Yet another VLAN question (VM is not passing tagged vlan)

[ScottZ.]

I have read a few different threads and the admin book really doesn't get a clear answer on this.

I have 1 PVE Hypervisor. It has 3 physical nics (2 virtual interfaces).
NIC0: 1 Copper port, for management traffic
NIC1: LACP (802.3ad) SFP+ ports on a dedicated vlan, lets just call it VLAN 10, on VMBR1 (on BOND0)

From the hypervisor, I can ping from NIC1interface to vlan10 IP address, works great.

Now I create a VM with 2 network cards(lets call em NIC10, NIC11 just to make it easy).

• 10 - Management (the copper network, logically NIC0 from Hypervisor, as it will pass management network traffic)
• 11 for VLAN10 traffic (storage network, logically NIC1 from Hypervisor, as it will pass storage network traffic, via vlan tagging)

What is the official way for the VM (not the hypervisor, which is working) to pass traffic over NIC11 via vlan 10?

• Do I add the vlan tag on the VM? (tried it, didnt work)
• Do i keep it at no vlan tag? (tried it, didnt work)
• Do I tag on the VM interface (tried it, didnt work)
• Do I tag on the VM interface AND on the VM container? (tried it didn't work)
• Do I add the trunks tag via qm set <vm> <option>? (restarted, tried it, didn't work).

TLDR; To recap, very simple setup.
1 PVE Host, 2 logical NICs. 1 on vlan 1, the other on VLAN10 (and marked VLAN aware) and PVE host segregates traffic accordingly (good)
1 VM inside the host, 2 logical NICs that will be 1 on VLAN1(mgmt traffic) and the other NIC on VLAN10 for storage traffic (not working).

There is no default gateway (by design) on the VLAN10 as broadcast traffic should hit it.

*NOTE*: Firewall is disabled on both NICs

Please advise as I am out of ideas here.

Thank you!