[SOLVED] Proxmox behind a switch can't reach other devices

[Urbaman]

Hi,

I am trying to configure Proxmox to properly connect through a managed switch.

The switch only has access ports (vlan10, vlan100)

From my PC linked to a vlan100 port I can ping other devices (the switch, the server idracs, the pbs machine, ...)

If I try to set up proxmox network with vlans, it can only talk to himself and to its VMs

This is my actual config:

auto lo
iface lo inet loopback

iface eno1 inet manual

iface eno2 inet manual

auto vmbr0
iface vmbr0 inet static
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 10
    
auto vmbr1
iface vmbr1 inet static
    bridge-ports eno2
    bridge-stp off
    bridge-fd 0
    bridge-vlan-aware yes
    bridge-vids 100
    
auto vlan10
iface vlan10 inet static
    address 10.0.10.11/24
    vlan-raw-device vmbr0
    
auto vlan100
iface vlan100 inet static
    address 10.0.100.11/24
    gateway 10.0.100.1
    vlan-raw-device vmbr1

What's wrong with it?

 

[cave]

The switch only has access ports (vlan10, vlan100)

So on your switch, only access ports, that means untagged ports are configured and connected to eno1 and eno2.

On your proxmox host you setup VLAN, so your vmbr0 and vmbr1 only accept tagged VLAN.
Your Switch is only sending untagged (no VLAN information)

your bridges are now dropping all untagged packets, because they only accept tagged packets.

like in your setup, if your managed switch is already untagging two ports, you do not need VLAN on your Proxmox host.

drawing is the language of the engineer.
consider drawing your network with https://asciiflow.com/
it usually causes self-awareness about what you want to do.

 

[Urbaman]

Ok,

So wanting to segment the different vlans (also have pfSense routing/firewalling, say also attached to the switch thtough access ports.

Having those vlans on pfSense, I'd like to keep segmentation (you know, to keep sync/storage networks private).
Should I enable tagging on the switch (trunking just one vlan+native untugged) or should I just keep everything untugged and the segmentation would work?

Thanks.

 

[cave]

consider drawing your network with https://asciiflow.com/

 

[Urbaman]

At the moment, it's working without tagging.

I'll share my network design as soon as I can get it done.

Thank you.

Citing the other thread with intervlan ssh sessions closed (still not working): https://forum.proxmox.com/threads/intervlan-ssh-connection-gets-closed.121501/

 

[Urbaman]

See here for tagging to access ports: https://forum.proxmox.com/threads/vlan-tagging-not-working.121707/