Mangement network does not use defined vlan

[Sparc0]

I have a fresh installed Cloudstack 4.22.
Trying to setup my traffic types so that my SSVM's starts.
I am able to reach both SSVM on the public IP.
But unable to reach them on the mangement ip's. I have defined a vlan tag 3006 to the mangement range that does not seem to be used at all.

Looking at the XML and interfaces created on my physical host i can see that the public ip interface gets a vlan enabled interface created.
But for the mangement one(eth1) its just gets added to my cloudbr0 with no vlan defined.

So when i doing tcpdump -i eth1 -n on my ssvm i see the untagged network configured to my physical host which is the incorrect network.
And if i do tcpdump -i eth1 -n -e vlan i can see the traffic from other hosts in that mgmt network so it seems that cloudstack does not use the vlan tag i defined under mangement network range.

[NuxRo]

That's worrying. Can you set up the log levels in mgmt and hypervisor to DEBUG and try to recreate the problem and attach the logs?

[Sparc0]

I am a bit reluctant to share to much logs without doing a proper cleanup of them first. I will share a few lines i was able to find myself below. If thats not enough i will cleanup the logs.

Found this when it creates the vlan interfaces for my public network

2026-01-26 17:59:23,524 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-5:[]) (logid:d42c5695) nic=[Nic:Management-10.100.100.49-vlan://3006]
2026-01-26 17:59:23,524 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-5:[]) (logid:d42c5695) nic=[Nic:Public-100.10.10.253-vlan://214]
2026-01-26 17:59:23,524 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-5:[]) (logid:d42c5695) creating a vNet dev and bridge for public traffic per traffic label cloudbr0
2026-01-26 17:59:23,525 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-5:[]) (logid:d42c5695) Executing command [/usr/share/cloudstack-common/scripts/vm/network/vnet/modifyvlan.sh -v 214 -p bond0 -b brbond0-214 -o add ].
2026-01-26 17:59:23,581 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-5:[]) (logid:d42c5695) Successfully executed process [2763106] for command [/usr/share/cloudstack-common/scripts/vm/network/vnet/modifyvlan.sh -v 214 -p bond0 -b brbond0-214 -o add ]

I found that when it creates the instance the nic mapped to eth1 sets to "broadcastType": "Native" while the other nic for eth2 is "broadcastType": "Vlan".

[
  {
    "com.cloud.agent.api.StartAnswer": {
      "vm": {
        "id": "8327",
        "name": "s-8327-VM",
        "state": "Starting",
        "type": "SecondaryStorageVm",
        "cpus": "1",
        "minSpeed": "500",
        "maxSpeed": "500",
        "minRam": "(512.00 MB) 536870912",
        "maxRam": "(512.00 MB) 536870912",
        "arch": "x86_64",
        "os": "Debian GNU/Linux 12 (64-bit)",
        "platformEmulator": "Debian GNU/Linux 12 (64-bit)",
        "bootArgs": " template=domP type=secstorage host=redacted port=8250 name=s-8327-VM zone=1 pod=1 guid=s-8327-VM workers=5 authorized_key=ZWNkc2Etc2hhMi1uaXN0cDI1NiBBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQ,
resource=com.cloud.storage.resource.PremiumSecondaryStorageResource instance=SecStorage sslcopy=false role=templateProcessor mtu=1500 eth2ip=redacted eth2mask=255.255.255.128 gateway=redacted public.network.device=eth2 eth0ip=169.254.176.240 eth0mask=255.255.0.0 eth1ip=redacted eth1mask=255.255.255.224 mgmtcidr=redacted /25 localgw=redacted private.network.device=eth1 internaldns1=redacted internaldns2=redacted dns1=redacted dns2=redacted ",
        "enableHA": "false",
        "limitCpuUse": "false",
        "enableDynamicallyScaleVm": "false",
        "vncAddr": "10.236.1.248",
        "details": {},
        "uuid": "8f0901ad-dd66-4656-8e33-3d2f23f8c8bc",
        "enterHardwareSetup": "false",
        "disks": [
          {
            "data": {
              "org.apache.cloudstack.storage.to.VolumeObjectTO": {
                "uuid": "f3d22203-bed4-408e-9a3e-0742706b79b1",
                "volumeType": "ROOT",
                "dataStore": {
                  "org.apache.cloudstack.storage.to.PrimaryDataStoreTO": {
                    "uuid": "fa992e2a-bb7f-37af-b3ba-c2e502bf9705",
                    "name": "cs_primary_replica3",
                    "id": "1",
                    "poolType": "RBD",
                    "host": "redacted ",
                    "path": "cs_primary_replica3",
                    "port": "0",
                    "url": "RBD://redacted /cs_primary_replica3/?ROLE=Primary&STOREUUID=fa992e2a-bb7f-37af-b3ba-c2e502bf9705",
                    "isManaged": "false"
                  }
                },
                "name": "ROOT-8327",
                "size": "(4.88 GB) 5242880000",
                "path": "f3d22203-bed4-408e-9a3e-0742706b79b1",
                "volumeId": "8211",
                "vmName": "s-8327-VM",
                "accountId": "1",
                "format": "RAW",
                "provisioningType": "THIN",
                "poolId": "1",
                "id": "8211",
                "deviceId": "0",
                "bytesReadRate": "(0 bytes) 0",
                "bytesWriteRate": "(0 bytes) 0",
                "iopsReadRate": "(0 bytes) 0",
                "iopsWriteRate": "(0 bytes) 0",
                "hypervisorType": "KVM",
                "directDownload": "false",
                "deployAsIs": "false",
                "checkpointPaths": [],
                "checkpointImageStoreUrls": [],
                "followRedirects": "false"
              }
            },
            "diskSeq": "0",
            "path": "f3d22203-bed4-408e-9a3e-0742706b79b1",
            "type": "ROOT",
            "details": {
              "storageHost": "redacted ",
              "managed": "false",
              "storagePort": "0",
              "protocoltype": "RBD",
              "storage.pool.disk.wait": "60",
              "volumeSize": "(4.88 GB) 5242880000"
            }
          }
        ],
        "nics": [
          {
            "deviceId": "2",
            "networkRateMbps": "-1",
            "defaultNic": "true",
            "pxeDisable": "true",
            "nicUuid": "228954a9-c63b-4e81-bf16-8843b6962897",
            "details": {
              "PromiscuousMode": "false",
              "MacAddressChanges": "true",
              "ForgedTransmits": "true",
              "MacLearning": "false"
            },
            "dpdkEnabled": "false",
            "networkId": "200",
            "networkSegmentName": "D1-A1-Z1-S200",
            "uuid": "0e7127d6-87b2-4bff-b1f4-0dba7351a5a1",
            "ip": "redacted ",
            "netmask": "255.255.255.128",
            "gateway": "redacted ",
            "mac": "1e:00:f3:00:00:1d",
            "dns1": "redacted ",
            "dns2": "redacted ",
            "broadcastType": "Vlan",
            "type": "Public",
            "broadcastUri": "vlan://214",
            "isolationUri": "vlan://214",
            "securityGroupEnabled": "false",
            "name": "cloudbr0"
          },
          {
            "deviceId": "0",
            "networkRateMbps": "-1",
            "defaultNic": "false",
            "pxeDisable": "true",
            "nicUuid": "b296f915-1d2c-49f7-a876-aad69fb8ceaf",
            "details": {
              "PromiscuousMode": "false",
              "MacAddressChanges": "true",
              "ForgedTransmits": "true",
              "MacLearning": "false"
            },
            "dpdkEnabled": "false",
            "networkId": "202",
            "networkSegmentName": "D1-A1-Z1-S202",
            "uuid": "c49eb44c-96d0-47d1-9794-5a0500d63bdb",
            "ip": "169.254.176.240",
            "netmask": "255.255.0.0",
            "gateway": "169.254.0.1",
            "mac": "0e:00:a9:fe:b0:f0",
            "broadcastType": "LinkLocal",
            "type": "Control",
            "securityGroupEnabled": "false"
          },
          {
            "deviceId": "1",
            "networkRateMbps": "-1",
            "defaultNic": "false",
            "pxeDisable": "true",
            "nicUuid": "12ea2287-e8bd-47df-a02e-a544c36c6bbe",
            "details": {
              "PromiscuousMode": "false",
              "MacAddressChanges": "true",
              "ForgedTransmits": "true",
              "MacLearning": "false"
            },
            "dpdkEnabled": "false",
            "networkId": "201",
            "networkSegmentName": "D1-A1-Z1-S201",
            "uuid": "347f6355-aba8-42e9-a3bc-327b6b21e6c9",
            "ip": "redacted ",
            "netmask": "255.255.255.224",
            "gateway": "redacted ",
            "mac": "1e:00:04:00:00:2e",
            "broadcastType": "Native",
            "type": "Management",
            "broadcastUri": "vlan://3006",
            "securityGroupEnabled": "false",
            "name": "cloudbr0"
          }
        ],
        "vcpuMaxLimit": "1",
        "configDriveLocation": "SECONDARY",
        "guestOsDetails": {},
        "extraConfig": {},
        "networkIdToNetworkNameMap": {},
        "metadataManufacturer": "Apache Software Foundation",
        "metadataProductName": "CloudStack KVM Hypervisor"
      },
      "result": "true",
      "wait": "0",
      "bypassHostMaintenance": "false"
    }
  },
  {
    "com.cloud.agent.api.check.CheckSshAnswer": {
      "result": "true",
      "wait": "0",
      "bypassHostMaintenance": "false"
    }
  }
]

[Sparc0]

I tried to add a storage network and that one also takes vlan into consideration and creates the necessary interfaces to bind the VM correctly.

2026-01-26 19:25:23,072 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-2:[]) (logid:d42c5695) nic=[Nic:Management-10.139.62.58-vlan://3006]
2026-01-26 19:25:23,072 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-2:[]) (logid:d42c5695) nic=[Nic:Public-100.87.170.253-vlan://214]
2026-01-26 19:25:23,072 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-2:[]) (logid:d42c5695) creating a vNet dev and bridge for public traffic per traffic label cloudbr0
2026-01-26 19:25:23,072 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-2:[]) (logid:d42c5695) Executing command [/usr/share/cloudstack-common/scripts/vm/network/vnet/modifyvlan.sh -v 214 -p bond0 -b brbond0-214 -o add ].
2026-01-26 19:25:23,121 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-2:[]) (logid:d42c5695) Successfully executed process [2799451] for command [/usr/share/cloudstack-common/scripts/vm/network/vnet/modifyvlan.sh -v 214 -p bond0 -b brbond0-214 -o add ].
2026-01-26 19:25:23,122 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-2:[]) (logid:d42c5695) nic=[Nic:Storage-10.139.62.38-storage://3006]
2026-01-26 19:25:23,122 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-2:[]) (logid:d42c5695) creating a vNet dev and bridge for Storage traffic per traffic label cloudbr0
2026-01-26 19:25:23,122 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-2:[]) (logid:d42c5695) Executing command [/usr/share/cloudstack-common/scripts/vm/network/vnet/modifyvlan.sh -v 3006 -p bond0 -b brbond0-3006 -o add ].
2026-01-26 19:25:23,176 DEBUG [kvm.resource.BridgeVifDriver] (AgentRequest-Handler-2:[]) (logid:d42c5695) Successfully executed process [2799469] for command [/usr/share/cloudstack-common/scripts/vm/network/vnet/modifyvlan.sh -v 3006 -p bond0 -b brbond0-3006 -o add ].

[Sparc0]

I was able to make it work by creating the bridge myself and connected my mangement vlan interface to it so it became untagged inside the bridge.
Then changed the mangement networks kvmnetworklabel to that bridge instead of using cloudbr0 as i use for public/storage and guest traffic.

So why don't the management traffic take the vlan into consideration and setup the bridge/interfaces the same way as public/guest/storage traffic?

[rajujith]

I am assuming it never supported management VLAN configuration by CloudStack; your current approach looks good. We may have to support VLAN being passed with https://cloudstack.apache.org/api/apidocs-4.22/apis/createPod.html and also configure it like the storage VLAN. #7816.