Connecting Cisco 3560 to Netgate 2100

WN

Strange thing is that I believe the issues is on the Cisco switch and not able to route back to the interfaces I have created on the 2100. Let give you all the current state:

Set up three vlan's tagged, have DHCP service running on all vlans.
All interfaces are IPed as the gateway for each vlan
Currently have any/any rule set up on each vlan do all traffic can pass
DHCP is working! my servers can get the proper IP for the server vlan! Woot!
What is not happening is I can't ping the gateway IP of the 2100 interface. I can ping between hosts on the same subnet/vlan. But no traffic is getting towards the gateway IP.

johnpoz

@wn said in Connecting Cisco 3560 to Netgate 2100:

What is not happening is I can't ping the gateway IP of the 2100 interface.

And what rules did you put on these interfaces? When you create a new interface, vlan or not there will be no rules on it. If you want to be able to ping the pfsense IP of that interface you would need to have a rule that allows that on that interface.

Currently have any/any rule set up on each vlan do all traffic can pass

Is it truely any or default to tcp when you create a new rule.

WN

Created any/any firewall rules for each interface. There's no blockers that should prohibit hosts on that Vlan from at the least ping the interface with ICMP traffic.

johnpoz

If your saying dhcp is working for each of your vlans.. But you can not ping the IP of that interface. Then either your rule is not correct, or maybe you have something stepping on the IP of pfsense interface?

But your L2 connectivity is there if your getting dhcp. So rule would seem the issue to me. On your client trying to ping the IP of pfsense. What do you show for the mac of pfsense IP? Is it correct?

WN

So on my cisco switch:

switch#s arp
internet xxx.xxx.20.1 90.ec.770d.8e0b.8e0b

From pFsense
Diagnostics/ ARP Table:

Vlan20 xxx.xxx.20.1 90.ec.770d.8e0b.8e0b

I also gave the vlan on the switch an IP of .5 which is showing in the ARP table of both the switch and pFsense box with the poper MAC.

Losing my mind here can figure out why they are not communicating

xxx.xxx.20.5

johnpoz

And you can not ping the pfsense IP from the switch? Then that screams firewall rule dude!

WN

So that rule wont allow traffic to PING the interface? Can you confirm so I'm not losing it.

johnpoz

No - its TCP only! That doesn't allow ICMP.

Or UDP for dns either. If you want a ANY rule - icmp, tcp, udp, etc.. Then you have to set that in the rule and would show little *

WN

The top one should be correct then? I just want to get connectivity going and then I'll start peeling it back. Also, most of my experience is with ASA's. Do I need a bi-directional rule within the same interface?

johnpoz

Yeah that rule would be true any any rule.

edit: no you wouldn't need bidirectional rule, any return traffic would be allowed by the state created when inbound traffic to the interface is allowed.

WN

Yeah... Still didn't work.

johnpoz

Well sniff on pfsense - pfsense can not answer ping if it never sees it.

Its not rocket science here - the traffic is tagged or its not, etc Post up your switch port config on pfsense and your switch..

If your seeing the mac - that says your L2 is connected.. If your rule allows for answer then it would work.

edit: You don't have any floating rules do you?

WN

No floating just the any/any on each interface. Below are the uplinks for each vlan 10,20 and 30. I removed the vlan interfaes off the switch and te defalt gateway. there should be no more layer 3 on the switch

interface GigabitEthernet0/16
description Uplink to pFsense Vlan 10
switchport access vlan 10
switchport mode access
spanning-tree portfast

interface GigabitEthernet0/32
description Uplink to pFsense Vlan 20
switchport access vlan 20
switchport mode access
spanning-tree portfast

interface GigabitEthernet0/48
description Uplink to pFsense Vlan 30
switchport access vlan 30
switchport mode access
spanning-tree portfast

Arp on

johnpoz

@wn Nothing jumping out at me that is wrong there.. Have very sim setup on a 3100 with switch ports being untagged vlans.

If your firewall rules are any any.. and you showing the mac in your device your trying to ping from.. Then you should get an answer..

Really the only thing left to validate is traffic is being seen by pfsense - as stated if pfsense never sees the ping, it for sure can not answer. Seeing the traffic would have zero to do with rules being wrong or not, etc.

edit: Just for reference and example.. Here is my very sim sort of setup

WN

I I believe me removing all layer 3 interfaces from the cisco switch might have done the trick. I can ping the interfaces from the server IP's.

Thank you again for letting me bounce things off of you. Extremely important to have other eye look at your work. Thanks again!