Sanity check - X710 bridge vs pass-through

lebowski89

New Member
Jun 4, 2024
13
2
3
Hello,

Have upgraded my UnRaid server recently (5900XT/X570-P/Adaptec 71605/Intel X710-DA4 FH/64GB Unbuffered ECC), and have now made the move to Proxmox. Have set up a few VM (UnRaid, Debian, OPNsense). So far I've just used the motherboard port for most things while I've been setting up and making sure UnRaid was good (passed through HBA). I am now working on my network with the 4-port X710 (previously used a Mellanox Connect-X3). So far I've created a virtual bridge for one of the ports to use as my WAN port, which has worked great and my internet is now running through OPNsense (temporary though, as I've ordered a 2.5GB ETH PCIx1 NIC to take the WAN port and free up the SFP+ for LAN). I'm now deciding how I want to set up LAN for Proxmox and the VMs. I've checked the IOMMU groupings and thankfully each x710 port is in its own group if im reading correctly:

Screenshot_137.png

What I'm thinking is that I pass-through a port to UnRaid and a port to Debian (which has all my docker swarm stacks and services) and then leave one for Proxmox (this one can be a bridge or whatever). These ports will be connected to a Mikrotik CRS305-1G-4S+IN (with the fourth port on the switch connected to a Mikrotik CRS326-24G-2S+). Does this sound rational? I know the topic of bridge vs pass-through is often discussed and there are a variety of opinions. I would assume that having the switches (and DAC cables) already laying around, and with a planned workflow of frequent heavy file transfers between the UnRaid and Debian VM, pass-through should net better performance with a 10GB NIC, right?

I've never really passed individual NIC ports, I typically pass entire devices through (such as HBA). Are there any potential issues to be aware of with individual port pass-through?

Thanks
 
Yes there are, especially if you use either VLAN on any VF passed to an LXC/VM or a mix of bridged interface pointing to VF.
For bridging a VF (or a PF actually) and enabled all VM to see traffic coming/going from the bridge you have to register each veth generated MAC via FDB to the related PF/VF, see https://github.com/jdlayman/pve-hookscript-sriov.

For those interested, there are other quirks using X710 on proxmox :
- VLAN stripping on SR-IOV VFs
- LLDP offload not reporting to linux kernel
- Asymmetric speed due to TX checksum offload

See https://github.com/nvandamme/systemd-networkd-i40e for a more friendly approach with a systemd service (and maybe add your quirks too!).