Linuxnetworking

Proxmox VE 9.2 SDN Fabric: Build + Verify

Build an OpenFabric/OSPF SDN fabric across Proxmox VE 9.2 nodes from the GUI, then verify the generated FRR routing config and route filtering with read-only commands.

DistrosProxmox VE 9.2
Shellbash
Updated
Script
bash
# Proxmox VE 9.2 SDN Fabric — GUI build steps + READ-ONLY verification.
# Full walkthrough: /articles/proxmox-92-sdn-fabric-wireguard
# The fabric itself is built in the GUI (Datacenter > SDN > Fabrics); the
# commands below only INSPECT the result, so they are safe to run as-is.

# --- Build (GUI: Datacenter > SDN) ---
#  1. Fabrics > Add Fabric > protocol OpenFabric (or OSPF); set router IDs +
#     loopback prefix.
#  2. Add each node (+), choose its fabric interfaces, give each a CIDR address.
#  3. Main SDN panel > Apply Configuration  (writes FRR on EVERY node).
#  For encrypted inter-node routing: a WireGuard fabric carries OSPF/BGP on top
#  (WireGuard encrypts; it does NOT route by itself).
#  Filtering: Prefix Lists + Route Maps (Datacenter > SDN) decide which
#  prefixes a controller advertises to peers.

# --- Verify (read-only; run on a node) ---
# Pending SDN config vs applied (should match after Apply):
pvesh get /cluster/sdn 2>/dev/null || true

# The generated FRR config Proxmox wrote for you:
cat /etc/frr/frr.conf

# Live routing state via FRR's shell (read-only 'show' commands):
vtysh -c 'show running-config' | sed -n '1,60p'
vtysh -c 'show ip route'                 # learned routes + best paths
vtysh -c 'show openfabric neighbor' 2>/dev/null || vtysh -c 'show ip ospf neighbor'

# Confirm the auto-created dummy loopback exists:
ip -br addr show type dummy

What this does

This is the build-and-verify companion to the Proxmox VE 9.2 SDN Fabrics post. The fabric is created in the web GUI (Datacenter → SDN → Fabrics); Proxmox then generates the FRR routing configuration on every participating node. The commands here only inspect the result — the generated config, the learned routes, neighbor state, and the auto-created loopback — so they’re safe to run on a node without changing anything.

The full walkthrough (OpenFabric vs OSPF vs WireGuard, route-maps, the Ceph use case) is in Proxmox VE 9.2 SDN Fabrics: Routed, Encrypted Networking.

Prerequisites

  • Proxmox VE 9.2 on the participating nodes (fabrics are a 9.2 feature).
  • More than one node, ideally with more than one link between them (a fabric on a single flat link buys you little).
  • An address plan for the fabric loopbacks and interfaces before you click Apply — the change is cluster-wide.

Notes

  • Honest status: this playbook is tested: false — the steps are sourced from the official Proxmox SDN documentation and the verification commands are standard read-only FRR/pvesh calls, but the fabric was not built on real hardware for this guide. Treat the inspection commands as safe and the build steps as doc-accurate; validate on your own lab before relying on it.
  • Make these values your own: use your real node names, interface names, and CIDR ranges. If a value looks specific to one machine, it’s a placeholder to change.
  • Apply is cluster-wide. Applying an SDN change regenerates /etc/frr/frr.conf on all participating nodes and reloads FRR — plan the address scheme up front.
  • WireGuard ≠ routing. A WireGuard fabric encrypts the transport; you still run OSPF or BGP on top to distribute routes.
  • Filter what you advertise. Use Prefix Lists + Route Maps (Datacenter → SDN) so management and Ceph storage prefixes aren’t advertised to guest-facing peers.
All playbooks