OPNSense SR-IOV Passthrough or Full Device Passthrough?
Hey Everyone,
I'm interested in the theory/results of something. I have a proxmox host - hosting an opnsense VM. I already have a dedicated box for opnsense, but I'm looking to move to virtualization (I know, it's probably a poor idea, but I wanted HA Proxy as its own VM and I didn't want it having to route through the switch... but my question isn't about the validity of virtualization... like I said, it's probably a poor idea).
However, while building out... I realized "Hey, I can do SR-IOV and pass-through a virtual function to each of my VLANs instead of just passing through the whole physical device and putting all my VLANs onto the same MLXEN1 port)."
What would the benefits be of this? I tried gemini, but it seems to be thinking that I want to do SR-IOV vs. VMBR (which is not what I'm asking - I'm asking about passing through virtual functions vs. the physical device).
Anyone have feedback on this? Is there any security, speed, or latency gain here (management is an obvious decrease)... wouldn't, in theory, this be avoiding the software layer in opnsense as well by tying it to a nic that it thinks is a physical nic (SR-IOV) vs. it having to route multiple vlans thorugh the same device (port 2 of the device)?
Or... because I'm putting the VLAN on top of it anyway, it's already hitting the software layer and there's essentially no benefit?
Hoping someone with more and better knowledge can either get added to this conversation or direct me.