/troubleshoot

1. If I remove vmbr3, then eth2 is removed as well. If I reboot the VM, the MAC is persistent.
2. If I disconnect vmbr3, eth2 shows disconnected in Security Onion
3. If I run tcpdump on the proxmox interface eno4, I can see my host pinging an internal VM. If I run tcpdump on Security Onions eth2 inteface, I see no traffic. I assume its because its incorrectly being assigned the wrong nic.

Please let me know if any additional info is required.

Interface assignment:

1. vmbr1 assigned to Security Onion management
2. vmbr2 assigned to North-South span traffic out of the gateway
3. vmbr3 assigned to East-West span traffic to my server

Proxmox network inteface assignement


Proxmox eno4/vmbr3 config


Proxmox eno3/vmbr2 config


Security Onion network interface assignment


Security Onion nic assignement

lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group defaul                                                                                                                                                                                               t qlen 1000

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    inet 127.0.0.1/8 scope host lo

       valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP gr                                                                                                                                                                                               oup default qlen 1000

    link/ether 7e:31:c2:3e:9f:0b brd ff:ff:ff:ff:ff:ff

    inet 192.168.10.32/24 brd 192.168.10.255 scope global noprefixroute eth0

       valid_lft forever preferred_lft forever

3: eth1: <BROADCAST,NOARP,PROMISC,SLAVE,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast m                                                                                                                                                                                               aster bond0 state UP group default qlen 1000

    link/ether 3a:6a:d3:94:9f:85 brd ff:ff:ff:ff:ff:ff

4: eth2: <NO-CARRIER,BROADCAST,NOARP,PROMISC,SLAVE,UP> mtu 1500 qdisc pfifo_fast                                                                                                                                                                                                master bond0 state DOWN group default qlen 1000

    link/ether 3a:6a:d3:94:9f:85 brd ff:ff:ff:ff:ff:ff

5: bond0: <BROADCAST,MULTICAST,PROMISC,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueu

ProxMox /etc/network/interfaces config

auto vmbr0
iface vmbr0 inet static
        address 192.168.10.30/24
        gateway 192.168.10.1
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0

auto vmbr1
iface vmbr1 inet manual
        bridge-ports eno2
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 10-50

auto vmbr2
iface vmbr2 inet manual
        bridge-ports eno3
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 10-50
        bridge_ageing 0

auto vmbr3
iface vmbr3 inet manual
        bridge-ports eno4
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 10-50
        bridge_ageing 0

 

[spirit]

eth1 && eth2 are slaves of a bond0 (..master bond0..), so this is normal than they have same mac. (bond0 mac = eth1 mac = eth2 mac).
The bond mac use the first interface (eth1) mac.

 

[mysicksi]

eth1 && eth2 are slaves of a bond0 (..master bond0..), so this is normal than they have same mac. (bond0 mac = eth1 mac = eth2 mac).
The bond mac use the first interface (eth1) mac.

You're right. I see the bond in the network interface config. Thanks again for your help!