* [pve-devel] [PATCH pve-docs 0/2] sdn: evpn && vxlan improvments
@ 2021-09-06 3:57 Alexandre Derumier
2021-09-06 3:57 ` [pve-devel] [PATCH pve-docs 1/2] pvesdn: add evpn Advertise Subnets && Exit Nodes Local routing options Alexandre Derumier
2021-09-06 3:57 ` [pve-devel] [PATCH pve-docs 2/2] sdn: add vxlan encryption notes Alexandre Derumier
0 siblings, 2 replies; 5+ messages in thread
From: Alexandre Derumier @ 2021-09-06 3:57 UTC (permalink / raw)
To: pve-devel
add new evpn options && notes on vxlan encryption
Alexandre Derumier (2):
pvesdn: add evpn Advertise Subnets && Exit Nodes Local routing options
sdn: add vxlan encryption notes
pvesdn.adoc | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 61 insertions(+)
--
2.30.2
^ permalink raw reply [flat|nested] 5+ messages in thread
* [pve-devel] [PATCH pve-docs 1/2] pvesdn: add evpn Advertise Subnets && Exit Nodes Local routing options
2021-09-06 3:57 [pve-devel] [PATCH pve-docs 0/2] sdn: evpn && vxlan improvments Alexandre Derumier
@ 2021-09-06 3:57 ` Alexandre Derumier
2021-09-10 12:56 ` [pve-devel] applied: " Thomas Lamprecht
2021-09-06 3:57 ` [pve-devel] [PATCH pve-docs 2/2] sdn: add vxlan encryption notes Alexandre Derumier
1 sibling, 1 reply; 5+ messages in thread
From: Alexandre Derumier @ 2021-09-06 3:57 UTC (permalink / raw)
To: pve-devel
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
pvesdn.adoc | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/pvesdn.adoc b/pvesdn.adoc
index 3b3fd8f..d26c6b9 100644
--- a/pvesdn.adoc
+++ b/pvesdn.adoc
@@ -233,6 +233,15 @@ Exit Nodes:: This is used if you want to define some proxmox nodes, as exit
gateway from evpn network through real network. The configured nodes will
announce a default route in the EVPN network.
+Advertise Subnets:: Optional. If you have silent vms/CT (for example, multiples
+ ips by interfaces, and the anycast gateway don't see traffic from theses ips,
+ the ips addresses won't be able to be reach inside the evpn network). This
+ option will announce the full subnet in the evpn network in this case.
+
+Exit Nodes local routing:: Optional. This is a special option if you need to
+ reach a vm/ct service from an exit node. (By default, the exit nodes only
+ allow forwarding traffic between real network and evpn network).
+
MTU:: because VXLAN encapsulation use 50 bytes, the MTU needs to be 50 bytes
lower than the maximal MTU of the outgoing physical interface.
--
2.30.2
^ permalink raw reply [flat|nested] 5+ messages in thread
* [pve-devel] [PATCH pve-docs 2/2] sdn: add vxlan encryption notes
2021-09-06 3:57 [pve-devel] [PATCH pve-docs 0/2] sdn: evpn && vxlan improvments Alexandre Derumier
2021-09-06 3:57 ` [pve-devel] [PATCH pve-docs 1/2] pvesdn: add evpn Advertise Subnets && Exit Nodes Local routing options Alexandre Derumier
@ 2021-09-06 3:57 ` Alexandre Derumier
2021-09-10 13:01 ` [pve-devel] applied: " Thomas Lamprecht
1 sibling, 1 reply; 5+ messages in thread
From: Alexandre Derumier @ 2021-09-06 3:57 UTC (permalink / raw)
To: pve-devel
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
pvesdn.adoc | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 52 insertions(+)
diff --git a/pvesdn.adoc b/pvesdn.adoc
index d26c6b9..eae47ad 100644
--- a/pvesdn.adoc
+++ b/pvesdn.adoc
@@ -898,3 +898,55 @@ public network can reply back.
If you have configured an external BGP router, the BGP-EVPN routes (10.0.1.0/24
and 10.0.2.0/24 in this example), will be announced dynamically.
+
+
+Notes
+-----
+
+Vxlan Encryption
+~~~~~~~~~~~~~~~~
+If you need to add encryption on top of vxlan, it's possible to do it with strongswan software.
+You'll need to reduce the mtu around 60bytes (ipv4) or 80bytes (ipv6) to handle encryption.
+
+So with default 1500 mtu, you need mtu 1370 (1370 + 80bytes ipsec + 50 bytes vxlan).
+
+
+Install strongwan
+----
+apt install strongwan
+----
+
+Add configuration in /etc/ipsec.conf.
+(Encrypt only vxlan udp port 4789)
+
+----
+conn %default
+ ike=aes256-sha1-modp1024! #the fastest (but reasonably secure)cipher on reasonably modern hardware
+ esp=aes256-sha1!
+ leftfirewall=yes # this is necessary when using Proxmox firewall rules
+
+conn output
+ rightsubnet=%dynamic[udp/4789]
+ right=%any
+ type=transport
+ authby=psk
+ auto=route
+
+conn input
+ leftsubnet=%dynamic[udp/4789]
+ type=transport
+ authby=psk
+ auto=route
+----
+
+Then generate a preshared key with
+
+----
+openssl rand -base64 128
+----
+
+and copy the key in /etc/ipsec.secrets
+
+----
+: PSK <generatedbase64key>
+----
--
2.30.2
^ permalink raw reply [flat|nested] 5+ messages in thread
* [pve-devel] applied: [PATCH pve-docs 1/2] pvesdn: add evpn Advertise Subnets && Exit Nodes Local routing options
2021-09-06 3:57 ` [pve-devel] [PATCH pve-docs 1/2] pvesdn: add evpn Advertise Subnets && Exit Nodes Local routing options Alexandre Derumier
@ 2021-09-10 12:56 ` Thomas Lamprecht
0 siblings, 0 replies; 5+ messages in thread
From: Thomas Lamprecht @ 2021-09-10 12:56 UTC (permalink / raw)
To: Proxmox VE development discussion, Alexandre Derumier
On 06.09.21 05:57, Alexandre Derumier wrote:
> Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
> ---
> pvesdn.adoc | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
>
applied, thanks!
^ permalink raw reply [flat|nested] 5+ messages in thread
* [pve-devel] applied: [PATCH pve-docs 2/2] sdn: add vxlan encryption notes
2021-09-06 3:57 ` [pve-devel] [PATCH pve-docs 2/2] sdn: add vxlan encryption notes Alexandre Derumier
@ 2021-09-10 13:01 ` Thomas Lamprecht
0 siblings, 0 replies; 5+ messages in thread
From: Thomas Lamprecht @ 2021-09-10 13:01 UTC (permalink / raw)
To: Proxmox VE development discussion, Alexandre Derumier
On 06.09.21 05:57, Alexandre Derumier wrote:
> ...
> +So with default 1500 mtu, you need mtu 1370 (1370 + 80bytes ipsec + 50 bytes vxlan).
> +
> +
> +Install strongwan
typo strongwan vs. strongswan (missing s).
> +----
> +apt install strongwan
same typo
applied with above typos fixed and some wording/format fixes in general, thanks!
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-09-10 13:02 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-06 3:57 [pve-devel] [PATCH pve-docs 0/2] sdn: evpn && vxlan improvments Alexandre Derumier
2021-09-06 3:57 ` [pve-devel] [PATCH pve-docs 1/2] pvesdn: add evpn Advertise Subnets && Exit Nodes Local routing options Alexandre Derumier
2021-09-10 12:56 ` [pve-devel] applied: " Thomas Lamprecht
2021-09-06 3:57 ` [pve-devel] [PATCH pve-docs 2/2] sdn: add vxlan encryption notes Alexandre Derumier
2021-09-10 13:01 ` [pve-devel] applied: " Thomas Lamprecht
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox