SDN lab: two zones with routing

This lab configures the built-in SDN module and demonstrates inter-VNET routing through the SDN-managed gateway.

Steps

1. Enable the SDN module

In the GUI: Datacenter → SDN → Zones.

Or via CLI on a cluster node:

# Verify the SDN packages are installed
dpkg -l | grep pve-manager
# The SDN module ships with pve-manager

2. Create a Simple zone

pvesh create /sdn/zones --zone eng-zone --type simple \
  --bridge vmbr0 --mtu 1500

3. Add VNETs

pvesh create /sdn/vnets --vnet engineering --zone eng-zone \
  --tag 100 --alias "Engineering VNet"
pvesh create /sdn/vnets --vnet marketing --zone eng-zone \
  --tag 200 --alias "Marketing VNet"

4. Configure the SDN controller and apply

pvesh set /sdn/controllers/local
pvesh set /sdn/apply --enable 1

Verify the bridge now has the VLAN sub-interfaces:

ip link show vmbr0
# Expected: vnet100 and vnet200 as VLAN sub-interfaces

5. Create test VMs on each VNET

qm create 903 --name eng-vm --memory 1024 --cores 1 \
  --net0 virtio,bridge=vmbr0,tag=100 --ostype l26 \
  --ipconfig0 ip=10.100.1.50/24,gw=10.100.1.1
qm create 904 --name mkt-vm --memory 1024 --cores 1 \
  --net0 virtio,bridge=vmbr0,tag=200 --ostype l26 \
  --ipconfig0 ip=10.200.1.50/24,gw=10.200.1.1
qm start 903 && qm start 904

6. Verify routing

# From eng-vm
ping -c 3 10.200.1.50   # Should reach mkt-vm via the SDN gateway

7. Add a QinQ zone

QinQ (802.1ad) stacks a customer VLAN tag on top of a service VLAN tag, useful for multi-tenant scenarios where you do not control the upstream switch’s VLAN table.

pvesh create /sdn/zones --zone tenant-zone --type qinq \
  --bridge vmbr0 --mtu 1500 --service-vlan 1000
pvesh create /sdn/vnets --vnet tenant-a --zone tenant-zone \
  --tag 100 --alias "Tenant A"
pvesh apply

8. Verify QinQ

Create a VM on tenant-a:

qm create 905 --name tenant-vm --memory 1024 --cores 1 \
  --net0 virtio,bridge=vmbr0,tag=100,trunks=1000 --ostype l26
qm start 905

The outer switch sees VLAN 1000; the SDN sees VLAN 100 inside that.

Verification

pvesh get /sdn/zones lists both zones
eng-vm (VLAN 100) can ping mkt-vm (VLAN 200) via the gateway
tenant-vm is reachable on its inner VLAN from inside the QinQ service

Cleanup

qm stop 903 904 905
qm destroy 903 904 905
pvesh delete /sdn/vnets/engineering
pvesh delete /sdn/vnets/marketing
pvesh delete /sdn/vnets/tenant-a
pvesh delete /sdn/zones/eng-zone
pvesh delete /sdn/zones/tenant-zone
pvesh apply

Verification status

Executed end to end

not yet run on hardware

The commands and configuration here have been reviewed against the verified software versions, but nobody has run this lab start to finish on a system meeting its prerequisites. Treat the Expected Outcome as the intended result rather than an observed one, and keep the Cleanup section to hand.

Configure SDN with two zones and verify routing between them

Objectives

Prerequisites