tagged VLAN bridge + untagged VLAN bridge on one interface?

[Dunuin]

Hi,

I am using Freenas 11.3U4.1 and I got 3 NICs:
em0 (Gbit)
igb0 (Gbit)
mlxen0 (10G)

Both em0 and mlxen0 are connected to a managed switch where the ports are a in "trunk mode" so they send/recieve tagged packets for VLAN ID 2,3,41,42,43,44,45,46,47 and 48. I don't want to use LACP with 1G+10G because I heard that would slow down the connection. So I want to create a bond "lagg0" with em0 and mlxen0 as slaves in in "failover" mode. So always the fast mlxen0 is used except it dies and in that case em0 should be used. I've read the FreeBSD documentation and the primary NIC for that bond will be the first interface you assign. But I wasn't able to find a option in the GUI to order the slaves. I can only select em0 + mlxen0 in the dropdown menu but that way em0 is first and not mlxen0. I then thought I could leave the "lagg interfaces"-field empty and assign them manually through the "options"-field but that way the GUI doesn't allow me to create that bond.
Am I right that I need to manually create the bond using RC tunables?
And if yes, would this be right?

Code:

ifconfig_em0="up"
ifconfig_mlxen0="up"
cloned_interfaces="lagg0"
ifconfig_lagg0="laggproto failover laggport mlxen0 laggport em0"

Another problem is that I need FreeNAS itself listen on different IPs on different VLANs:
1.) FTP accessible on IP 192.168.41.4 VLAN 41
2.) SMB+WebGUI accessible on IP 192.168.43.10 VLAN 43
3.) SMB+NFS accessible on IP 192.168.45.4 VLAN 45
4.) SMB accessible on IP 192.168.48.4 VLAN 48

That is working fine if I create these vlan interfaces:
vlan41 with IP=192.168.41.4, VLAN Tag=41, Parent Interface=mlxen0
vlan44 with IP=192.168.43.10, VLAN Tag=43, Parent Interface=mlxen0
vlan45 with IP=192.168.45.4, VLAN Tag=45, Parent Interface=mlxen0
vlan48 with IP=192.168.48.4, VLAN Tag=48, Parent Interface=mlxen0

That way I can bind the FreeNAS services to the IPs of the vlan interfaces and everything is sent tagged through the trunk to the switch where other hosts can access the services.

But now I got a problem because I want to virtualize a OPNsense-VM and that VM needs an virtio NIC bridged to the mlxen0 itself so it can send and recieve tagged packets and do the routing between all 10 subnets. But if there is any vlan interface (like my "vlan41" and so on) assigned to mlxen0, then I am not allowed to create a new bridge, bridging that mlxen0.
Is there any way to solve this without creating 10 vlan interfaces, 10 bridges bridged to these vlan interfaces and 10 virtio NICs assigned to these 10 bridges?
I'm sure I will add more vlan later on and it seems not to be the best idea to use 10 or more untagged virtio interfaces if only one tagged virtio interface would do the job too.

Edit:
I tried it with the 4 tunables but no "lagg0" was created after reboot.

Edit:
I think I found a workaround for the "lagg0". If I create it using the GUI with only "mlxen0" as interface and "laggport em0" as options ifconfig show me that lagg0 is up and running with mlxen0 as "Master/Active" and em0 without flags.

So still the problem with that vlan aware bridge.

 

[jgreco]

You are a bit confused. There is no difference between a "trunk", "bond", and a "LAG", although various people try to define the terms as various things (for example, some people define "trunk" as a circuit that carries vlans, or a trunk might be an LACP of two or more ethernets). But in general these are all the same thing, a lagg virtual interface with one or more underlying physical interfaces. A lagg can be configured failover, LACP, or a few other things if you create them manually. Things like vlans are layered on top of the lagg virtual interface.

Please note that it is strongly recommended that you use only ethernet devices of the same driver type and speed when configuring a lagg virtual interface. While other configurations are theoretically supposed to work, the real world experience of many forum users is that it doesn't work well. There are almost certainly counterexamples too, of course.

As far as I know, the virtual switch support on FreeBSD does not handle vlan tags. If you want to do this, you will probably need to do what you suggest, or see if you can pass through an ethernet interface directly to your VM.