SDN VNet with 802.1q tags (Q-in-VNI) Support

[johnwkerns]

I'm experimenting with Proxmox as a replacement for a current virtualization system I run which makes extensive use of VLAN (802.1q) tags inside VXLAN tunnels. The system we use segments customer networks into individual VNIs and allows the customer to use VLANs to segment traffic within their network. The customer VLANs use 802.1q tags and the the EVPN system transports them, but we allow the customer to strip those tags within the hypervisor before they hit their VM's NIC.

In my testing of Proxmox, I am able to build a zone and VNet which carries this tagged traffic, but when I try to attach a VM to a VNet and set a VLAN tag (so my VM gets untagged traffic), I get the below error.

[B]net0[/B]: hotplug problem - vm vlans are not allowed on vnet TEST at /usr/share/perl5/PVE/Network/SDN/Zones/Plugin.pm line 235.

I can see in the Perl module that it intentionally throws this exception when a VLAN tag is included. However, if I manually modify the host networking (shown below), I can get fully functional untagged traffic to my VM.

ip link add link vxlan_TEST name TEST.2711 type vlan id 2711
ip link set up TEST.2711

brctl addbr TESTv2711
brctl addif TESTv2711 TEST.2711
ip link set up TESTv2711


brctl delif vmbr0 tap101i0
brctl addif TESTv2711 tap101i0

I'd love to be able to perform this tag/untag natively in the Proxmox GUI. Does anybody know if this is a known bug or limitation and if Proxmox plans to support VLAN tagging for VNets the same way they do for normal bridges with physical uplinks?

 

[spirit]

you need to enable vlan aware on your vnet (in advanced options)

 

[johnwkerns]

you need to enable vlan aware on your vnet (in advanced options)

Is the VLAN-Aware option only available on VNets built on a certain type of zone? I'm using an EVPN zone and I don't see an option to enable the VNet as VLAN-aware

 

[johnwkerns]

I've confirmed that a VNet built atop a "VXLAN" zone has the VLAN-Aware option, but a VNet built atop a "EVPN" zone does not have the option.

If a build a VXLAN zone, the EVPN system will announce BGP type-3 (broadcast/multicast) EVPN routes for the VNI, but it will not announce any type-2 (MAC unicast) routes for the VM.

It seems like Proxmox needs to add support for a VLAN-Aware VNet when the VNet's zone is of the EVPN type.