So i was looking into implementation today.
Unfortunately I found some points where I'm kinda stuck with the current
way SDN is designed.
I'm hoping you have some ideas or advise how to continue.
Basicly the vnet and subnet part I see as in issue.
Since in this kind of setup there is no defined subsets required the
current configuration doesn't fully make sense.
I guess you could still have a subnet configuration and configure all
the host addresses inside that subnet, but it's not really necessary .
Every VM route would be a /32 route and also the configured address on
that bridge (gateway field) would be a /32.
When the tap interface of a vm gets plugged a route needs to be created.
Routes per VM get created with the comand ip route add 192.168.1.5/32
dev routedbridge.
The /32 gateway address needs to be configured on the bridge as well.
There needs to be some way to configure the guests IPs as well, but in
ipam there is currently no way to set a ip for a vm, it's only ip mac
bindings.
A potential security flaw is also devices on that bridge can steal a
configured ip by just replying to arp.
That could be mitigated by disabling bridge learning and creating static
atp entires as well for those configured IPs.
I don't know yet what's the best way to configure guest ip addresses.
My initial idea was to have that done on a per interface vm level, that
is incompatible with sdn though.
I don't know how it could be integrated in IPAM though, especially
considering that pve IPAM isn't the only one available to be used.
Mit freundlichen Grüßen,
Maurice Klein
Aetherus
TEL: 0212 7846460
Mail: [email protected]
Am 29.01.26 um 13:20 schrieb Stefan Hanreich:
On 1/27/26 11:36 AM, Maurice Klein wrote:
Hi,
I didn't even think about mac address, since arp does recover quickly
but it would be a unwanted interruption.
I like the idea with using a bridge with l2 isolation.
I'd like to implement the zone then, with the use of a l2 isolated bridge.
I'd propose the first step would be to get the zone working, to get the
mechanism working to add host routes.
I would use one VRF then per zone.
For a PoC we could just utilize the default routing table I think? VRF
support for SDN entities is something that is on the mid-term roadmap,
so if we want VRF support we'd need to be careful not to put any
barriers in that make implementing that feature harder. We'd also have
to make sure that VRFs stay unique across all entities that are using
them (currently only EVPN zone). If we generate the names analogous to
the EVPN zones we should be fine since all zones regardless of type
share the same ID space.
With multiple VRFs, you'd ideally want to have the option to announce
the routes per-VRF. Utilizing transit VLANs for zones would make sense
then and also being able to map each VNet in a zone to a VLAN. That'd
require creating VLAN subinterfaces inside a VRF as well via our stack
and adding them to a VNet (might be done automatically) / VRF. At that
point we're building essentially what is VRF-lite though, so that's a
bit more involved.
A proposed name would be "Routed".
Do you have better Ideas?
A roadmap I'd have in my head then would look the following way:
- implement zone "Routed"
ensuring that all routing between guests and host works and that
default routes get put in the vrf as well
I'd not necessarily put in the default route unconditionally, either as
a config option, or - if we skip VRF support for now - we'd get this for
free via implementing the VRF feature afterwards.
- implement possibility to export host routes of routed zones via BGP
see below
- implement possibility to add static routes per Routed zone, like
different default routes or others
we would get that via VRF support as well
- implement dynamic routing updates into routed zones vrf tables
Where I'm still not sure is how to get routing in a cluster running
between the same zone.
It could be implemented via IBGP Sessions between the hosts, but i don't
know if that is the preffered way and it needs to be clear to the user
which path will be taken and how it works.
One option would be to utilize e.g. the fabrics where we plan to add
initial support for route redistribution soon. This should get
integrated with a future VRF feature as well. That would decouple the
zone from the redistribution / announcing itself and give users
flexibility in choosing their routing protocol. Users can create
fabrics, then select which VRFs to announce via them (and apply filters
via route-maps).
