VLAN Tagging egress

[Stratisphere]

Hi All,

I have two proxmox v2.x servers (NOT clustered). They both have a single physical NIC and both sit on the same physical (and logical) network. I have numerious VMs on each one that utilises the default VMBR0 that proxmox sets up. Various hosts are configured with VLAN tags via the proxmox GUI.

What I would like is for a VM on proxmox server 1 to be tagged with VLAN 10 to be able to speak to a VM with the same tag on proxmox server 2. My knowledge of VLANs is fairly basic but I think it's a case that as packets exit the VMs, they need to be tagged with VLAN10 and that tag must be preserved as it goes out of eth0.

I've been trying to get this working on and off for about a year now and failed every time. I'd greatly appreciate tips on how people have got this working.

Thanks

 

[mir]

If your nodes are connected through a switch the switch needs to be a managed switch otherwise vlan tagging is not possible.

 

[Stratisphere]

Yup, got that. Thing is, I cant even see the tagged packets if I tcpdump from the host.

Assuming the switch is configured right, should proxmox work like this out of the box or is extra configuration required to pass the tags over eth0?

 

[Kyc]

According to the wiki you just need to change the network entry:
http://pve.proxmox.com/wiki/Vlan

I would have through you'd need to create vlan eth and bridge aliases...

I don't have a test environment to play around with this to test, if the wiki method doesn't work this is a really good write-up:
http://blog.davidvassallo.me/2012/05/05/kvm-brctl-in-linux-bringing-vlans-to-the-guests/

 

[dietmar]

According to the wiki you just need to change the network entry:

You can configure VLANs on the GUI since 2.0

 

[Stratisphere]

Thanks Kyc, I've seen both those posts before but actually might warrant a new look at them!

@dietmar - I'm aware of the VLAN setting in the GUI, thats how I've been configuring them. If I have 2 machines on the same VMBR with different VLANs then that works as expected (as in, they cant see each other). The issue I'm having is that I have a VM on VLAN10 on one server, and the same on another proxmox server. I want the two to be able to talk to each other. I have a L2 Managed switch that is VLAN capable and both are hooked up to that. Both the ports are set to allow VLANs and more specifically the VLANs I'm using.

What I seem to be failing to get, is for the packets to leave each server with the VLAN tag intact. Ideally I'd like to not have to create a bridge for each VLAN and to be able to use the GUI setting, but at this point, I just want it working.

@Kyc, I'll try creating the bridges manually and report back later. I may write up a definitive howto specific to Proxmox if I get it working!

 

[Stratisphere]

It would seem my previous reply is held in a moderation queue... weird?!

 

[spirit]

Thanks Kyc, I've seen both those posts before but actually might warrant a new look at them!

@dietmar - I'm aware of the VLAN setting in the GUI, thats how I've been configuring them. If I have 2 machines on the same VMBR with different VLANs then that works as expected (as in, they cant see each other). The issue I'm having is that I have a VM on VLAN10 on one server, and the same on another proxmox server. I want the two to be able to talk to each other. I have a L2 Managed switch that is VLAN capable and both are hooked up to that. Both the ports are set to allow VLANs and more specifically the VLANs I'm using.

What I seem to be failing to get, is for the packets to leave each server with the VLAN tag intact. Ideally I'd like to not have to create a bridge for each VLAN and to be able to use the GUI setting, but at this point, I just want it working.

@Kyc, I'll try creating the bridges manually and report back later. I may write up a definitive howto specific to Proxmox if I get it working!

Hi, I think something is wrong on your physical switch config.
If the proxmox servers send tagged packet, they should reach together without problem.

If you have a cisco switch by example, you need to setup the port as trunk. (and not forcing re-tagging of the packets)