[PVE-User] VLAN between LXC containers on differents proxmox 4

[Guillaume]

Hello,

We have 2 Proxmox 4.4 servers on dedicated servers at OVH, with 2
networks interfaces, a wan and a lan (ovh vrack solution) nic.
I tried to setup a vlan inside the vrack.

VLAN works between containers on the same proxmox (101 & 103), but isn't
between containers on differents proxmox (101 & 102 or 103 & 102).

Here's our configuration :

* PX 1 :
vmbr0 (wan) on eth0
vmbr1 (lan) on eth1 (vlan aware) : 172.16.0.1/16

** LXC 101 :
net0/eth0 on vmbr2 : 172.16.1.1/16
net1/eth1 on vmbr2
net2/eth1.10 on vmbr2 : 10.0.10.1/24 (vlan 10)

** LXC 103 :
net0/eth0 on vmbr2 : 172.16.1.3/16
net1/eth1 on vmbr2
net2/eth1.10 on vmbr2 : 10.0.10.3/24 (vlan 10)

* PX 2 :
vmbr0 (wan) on eth0
vmbr1 (lan) on eth1 (vlan aware) : 172.16.0.2/16

** LXC 102 :
net0/eth0 on vmbr2 : 172.16.1.2/16
net1/eth1 on vmbr2
net2/eth1.10 on vmbr2 : 10.0.10.2/24 (vlan 10)


What am I missing ?
I think i should have a vmbr3 bridge (using an eth1.10 interface) but
since the web interface doesn't permit vlan configuration on the
hypervisor (i am confortable with console), i am doubting that.

Thanks,

Guillaume

[Michael Rasmussen]

On Tue, 4 Apr 2017 12:43:32 +0200

VLAN works between containers on the same proxmox (101 & 103), but isn't between containers on differents proxmox (101 & 102 or 103 & 102).

To be able to use vlans between different proxmox nodes the switch must
support vlan so you should ask OVH support whether vlans between
servers are supported.
--
Hilsen/Regards
Michael Rasmussen

Get my public GnuPG keys:
michael <at> rasmussen <dot> cc
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xD3C9A00E
mir <at> datanom <dot> net
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE501F51C
mir <at> miras <dot> org
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE3E80917
--------------------------------------------------------------
/usr/games/fortune -es says:
If you look like your driver's license photo -- see a doctor.
If you look like your passport photo -- it's too late for a doctor.

[Gwenn Gueguen]

Hi,

On Tue, 4 Apr 2017 12:51:45 +0200

Post by Michael Rasmussen
To be able to use vlans between different proxmox nodes the switch
must support vlan so you should ask OVH support whether vlans between
servers are supported.

Or use VXLAN between nodes.

[Guillaume]

They support vlan between servers in the vrack.

Post by Michael Rasmussen
On Tue, 4 Apr 2017 12:43:32 +0200

VLAN works between containers on the same proxmox (101 & 103), but isn't between containers on differents proxmox (101 & 102 or 103 & 102).

To be able to use vlans between different proxmox nodes the switch must
support vlan so you should ask OVH support whether vlans between
servers are supported.
_______________________________________________
pve-user mailing list
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user

[Michael Rasmussen]

On Tue, 4 Apr 2017 16:58:37 +0200

Post by Guillaume
They support vlan between servers in the vrack.

Then you need to have a trunk port instead of an access port in the
switch where the servers are connected.
--
Hilsen/Regards
Michael Rasmussen

Get my public GnuPG keys:
michael <at> rasmussen <dot> cc
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xD3C9A00E
mir <at> datanom <dot> net
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE501F51C
mir <at> miras <dot> org
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE3E80917
--------------------------------------------------------------
/usr/games/fortune -es says:
Prepare for tomorrow -- get ready.
-- Edith Keeler, "The City On the Edge of Forever",
stardate unknown

[Guillaume]

Post by Michael Rasmussen
On Tue, 4 Apr 2017 16:58:37 +0200

Post by Guillaume
They support vlan between servers in the vrack.

Then you need to have a trunk port instead of an access port in the
switch where the servers are connected.

Is my proxmox network config right ?
What about the need to create a network interface on the host inside the
vlan used by the lxc containers ?

Post by Michael Rasmussen
_______________________________________________
pve-user mailing list
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user

[Michael Rasmussen]

On Tue, 4 Apr 2017 17:34:45 +0200

Post by Guillaume
Is my proxmox network config right ?
What about the need to create a network interface on the host inside the vlan used by the lxc containers ?

Before you can positive confirm that your proxmox nodes are connected
through a trunk port the rest can wait.
--
Hilsen/Regards
Michael Rasmussen

Get my public GnuPG keys:
michael <at> rasmussen <dot> cc
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xD3C9A00E
mir <at> datanom <dot> net
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE501F51C
mir <at> miras <dot> org
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE3E80917
--------------------------------------------------------------
/usr/games/fortune -es says:
... Had this been an actual emergency, we would have fled in terror,
and you would not have been informed.

[Guillaume]

The vrack system already took care of that, that's why i didn't speak
about that part at all on my initial email.

Post by Michael Rasmussen
On Tue, 4 Apr 2017 17:34:45 +0200

Post by Guillaume
Is my proxmox network config right ?
What about the need to create a network interface on the host inside the vlan used by the lxc containers ?

Before you can positive confirm that your proxmox nodes are connected
through a trunk port the rest can wait.
_______________________________________________
pve-user mailing list
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user

[Michael Rasmussen]

On Tue, 4 Apr 2017 22:48:54 +0200

The vrack system already took care of that, that's why i didn't speak about that part at all on my initial email.

Ok. The next thing is that I do not think it is possible to configure
vlans inside of a LXC you need to configure the bridge on the proxmox
node to handle the vlan stuff.

This is a working example from my installation:
Proxmox:
auto vmbr1000
iface vmbr1000 inet manual
bridge_ports bond0.1000
bridge_stp off
bridge_fd 0

LXC:
net0: name=eth0,bridge=vmbr1000,hwaddr=3A:66:32:39:38:65,ip=dhcp,type=veth
--
Hilsen/Regards
Michael Rasmussen

Get my public GnuPG keys:
michael <at> rasmussen <dot> cc
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xD3C9A00E
mir <at> datanom <dot> net
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE501F51C
mir <at> miras <dot> org
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE3E80917
--------------------------------------------------------------
/usr/games/fortune -es says:
Assume a virtue, if you have it not. -William Shakespeare

[Guillaume]

Post by Michael Rasmussen
On Tue, 4 Apr 2017 22:48:54 +0200

The vrack system already took care of that, that's why i didn't speak about that part at all on my initial email.

Ok. The next thing is that I do not think it is possible to configure
vlans inside of a LXC you need to configure the bridge on the proxmox
node to handle the vlan stuff.
auto vmbr1000
iface vmbr1000 inet manual
bridge_ports bond0.1000
bridge_stp off
bridge_fd 0
net0: name=eth0,bridge=vmbr1000,hwaddr=3A:66:32:39:38:65,ip=dhcp,type=veth

You can configure vlan inside lxc since i did it (using the web
interface or interfaces file), but i am indeed missing a bridge in the
same vlan on proxmox side.

Post by Michael Rasmussen
_______________________________________________
pve-user mailing list
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user

[Guillaume]

Post by Guillaume

Post by Michael Rasmussen
On Tue, 4 Apr 2017 22:48:54 +0200

Post by Guillaume
The vrack system already took care of that, that's why i didn't
speak about that part at all on my initial email.

Ok. The next thing is that I do not think it is possible to configure
vlans inside of a LXC you need to configure the bridge on the proxmox
node to handle the vlan stuff.
auto vmbr1000
iface vmbr1000 inet manual
bridge_ports bond0.1000
bridge_stp off
bridge_fd 0
name=eth0,bridge=vmbr1000,hwaddr=3A:66:32:39:38:65,ip=dhcp,type=veth

You can configure vlan inside lxc since i did it (using the web
interface or interfaces file), but i am indeed missing a bridge in the
same vlan on proxmox side.

Of course, if i follow your advice and do it on proxmox side, there is
no need to do it on the container side.

Post by Guillaume

Post by Michael Rasmussen
_______________________________________________
pve-user mailing list
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user

_______________________________________________
pve-user mailing list
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user

[Alessandro Briosi]

Post by Guillaume

Post by Guillaume

Post by Michael Rasmussen
On Tue, 4 Apr 2017 22:48:54 +0200

Post by Guillaume
The vrack system already took care of that, that's why i didn't
speak about that part at all on my initial email.

Ok. The next thing is that I do not think it is possible to configure
vlans inside of a LXC you need to configure the bridge on the proxmox
node to handle the vlan stuff.
auto vmbr1000
iface vmbr1000 inet manual
bridge_ports bond0.1000
bridge_stp off
bridge_fd 0
name=eth0,bridge=vmbr1000,hwaddr=3A:66:32:39:38:65,ip=dhcp,type=veth

You can configure vlan inside lxc since i did it (using the web
interface or interfaces file), but i am indeed missing a bridge in
the same vlan on proxmox side.

Of course, if i follow your advice and do it on proxmox side, there is
no need to do it on the container side.

I think it's simply a matter of setting the VLAN tag in the eth
configuration on the Proxmox GUI.


Alessandro

[Guillaume]

Here is what i added in my proxmox interfaces file :

auto vmbr210
iface vmbr210 inet manual
bridge_ports eth1.10
bridge_stp off
bridge_fd 0
bridge_vlan_aware yes

Then, i have a eth110/net2 interface on vmbr210 in my lxc container with
this :

auto eth110
iface eth110 inet static
address 10.0.0.102
netmask 255.255.255.0

ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
From 10.0.0.1 icmp_seq=1 Destination Host Unreachable
From 10.0.0.1 icmp_seq=2 Destination Host Unreachable


10.0.0.1 through 5 are 5 physical ubuntu servers with have the same vlan
(inside the vrack) and use the vlan without any issue.
So there is still something missing on proxmox side.

Post by Alessandro Briosi

Post by Guillaume

Post by Guillaume

Post by Michael Rasmussen
On Tue, 4 Apr 2017 22:48:54 +0200

Post by Guillaume
The vrack system already took care of that, that's why i didn't
speak about that part at all on my initial email.

Ok. The next thing is that I do not think it is possible to configure
vlans inside of a LXC you need to configure the bridge on the proxmox
node to handle the vlan stuff.
auto vmbr1000
iface vmbr1000 inet manual
bridge_ports bond0.1000
bridge_stp off
bridge_fd 0
name=eth0,bridge=vmbr1000,hwaddr=3A:66:32:39:38:65,ip=dhcp,type=veth

You can configure vlan inside lxc since i did it (using the web
interface or interfaces file), but i am indeed missing a bridge in
the same vlan on proxmox side.

Of course, if i follow your advice and do it on proxmox side, there is
no need to do it on the container side.

I think it's simply a matter of setting the VLAN tag in the eth
configuration on the Proxmox GUI.
Alessandro
_______________________________________________
pve-user mailing list
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user

[Guillaume]

Post by Alessandro Briosi

Post by Guillaume

Post by Guillaume

Post by Michael Rasmussen
On Tue, 4 Apr 2017 22:48:54 +0200

Post by Guillaume
The vrack system already took care of that, that's why i didn't
speak about that part at all on my initial email.

Ok. The next thing is that I do not think it is possible to configure
vlans inside of a LXC you need to configure the bridge on the proxmox
node to handle the vlan stuff.
auto vmbr1000
iface vmbr1000 inet manual
bridge_ports bond0.1000
bridge_stp off
bridge_fd 0
name=eth0,bridge=vmbr1000,hwaddr=3A:66:32:39:38:65,ip=dhcp,type=veth

You can configure vlan inside lxc since i did it (using the web
interface or interfaces file), but i am indeed missing a bridge in
the same vlan on proxmox side.

Of course, if i follow your advice and do it on proxmox side, there is
no need to do it on the container side.

I think it's simply a matter of setting the VLAN tag in the eth
configuration on the Proxmox GUI.

With Proxmox GUI, you can only assign vlan tag on lxc interfaces, not on
proxmox network.
And doing it only on lxc side (assigned to a proxmox bridge vlan aware)
doesn't work.

I am not using bonding so I can't use Michael's working example out of
the box.

Post by Alessandro Briosi
Alessandro
_______________________________________________
pve-user mailing list
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user

[Alessandro Briosi]

Post by Guillaume

Post by Alessandro Briosi

Post by Guillaume

Post by Guillaume

Post by Michael Rasmussen
On Tue, 4 Apr 2017 22:48:54 +0200

Post by Guillaume
The vrack system already took care of that, that's why i didn't
speak about that part at all on my initial email.

Ok. The next thing is that I do not think it is possible to configure
vlans inside of a LXC you need to configure the bridge on the proxmox
node to handle the vlan stuff.
auto vmbr1000
iface vmbr1000 inet manual
bridge_ports bond0.1000
bridge_stp off
bridge_fd 0
name=eth0,bridge=vmbr1000,hwaddr=3A:66:32:39:38:65,ip=dhcp,type=veth

You can configure vlan inside lxc since i did it (using the web
interface or interfaces file), but i am indeed missing a bridge in
the same vlan on proxmox side.

Of course, if i follow your advice and do it on proxmox side, there is
no need to do it on the container side.

I think it's simply a matter of setting the VLAN tag in the eth
configuration on the Proxmox GUI.

With Proxmox GUI, you can only assign vlan tag on lxc interfaces, not
on proxmox network.
And doing it only on lxc side (assigned to a proxmox bridge vlan
aware) doesn't work.
I am not using bonding so I can't use Michael's working example out of
the box.

It you need proxmox to use that VLAN on the bridge and then assign that
bridge to the LXC containers, then you'd need to create a bridge which
uses a VLAN configured ethX.Y/bondX.Y for the VLAN (like you did). Dunno
if "bridge_vlan_aware yes" is correct in this case.

If you simply need the LXC to be part of the VLAN then Assign the Tag.

So basically here you have 2 possible solutions:

1. make the bridge vlan aware (bridge_vlan_aware yes) and simply tag the
LXC ethernets associated with the bridge (vmbr210 with bridge_ports eth1)

2. make the bridge inside a vlan (bridge_ports eth1.10) and simply
assign that bridge to the LXC containers.

1 works for me (no on OVH though) and Michael says 2 is also working so
there must be something in your configuration or OVH vrack which
prevents it from working.

Alessandro

[Guillaume]

Post by Alessandro Briosi

Post by Guillaume

Post by Alessandro Briosi

Post by Guillaume

Post by Guillaume

Post by Michael Rasmussen
On Tue, 4 Apr 2017 22:48:54 +0200

Post by Guillaume
The vrack system already took care of that, that's why i didn't
speak about that part at all on my initial email.

Ok. The next thing is that I do not think it is possible to configure
vlans inside of a LXC you need to configure the bridge on the proxmox
node to handle the vlan stuff.
auto vmbr1000
iface vmbr1000 inet manual
bridge_ports bond0.1000
bridge_stp off
bridge_fd 0
name=eth0,bridge=vmbr1000,hwaddr=3A:66:32:39:38:65,ip=dhcp,type=veth

You can configure vlan inside lxc since i did it (using the web
interface or interfaces file), but i am indeed missing a bridge in
the same vlan on proxmox side.

Of course, if i follow your advice and do it on proxmox side, there is
no need to do it on the container side.

I think it's simply a matter of setting the VLAN tag in the eth
configuration on the Proxmox GUI.

With Proxmox GUI, you can only assign vlan tag on lxc interfaces, not
on proxmox network.
And doing it only on lxc side (assigned to a proxmox bridge vlan
aware) doesn't work.
I am not using bonding so I can't use Michael's working example out of
the box.

It you need proxmox to use that VLAN on the bridge and then assign that
bridge to the LXC containers, then you'd need to create a bridge which
uses a VLAN configured ethX.Y/bondX.Y for the VLAN (like you did). Dunno
if "bridge_vlan_aware yes" is correct in this case.
If you simply need the LXC to be part of the VLAN then Assign the Tag.
1. make the bridge vlan aware (bridge_vlan_aware yes) and simply tag the
LXC ethernets associated with the bridge (vmbr210 with bridge_ports eth1)
2. make the bridge inside a vlan (bridge_ports eth1.10) and simply
assign that bridge to the LXC containers.
1 works for me (no on OVH though) and Michael says 2 is also working so
there must be something in your configuration or OVH vrack which
prevents it from working.

OVH is looking at it with some test servers they are installing.

Post by Alessandro Briosi
Alessandro
_______________________________________________
pve-user mailing list
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-user

[Alessandro Briosi]

Post by Guillaume

Post by Alessandro Briosi

Post by Guillaume

Post by Guillaume

Post by Michael Rasmussen
On Tue, 4 Apr 2017 22:48:54 +0200

Post by Guillaume
The vrack system already took care of that, that's why i didn't
speak about that part at all on my initial email.

Ok. The next thing is that I do not think it is possible to configure
vlans inside of a LXC you need to configure the bridge on the proxmox
node to handle the vlan stuff.
auto vmbr1000
iface vmbr1000 inet manual
bridge_ports bond0.1000
bridge_stp off
bridge_fd 0
name=eth0,bridge=vmbr1000,hwaddr=3A:66:32:39:38:65,ip=dhcp,type=veth

You can configure vlan inside lxc since i did it (using the web
interface or interfaces file), but i am indeed missing a bridge in
the same vlan on proxmox side.

Of course, if i follow your advice and do it on proxmox side, there is
no need to do it on the container side.

I think it's simply a matter of setting the VLAN tag in the eth
configuration on the Proxmox GUI.

With Proxmox GUI, you can only assign vlan tag on lxc interfaces, not
on proxmox network.
And doing it only on lxc side (assigned to a proxmox bridge vlan
aware) doesn't work.
I am not using bonding so I can't use Michael's working example out of
the box.

oh, and I would also consider using OVS:
https://pve.proxmox.com/wiki/Open_vSwitch



Buon lavoro.
/Alessandro Briosi/

*METAL.it Nord S.r.l.*
Via Maioliche 57/C - 38068 Rovereto (TN)
Tel.[phone] - Fax [phone]
www.metalit.com