VLAN tagging on VMs

[beriapl]

I have simple setup with two physical NIC interfaces.

I have VLAN interface for management and I would like to tag VM inside proxmox with the same VLAN.

auto lo
iface lo inet loopback


auto eno1
iface eno1 inet manual


auto eno2
iface eno2 inet manual


auto bond0
iface bond0 inet manual
        bond-slaves eno1 eno2
        bond-miimon 100
        bond-mode balance-alb


auto vmbr0
iface vmbr0 inet manual
        bridge-ports bond0
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 2-4094


auto vlan52
iface vlan52 inet static
        address 192.168.52.11/25
        gateway 192.168.52.1
        vlan-raw-device bond0

With this setting when I'm adding NIC to VM on vmbr0 with tag 52 - this VM doesn't have network.
What I'm doing wrong here?

 

[Arvyr]

vmbr0 is untagged or a trunk in this case.
You can however set the vlan tag in your VM or CT directly.
Go to your VM -> NIC -> VLAN Tag: and enter the number there.
For CTs go to your CT -> Network -> VLAN Tag:

 

[beriapl]

That's what I'm doing. I'm tagging VM.

 

[Arvyr]

Is it properly configured on the other end, your switch?

 

[beriapl]

Yup. Since interface vlan52 works fine - it is good confirmation that it works.

 

[spirit]

Hi,
if you use vlan aware bridge, the best way to setup your vlan52, is

auto vmbr0.52
iface vmbr0.52 inet static
        address 192.168.52.11/25
        gateway 192.168.52.1

Like this you'll use the vlan tagging feature from bridge, same than vms.

 

[beriapl]

Hi,
if you use vlan aware bridge, the best way to setup your vlan52, is

auto vmbr0.52
iface vmbr0.52 inet static
        address 192.168.52.11/25
        gateway 192.168.52.1

Like this you'll use the vlan tagging feature from bridge, same than vms.

So, it is not the same as this...

auto vlan52
iface vlan52 inet static
address 192.168.52.11/25
gateway 192.168.52.1
vlan-raw-device bond0

 

[spirit]

So, it is not the same as this...

auto vlan52
iface vlan52 inet static
address 192.168.52.11/25
gateway 192.168.52.1
vlan-raw-device bond0

no, here you are tagging on bond0.52.
it's a different way, not same layer. I'm not sure than both method are playing fine together.

with vmbr0.52, you are tagging directly a virtual port inside the vlan-aware bridge. (like for the vm)

 

[beriapl]

So any way - why my bond0.52 aka vlan52 works, while tagged VM doesn't? For me it is the same vlan52 is "same" as tagged VM? Right? Or no?

 

[spirit]

So any way - why my bond0.52 aka vlan52 works, while tagged VM doesn't? For me it is the same vlan52 is "same" as tagged VM? Right? Or no?

no this is not tagged at the same layer.

does other vlans on your vms works ? or only vlan52 ?

I'm not sure how the kernel is managing vlan here.

with bond0.52 aka vlan52, the vlan tag is done when the packet is going out bond0.
with vlan-aware bridge, the tag is done inside the vmbr0.

If not sure if the vlan52 for the vm inside the bridge is not removed by the bond0.52.

you should not mix 2 differents of tagging to be sure.

if you don't use vlan-aware bridge, the clean config is

auto vmbr0
iface vmbr0 inet manual
        bridge-ports bond0
        bridge-stp off
        bridge-fd 0


auto vmbr0v52
iface vmbr0v52 inet static
        address 192.168.52.11/25
        gateway 192.168.52.1
        bridge-ports bond0.52

or with vlan-aware bridge

auto vmbr0
iface vmbr0 inet manual
        bridge-ports bond0
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 2-4094

auto vmbr0.52
iface vmbr0.52 inet static
        address 192.168.52.11/25
        gateway 192.168.52.1

just follow the official documentation:
https://pve.proxmox.com/wiki/Network_Configuration#_vlan_802_1q