From: Hannes Laimer <h.laimer@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [PATCH pve-network v6 05/17] sdn: zones: take the VXLAN and EVPN MTU from the underlay interface
Date: Thu, 5 Nov 2026 11:03:04 +0100 [thread overview]
Message-ID: <20261105100316.449163-6-h.laimer@proxmox.com> (raw)
In-Reply-To: <20261105100316.449163-1-h.laimer@proxmox.com>
The MTU of a VXLAN or EVPN zone without its own setting is the MTU of
the interface that reaches its peers, minus the 50 bytes of VXLAN
encapsulation. The lookup read that interface one level too high in
the parsed network configuration and never found it. So the vnets
always got the default of 1450.
A zone whose underlay interface has an MTU set gets that MTU minus the
encapsulation at its next apply, such as 8950 on a 9000 byte underlay.
Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
Notes:
v5:
* new
src/PVE/Network/SDN/Zones/EvpnPlugin.pm | 8 ++--
src/PVE/Network/SDN/Zones/VxlanPlugin.pm | 18 +++++---
.../underlay_mtu/expected_controller_config | 44 +++++++++++++++++++
.../evpn/underlay_mtu/expected_sdn_interfaces | 42 ++++++++++++++++++
src/test/zones/evpn/underlay_mtu/interfaces | 8 ++++
src/test/zones/evpn/underlay_mtu/sdn_config | 26 +++++++++++
.../underlay_mtu/expected_sdn_interfaces | 16 +++++++
src/test/zones/vxlan/underlay_mtu/interfaces | 8 ++++
src/test/zones/vxlan/underlay_mtu/sdn_config | 11 +++++
9 files changed, 171 insertions(+), 10 deletions(-)
create mode 100644 src/test/zones/evpn/underlay_mtu/expected_controller_config
create mode 100644 src/test/zones/evpn/underlay_mtu/expected_sdn_interfaces
create mode 100644 src/test/zones/evpn/underlay_mtu/interfaces
create mode 100644 src/test/zones/evpn/underlay_mtu/sdn_config
create mode 100644 src/test/zones/vxlan/underlay_mtu/expected_sdn_interfaces
create mode 100644 src/test/zones/vxlan/underlay_mtu/interfaces
create mode 100644 src/test/zones/vxlan/underlay_mtu/sdn_config
diff --git a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
index c31b6c6a2bfd..1720e1ff5735 100644
--- a/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/EvpnPlugin.pm
@@ -218,11 +218,9 @@ sub generate_sdn_config {
my $is_evpn_gateway = $plugin_config->{'exitnodes'}->{$local_node};
my $exitnodes_local_routing = $plugin_config->{'exitnodes-local-routing'};
- my $mtu = 1450;
- if ($iface) {
- $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
- }
- $mtu = $plugin_config->{mtu} if $plugin_config->{mtu};
+ my $mtu = PVE::Network::SDN::Zones::VxlanPlugin::vxlan_mtu(
+ $plugin_config, $iface, $interfaces_config,
+ );
#vxlan interface
my $vxlan_iface = "vxlan_$vnetid";
diff --git a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm
index b8b1ef0eeb7f..4992757c1c5b 100644
--- a/src/PVE/Network/SDN/Zones/VxlanPlugin.pm
+++ b/src/PVE/Network/SDN/Zones/VxlanPlugin.pm
@@ -48,6 +48,18 @@ sub properties {
};
}
+# the vnet bridge takes the underlay interface's MTU minus the vxlan
+# encapsulation where the peers name a local interface, the default
+# otherwise. An explicit zone MTU wins
+sub vxlan_mtu {
+ my ($plugin_config, $iface, $interfaces_config) = @_;
+
+ return $plugin_config->{mtu} if $plugin_config->{mtu};
+ return $interfaces_config->{ifaces}->{$iface}->{mtu} - 50
+ if $iface && $interfaces_config->{ifaces}->{$iface}->{mtu};
+ return 1450;
+}
+
sub options {
return {
nodes => { optional => 1 },
@@ -120,11 +132,7 @@ sub generate_sdn_config {
die "neither peers nor fabric configured for VXLAN zone $plugin_config->{id}";
}
- my $mtu = 1450;
- if ($iface) {
- $mtu = $interfaces_config->{$iface}->{mtu} - 50 if $interfaces_config->{$iface}->{mtu};
- }
- $mtu = $plugin_config->{mtu} if $plugin_config->{mtu};
+ my $mtu = vxlan_mtu($plugin_config, $iface, $interfaces_config);
#vxlan interface
my @iface_config = ();
diff --git a/src/test/zones/evpn/underlay_mtu/expected_controller_config b/src/test/zones/evpn/underlay_mtu/expected_controller_config
new file mode 100644
index 000000000000..0c6cc0939d15
--- /dev/null
+++ b/src/test/zones/evpn/underlay_mtu/expected_controller_config
@@ -0,0 +1,44 @@
+frr version 10.6.1
+frr defaults datacenter
+hostname localhost
+log syslog informational
+service integrated-vtysh-config
+!
+vrf vrf_myzone
+ vni 1000
+exit-vrf
+!
+router bgp 65000
+ bgp router-id 192.168.0.1
+ no bgp hard-administrative-reset
+ no bgp default ipv4-unicast
+ coalesce-time 1000
+ no bgp graceful-restart notification
+ neighbor VTEP peer-group
+ neighbor VTEP remote-as 65000
+ neighbor VTEP bfd
+ neighbor 192.168.0.2 peer-group VTEP
+ neighbor 192.168.0.3 peer-group VTEP
+ !
+ address-family l2vpn evpn
+ neighbor VTEP activate
+ neighbor VTEP route-map MAP_VTEP_IN in
+ neighbor VTEP route-map MAP_VTEP_OUT out
+ advertise-all-vni
+ exit-address-family
+exit
+!
+router bgp 65000 vrf vrf_myzone
+ bgp router-id 192.168.0.1
+ no bgp hard-administrative-reset
+ no bgp graceful-restart notification
+exit
+!
+route-map MAP_VTEP_IN permit 1
+exit
+!
+route-map MAP_VTEP_OUT permit 1
+exit
+!
+line vty
+!
diff --git a/src/test/zones/evpn/underlay_mtu/expected_sdn_interfaces b/src/test/zones/evpn/underlay_mtu/expected_sdn_interfaces
new file mode 100644
index 000000000000..66d6c3d40a08
--- /dev/null
+++ b/src/test/zones/evpn/underlay_mtu/expected_sdn_interfaces
@@ -0,0 +1,42 @@
+#version:1
+
+auto myvnet
+iface myvnet
+ address 10.0.0.1/24
+ hwaddress A2:1D:CB:1A:C0:8B
+ bridge_ports vxlan_myvnet
+ bridge_stp off
+ bridge_fd 0
+ mtu 8950
+ ip-forward on
+ arp-accept on
+ vrf vrf_myzone
+
+auto vrf_myzone
+iface vrf_myzone
+ vrf-table auto
+ post-up ip route add vrf vrf_myzone unreachable default metric 4278198272
+
+auto vrfbr_myzone
+iface vrfbr_myzone
+ bridge-ports vrfvx_myzone
+ bridge_stp off
+ bridge_fd 0
+ mtu 8950
+ vrf vrf_myzone
+
+auto vrfvx_myzone
+iface vrfvx_myzone
+ vxlan-id 1000
+ vxlan-local-tunnelip 192.168.0.1
+ bridge-learning off
+ bridge-arp-nd-suppress on
+ mtu 8950
+
+auto vxlan_myvnet
+iface vxlan_myvnet
+ vxlan-id 100
+ vxlan-local-tunnelip 192.168.0.1
+ bridge-learning off
+ bridge-arp-nd-suppress on
+ mtu 8950
diff --git a/src/test/zones/evpn/underlay_mtu/interfaces b/src/test/zones/evpn/underlay_mtu/interfaces
new file mode 100644
index 000000000000..c32f92e1a7fc
--- /dev/null
+++ b/src/test/zones/evpn/underlay_mtu/interfaces
@@ -0,0 +1,8 @@
+auto vmbr0
+iface vmbr0 inet static
+ address 192.168.0.1/24
+ gateway 192.168.0.254
+ mtu 9000
+ bridge-ports eth0
+ bridge-stp off
+ bridge-fd 0
diff --git a/src/test/zones/evpn/underlay_mtu/sdn_config b/src/test/zones/evpn/underlay_mtu/sdn_config
new file mode 100644
index 000000000000..dd73b5cdc140
--- /dev/null
+++ b/src/test/zones/evpn/underlay_mtu/sdn_config
@@ -0,0 +1,26 @@
+{
+ version => 1,
+ vnets => {
+ ids => {
+ myvnet => { tag => "100", type => "vnet", zone => "myzone" },
+ },
+ },
+
+ zones => {
+ ids => { myzone => { ipam => "pve", type => "evpn", controller => "evpnctl", 'vrf-vxlan' => 1000, 'mac' => 'A2:1D:CB:1A:C0:8B' } },
+ },
+ controllers => {
+ ids => { evpnctl => { type => "evpn", 'peers' => '192.168.0.1,192.168.0.2,192.168.0.3', asn => "65000" } },
+ },
+
+ subnets => {
+ ids => { 'myzone-10.0.0.0-24' => {
+ 'type' => 'subnet',
+ 'vnet' => 'myvnet',
+ 'gateway' => '10.0.0.1',
+ }
+ }
+ }
+}
+
+
diff --git a/src/test/zones/vxlan/underlay_mtu/expected_sdn_interfaces b/src/test/zones/vxlan/underlay_mtu/expected_sdn_interfaces
new file mode 100644
index 000000000000..425021084781
--- /dev/null
+++ b/src/test/zones/vxlan/underlay_mtu/expected_sdn_interfaces
@@ -0,0 +1,16 @@
+#version:1
+
+auto myvnet
+iface myvnet
+ bridge_ports vxlan_myvnet
+ bridge_stp off
+ bridge_fd 0
+ mtu 8950
+
+auto vxlan_myvnet
+iface vxlan_myvnet
+ vxlan-id 100
+ vxlan-local-tunnelip 192.168.0.1
+ vxlan_remoteip 192.168.0.2
+ vxlan_remoteip 192.168.0.3
+ mtu 8950
diff --git a/src/test/zones/vxlan/underlay_mtu/interfaces b/src/test/zones/vxlan/underlay_mtu/interfaces
new file mode 100644
index 000000000000..c32f92e1a7fc
--- /dev/null
+++ b/src/test/zones/vxlan/underlay_mtu/interfaces
@@ -0,0 +1,8 @@
+auto vmbr0
+iface vmbr0 inet static
+ address 192.168.0.1/24
+ gateway 192.168.0.254
+ mtu 9000
+ bridge-ports eth0
+ bridge-stp off
+ bridge-fd 0
diff --git a/src/test/zones/vxlan/underlay_mtu/sdn_config b/src/test/zones/vxlan/underlay_mtu/sdn_config
new file mode 100644
index 000000000000..f929304206c9
--- /dev/null
+++ b/src/test/zones/vxlan/underlay_mtu/sdn_config
@@ -0,0 +1,11 @@
+{
+ version => 1,
+ vnets => {
+ ids => {
+ myvnet => { tag => 100, type => "vnet", zone => "myzone" },
+ },
+ },
+ zones => {
+ ids => { myzone => { ipam => "pve", type => "vxlan", peers => "192.168.0.1,192.168.0.2,192.168.0.3" } },
+ },
+}
--
2.47.3
next prev parent reply other threads:[~2026-11-05 10:05 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-05 10:02 [PATCH container/docs/manager/network/proxmox{,-perl-rs,-ve-rs}/qemu-server v6 00/17] sdn: implement DHCP for all zones using eBPF Hannes Laimer
2026-11-05 10:03 ` [PATCH proxmox v6 01/17] network-types: mac address: add an accessor for the bytes Hannes Laimer
2026-11-05 10:03 ` [PATCH proxmox v6 02/17] ebpf: dhcp: add the per-tap DHCPv4 responder program Hannes Laimer
2026-11-05 10:03 ` [PATCH proxmox v6 03/17] ebpf: dhcp: add the subsystem that loads the responder and keeps its records Hannes Laimer
2026-11-05 10:03 ` [PATCH proxmox-perl-rs v6 04/17] pve-rs: sdn: add bindings for the eBPF DHCP responder Hannes Laimer
2026-11-05 10:03 ` Hannes Laimer [this message]
2026-11-05 10:03 ` [PATCH pve-network v6 06/17] sdn: dhcp: make the lease time configurable per subnet Hannes Laimer
2026-11-05 10:03 ` [PATCH pve-network v6 07/17] sdn: dhcp: require a backend only if a zone on this node uses it Hannes Laimer
2026-11-05 10:03 ` [PATCH pve-network v6 08/17] sdn: dhcp: add an eBPF backend answering on each guest interface Hannes Laimer
2026-11-05 10:03 ` [PATCH pve-network v6 09/17] sdn: zones: report interface plugs and unplugs to the DHCP backends Hannes Laimer
2026-11-05 10:03 ` [PATCH pve-network v6 10/17] sdn: zones: allow the ebpf DHCP backend on every zone type Hannes Laimer
2026-11-05 10:03 ` [PATCH qemu-server v6 11/17] network: sdn: keep the DHCP backends current on guest NICs Hannes Laimer
2026-11-05 10:03 ` [PATCH pve-container v6 12/17] net: report NIC plugs and removals to the SDN DHCP backends Hannes Laimer
2026-11-05 10:03 ` [PATCH pve-manager v6 13/17] ui: sdn: add zone DHCP backend selector and subnet DHCP options Hannes Laimer
2026-11-05 10:03 ` [PATCH pve-manager v6 14/17] sdn: bring up the DHCP backends at boot before the guests start Hannes Laimer
2026-11-05 10:03 ` [PATCH proxmox-ve-rs v6 15/17] ve-config: sdn: add the ebpf dhcp backend Hannes Laimer
2026-11-05 10:03 ` [PATCH pve-docs v6 16/17] sdn: zones: document the MTU taken from the underlay interface Hannes Laimer
2026-11-05 10:03 ` [PATCH pve-docs v6 17/17] sdn: dhcp: add eBPF backend section Hannes Laimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261105100316.449163-6-h.laimer@proxmox.com \
--to=h.laimer@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox