Vlan traffic not correctly routed too VMs

[bibawa]

Hi Guys,

We've a working Proxmox 6 cluster in our environment, but we've a very strange issue with one of the nodes in the cluster.
All nodes are running the same version of Proxmox and are configured the same way.

We've configured our nodes with a LACP Trunk to our switched and connected this bond0 device to vmbr0, we've made the vmbr0 vlan aware so that we can configure the correct vlan tag in proxmox.

root@prox~# cat /etc/network/interfaces
auto lo
iface lo inet loopback

iface eno1 inet manual

auto bond0
iface bond0 inet manual
        bond-slaves enp216s0f0 enp216s0f1
        bond-miimon 100
        bond-mode 802.3ad
        offload-rx-vlan-filter off

auto vmbr0.100
iface vmbr0.100 inet static
        address 172.20.14.163
        netmask 255.255.255.0
        gateway 172.20.14.254

auto vmbr0.10
iface vmbr0.10 inet static
        address 172.10.10.4
        netmask 255.255.255.0

auto vmbr0
iface vmbr0 inet manual
        bridge-ports bond0
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes

iface eno2 inet manual

iface enp216s0f0 inet manual

iface enp216s0f1 inet manual

iface enp216s0f2 inet manual

iface enp216s0f3 inet manual

The strange thing is when I create a VM with VLAN id 2 network traffic is flowing, sometimes. All other vlans (3,4,98,..) are working fine as expected.

The most interesting thing is that when I run a tcpdump on the proxmox node , interface bond0 I see the traffic entering the proxmox machine:

So in the following example I started a ping from my vm (192.168.100.198) to a device in the network (192.168.100.148)

root@prox:~# tcpdump -ibond0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bond0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:08:26.747727 IP 192.168.100.198 > 192.168.100.148: ICMP echo request, id 1, seq 94, length 40
12:08:26.747960 IP 192.168.100.148 > 192.168.100.198: ICMP echo reply, id 1, seq 94, length 40

> on the VM itself I didn't receive any reply.

Firewall on the nic and host level is disabled.

Does anyone have any idea what could be the reason for this issue ?

best regards,

 

[Lorenz.S]

Is it possible, that the switch uses VLAN 2 as its default VLAN on this link? If this was the case, the switch would send any frames destined for VLAN 2 without any VLAN tag, which in turn "confuses" the node, because there is not default VLAN configured there.

If this really is the problem, the simplest solution would be to choose a not used VLAN (e.g. VLAN 1) as the default VLAN.