SDN Help - Multiple Nodes with Private VLAN in Datacenter.

[cmunroe]

Hello!

I am looking to setup 5 Proxmox nodes in a datacenter. The datacenter is going to provide me with two VLANs. A private VLAN and a public, internet, VLAN.

What I am looking to do is segment my VMs over different SDNs using the private VLAN as backing. Example networking config below.

Per Node:

iface vmbr0.200
    <snip>
    # Internet

iface vmbr0.201
    address 192.168.xxx.2x/24
    gateway 192.168.xxx.1
    # Private

I would then use PfSense/OpnSense as the firewall for each SDN.

I am thinking of the following SDNs

1. Secure
2. Insecure
3. Kubernetes

So to my question, which SDN should I pick? Since it is a DC would it be VLAN, VXLAN, QinQ? Which is the least painful on CPU usage?

 

[mgabriel]

It depends on what your DC supports. I guess the only possibly usable solution for your scenario will probably be QinQ.

If you want to use your private VLAN as the outer/service VLAN. Then you'll be able to use any VLAN you want inside the outer service VLAN [1].

Please keep in mind that the physical switches of the DC need to support this and your outer service vlan needs a 4 bytes extra header and you need to reduce your MTU by 4 bytes if only 1500 is supported.

[1] https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pvesdn_config_zone - Topic 12.6.4. QinQ Zones

 

[cmunroe]

It depends on what your DC supports. I guess the only possibly usable solution for your scenario will probably be QinQ.

If you want to use your private VLAN as the outer/service VLAN. Then you'll be able to use any VLAN you want inside the outer service VLAN [1].

Please keep in mind that the physical switches of the DC need to support this and your outer service vlan needs a 4 bytes extra header and you need to reduce your MTU by 4 bytes if only 1500 is supported.

[1] https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pvesdn_config_zone - Topic 12.6.4. QinQ Zones

Thank you for the reply!

I was doing my own research, and what do you think about VXLAN? Looking at this users blog post, it seems feasible: https://mattglass-it.com/software-defined-network-proxmox/

 

[mgabriel]

You need to reduce the MTU further to 1450 or less, but you can give it a try. Keep in mind that vxlan is not officially supported yet as it is in tech preview state.

 

[cmunroe]

You need to reduce the MTU further to 1450 or less, but you can give it a try. Keep in mind that vxlan is not officially supported yet as it is in tech preview state.

I wasn't aware that was still in preview? Where do you see that?

 

[mgabriel]

I was referring to https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pvesdn_support_status (See 12.2.2) but I agree, it seems to be supported.