Why we can't have more than 4094 vlan tag ID on OVS with GRE overly?

[tincboy]

I setup OVS switch on 10 nodes which are interconnected via GRE tunnels, but I can see Proxmox is not letting us create more than 4094 vlans because tag ID larger than 4094 is not validated in Proxmox interface or API.
Is there any restriction based on GRE overlay that prevent us having more vlans?

 

[aaron]

Correct me if I am wrong but the VLAN standard IEEE 802.1Q[0] can only address 4096 VLANs, minus 1 reserved at each end -> 4094.

[0] https://en.wikipedia.org/wiki/Virtual_LAN#IEEE_802.1Q

 

[tincboy]

Correct me if I am wrong but the VLAN standard IEEE 802.1Q[0] can only address 4096 VLANs, minus 1 reserved at each end -> 4094.

[0] https://en.wikipedia.org/wiki/Virtual_LAN#IEEE_802.1Q

That's correct, but doesn't OpenVSwitch supports IEEE_802.1ad ?

 

[aaron]

That's correct, but doesn't OpenVSwitch supports IEEE_802.1ad ?

Apparently yes. But this does not increase the number of VLANs available but adds another VLAN field to the packet -> VLAN inside VLAN.

https://en.wikipedia.org/wiki/IEEE_802.1ad

 

[tincboy]

Apparently yes. But this does not increase the number of VLANs available but adds another VLAN field to the packet -> VLAN inside VLAN.

https://en.wikipedia.org/wiki/IEEE_802.1ad

Using an other field, can't we assign both VLAN field IDs from Proxmox configs? If so then we can have more than 16 million separated private networks. right?

 

[aaron]

Using an other field, can't we assign both VLAN field IDs from Proxmox configs? If so then we can have more than 16 million separated private networks. right?

This is not how it works. Using two VLAN tags will not increase the addressable range (24bit instead of 12bit) but will put the packet with it's VLAN tag into another VLAN tag. It's a bit like having a box with the VLAN number written on it put in another box with the second VLAN number on it.
Usually switches only care about the most outer VLAN tag.

What is your use case?

 

[tincboy]

This is not how it works. Using two VLAN tags will not increase the addressable range (24bit instead of 12bit) but will put the packet with it's VLAN tag into another VLAN tag. It's a bit like having a box with the VLAN number written on it put in another box with the second VLAN number on it.
Usually switches only care about the most outer VLAN tag.

What is your use case?

My case is to offer private network to our many clients, each client may have more than 1 private network and therefor 4095 vlan tag is not enough to fully isolate each client's private network.

 

[adlai7]

My case is to offer private network to our many clients, each client may have more than 1 private network and therefor 4095 vlan tag is not enough to fully isolate each client's private network.

Using QinQ tagging would encapsulate all customer VLANs/private networks into 1 tagged VLAN on your provider network. You would need to define a customer edge and provider edge of the network where this happens so that you don't have any shared VLANs between customers. This would give each customer 4094 VLANs and you as a provider 4094 VLANs to assign to customers. Theoretically you max out at 4094 customers.

You may want to look into seeing if VXLANs would fit your use case as you'd have 16 million VXLAN IDs to utilize.

 

[tincboy]

Using QinQ tagging would encapsulate all customer VLANs/private networks into 1 tagged VLAN on your provider network. You would need to define a customer edge and provider edge of the network where this happens so that you don't have any shared VLANs between customers. This would give each customer 4094 VLANs and you as a provider 4094 VLANs to assign to customers. Theoretically you max out at 4094 customers.

You may want to look into seeing if VXLANs would fit your use case as you'd have 16 million VXLAN IDs to utilize.

In vxlan, is VNI equevalent of vlanID ? by setting VNI to each interface of a VM, are we isolating the traffic of that customer of others?

 

[adlai7]

In vxlan, is VNI equevalent of vlanID ? by setting VNI to each interface of a VM, are we isolating the traffic of that customer of others?

Yes, each VNI (VXLAN Network ID) is a L2 domain and would isolate traffic in the same way VLANs do.

 

[tincboy]

Yes, each VNI (VXLAN Network ID) is a L2 domain and would isolate traffic in the same way VLANs do.

Thanks for the info, would you please let me know how can I configure VNI id of an interface in Proxmox using OpenVSwitch Bridge?