HOWTO: Bootstrap EVE-NG Network Simulation in VLAN 50¶

Purpose: Deploy an EVE-NG VM in the isolated validation VLAN (VLAN 50) so you can run routing, firewall, and WAN experiments without touching production traffic.

Difficulty: Intermediate Prerequisites: - VLAN 50 configured on Proxmox as per ADR‑0101 and ADR‑0201. - EVE-NG ISO/OVA downloaded and available to Proxmox. - At least 8–16 GB RAM and 4+ vCPUs free for the EVE-NG host.

1. Context¶

This HOWTO complements:

ADR-0101 – VLAN Allocation Strategy
ADR-0103 – Inter-VLAN Firewall Policy
ADR-0201 – EVE-NG Network Simulation Architecture

EVE-NG is positioned as parallel simulation infrastructure, not in the production data path:

VLAN 50 is fully isolated by default.
Optional VLAN trunks can be added for specific “hybrid” experiments.

2. Scope boundary¶

This HOWTO is for controlled validation and Academy work.

It does not define the live operator path for:

Hetzner edge bring-up
GCP hub routing
on-prem site extension
DR underlay control

For those paths, use:

3. Environment Assumptions¶

Item	Example value
VLAN ID	50
Subnet	10.50.0.0/24
Gateway (Proxmox)	10.50.0.1
EVE-NG VM IP	10.50.0.10
DNS	8.8.8.8 / 1.1.1.1

Proxmox has a bridge vmbr0.50 or equivalent for VLAN 50.
Management access is via jump host (e.g. in VLAN 10) with firewall rules allowing SSH/HTTPS into VLAN 50 for admin only (optional).

4. Create the EVE-NG VM in Proxmox¶

4.1 Upload ISO or QCOW2¶

Upload eve-ng-community-*.iso or a prepared QCOW2 to your Proxmox ISO storage.

4.2 Create VM (GUI or Terraform)¶

Minimum spec (community edition):

vCPU: 4
RAM: 8–16 GB
Disk: 100–200 GB (thin provisioned)

Attach NIC:

Bridge: vmbr0 (or your main bridge).
VLAN tag: 50.

Boot from ISO and follow the EVE-NG installation prompts (default Debian-based installer).

5. Assign IP in VLAN 50¶

Inside EVE-NG console:

# As root inside EVE-NG (Debian)
nano /etc/network/interfaces

Example config:

auto eth0
iface eth0 inet static
    address 10.50.0.10/24
    gateway 10.50.0.1
    dns-nameservers 8.8.8.8 1.1.1.1

Apply:

systemctl restart networking

Validate from Proxmox host or management jump:

ping -c3 10.50.0.10

6. Apply Firewall Isolation¶

Confirm firewall policy from ADR‑0103 enforces:

VLAN 50 cannot reach operational VLANs (10/11/20/30/40).
Operational VLANs cannot reach VLAN 50, except:
Management host(s) for SSH/HTTPS UI (optional).

Example checks from a dev VM (VLAN 20):

ping -c3 10.50.0.10   # should FAIL

From management jump (if allowed by policy):

ping -c3 10.50.0.10   # should SUCCEED

7. Add Device Images and Create Your First Topology¶

In a browser (from allowed management host):

Open https://10.50.0.10/ and log in to EVE-NG.
Follow EVE-NG docs to upload device images (Cisco CSR, VyOS, pfSense, etc.).
Create a simple topology:
Two routers and a single link.
Verify ping and basic routing between them.

This topology is fully contained in VLAN 50 and has no impact on live infrastructure.

8. Optional: Trunk a Real VLAN into EVE-NG¶

For advanced testing, you can:

Add a second NIC to the EVE-NG VM on a trunk bridge.
Map that NIC to a dedicated EVE-NG network that represents, for example, “on-prem dev”.

Caution:

Only do this when you fully understand the risk.
Keep firewall rules strict and treat this as a temporary test configuration.

9. Validation Checklist¶

[ ] EVE-NG VM reachable at 10.50.0.10.
[ ] VLAN 50 routing and gateway functional (VM can reach 10.50.0.1 and internet).
[ ] Operational VLANs cannot reach VLAN 50 (as per ADR‑0103), except explicitly allowed management hosts.
[ ] Basic topology runs successfully (e.g. two routers can ping each other).
[ ] (Optional) Trunk tests are documented and reverted when complete.

References¶

License: MIT-0 for code, CC-BY-4.0 for documentation unless otherwise stated.