minor cleanups, typo and whitespace fixes

[pve-docs.git] / pve-network.adoc

diff --git a/pve-network.adoc b/pve-network.adoc
index 1755cb667cfd84e761572dd909389592779e7beb..b846d11a98555370ebfd4cf3358aa77d9d816a33 100644 (file)
--- a/pve-network.adoc
+++ b/pve-network.adoc
@@ -102,6 +102,7 @@ virtual networks.
 Default Configuration using a Bridge
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Default Configuration using a Bridge
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

+[thumbnail="default-network-setup-bridge.svg"]

 Bridges are like physical network switches implemented in software.
 All VMs can share a single bridge, or you can create multiple bridges to 
 separate network domains. Each host can have up to 4094 bridges.
 Bridges are like physical network switches implemented in software.
 All VMs can share a single bridge, or you can create multiple bridges to 
 separate network domains. Each host can have up to 4094 bridges.


@@ -146,6 +147,7 @@ You can avoid the problem by ``routing'' all traffic via a single
 interface. This makes sure that all network packets use the same MAC
 address.
 
 interface. This makes sure that all network packets use the same MAC
 address.
 

+[thumbnail="default-network-setup-routed.svg"]

 A common scenario is that you have a public IP (assume `198.51.100.5`
 for this example), and an additional IP block for your VMs
 (`203.0.113.16/29`). We recommend the following setup for such
 A common scenario is that you have a public IP (assume `198.51.100.5`
 for this example), and an additional IP block for your VMs
 (`203.0.113.16/29`). We recommend the following setup for such


@@ -314,6 +316,7 @@ iface vmbr0 inet static
 ----
 
 
 ----
 
 

+[thumbnail="default-network-setup-bond.svg"]

 Another possibility it to use the bond directly as bridge port.
 This can be used to make the guest network fault-tolerant.
 
 Another possibility it to use the bond directly as bridge port.
 This can be used to make the guest network fault-tolerant.
 


@@ -344,32 +347,31 @@ iface vmbr0 inet static
 
 ----
 
 
 ----
 

+

 VLAN 802.1Q
 ~~~~~~~~~~~
 
 VLAN 802.1Q
 ~~~~~~~~~~~
 

-A virtual LAN (VLAN) is any broadcast domain that is partitioned
-and isolated in the network at layer 2.
-So it is possible to have multiple networks (4096) in a physical network,
-each independent of the other ones.
-Each VLAN network is identified by a number often called `tag`.
-Network packages are then `tagged` to identify which virtual
-network they belong to.
+A virtual LAN (VLAN) is a broadcast domain that is partitioned and
+isolated in the network at layer two.  So it is possible to have
+multiple networks (4096) in a physical network, each independent of
+the other ones.
+
+Each VLAN network is identified by a number often called 'tag'.
+Network packages are then 'tagged' to identify which virtual network
+they belong to.

 
 

-One or more VLANs can be used at any network device (Nic, Bond, Bridge).
-VLANs can be configured in several ways. Here, only the most common ones get
-described. We assume a network infrastructure based on Linux Kernel Networking
-(opposed to, e.g., Open vSwitch).
-Of course, there are scenarios that are not possible with this configuration,
-but it will work for most standard setups.

 
 

-Two of the most common and popular usage scenarios are:
+VLAN for Guest Networks
+^^^^^^^^^^^^^^^^^^^^^^^

 
 

-1.) VLAN for the guest networks.
-Proxmox supports three different ways of using VLAN in guests:
+{pve} supports this setup out of the box. You can specify the VLAN tag
+when you create a VM. The VLAN tag is part of the guest network
+confinuration. The networking layer supports differnet modes to
+implement VLANs, depending on the bridge configuration:

 
 

-* *VLAN awareness on the Linux Bridge:*
+* *VLAN awareness on the Linux bridge:*

 In this case, each guest's virtual network card is assigned to a VLAN tag,
 In this case, each guest's virtual network card is assigned to a VLAN tag,

-which is transparently supported by the Linux Bridge.
+which is transparently supported by the Linux bridge.

 Trunk mode is also possible, but that makes the configuration
 in the guest necessary.
 
 Trunk mode is also possible, but that makes the configuration
 in the guest necessary.
 


@@ -379,25 +381,29 @@ and creates a VLAN device with associated bridge for each VLAN.
 That is, if e.g. in our default network, a guest VLAN 5 is used
 to create eno1.5 and vmbr0v5, which remains until rebooting.
 
 That is, if e.g. in our default network, a guest VLAN 5 is used
 to create eno1.5 and vmbr0v5, which remains until rebooting.
 

-* *Guest configured:* The VLANs are assigned in the guest.
-In this case, the setup is in the guest and can not be influenced from the
-outside.
-The benefit is more then one VLAN on a single virtual NIC can be used.
+* *Open vSwitch VLAN:*
+This mode uses the OVS VLAN feature.
+
+* *Guest configured VLAN:* 
+VLANs are assigned inside the guest. In this case, the setup is
+completely done inside the guest and can not be influenced from the
+outside. The benefit is that you can use more than one VLAN on a
+single virtual NIC.

 
 

-2.) VLAN on the host, to allow the host communication whit an isolated network.
-As already mentioned, it is possible to apply the VLAN to all network devices.
-In general, you should configure the VLAN on the interface with the least
+
+VLAN on the Host
+^^^^^^^^^^^^^^^^
+
+To allow host communication with an isolated network. It is possible
+to apply VLAN tags to any network device (NIC, Bond, Bridge). In
+general, you should configure the VLAN on the interface with the least

 abstraction layers between itself and the physical NIC.
 
 For example, in a default configuration where you want to place
 the host management address on a separate VLAN.
 
 abstraction layers between itself and the physical NIC.
 
 For example, in a default configuration where you want to place
 the host management address on a separate VLAN.
 

-NOTE: In the examples we use the VLAN at bridge level to ensure the correct
-function of VLAN 5 in the guest network, but in combination with VLAN anwareness
-bridge this it will not work for guest network VLAN 5.
-The downside of this setup is more CPU usage.

 
 

-.Example: Use VLAN 5 for the {pve} management IP
+.Example: Use VLAN 5 for the {pve} management IP with traditional Linux bridge

 ----
 auto lo
 iface lo inet loopback
 ----
 auto lo
 iface lo inet loopback


@@ -423,10 +429,32 @@ iface vmbr0 inet manual
 
 ----
 
 
 ----
 

+.Example: Use VLAN 5 for the {pve} management IP with VLAN aware Linux bridge
+----
+auto lo
+iface lo inet loopback
+
+iface eno1 inet manual
+
+
+auto vmbr0.5
+iface vmbr0.5 inet static
+        address  10.10.10.2
+        netmask  255.255.255.0
+        gateway  10.10.10.1
+
+auto vmbr0
+iface vmbr0 inet manual
+        bridge_ports eno1
+        bridge_stp off
+        bridge_fd 0
+        bridge_vlan_aware yes
+----
+

 The next example is the same setup but a bond is used to
 make this network fail-safe.
 
 The next example is the same setup but a bond is used to
 make this network fail-safe.
 

-.Example: Use VLAN 5 with bond0 for the {pve} management IP
+.Example: Use VLAN 5 with bond0 for the {pve} management IP with traditional Linux bridge

 ----
 auto lo
 iface lo inet loopback
 ----
 auto lo
 iface lo inet loopback