Sonicwall to PFSense VLAN Routing issue.
-
How can I put this in simple terms, I have a Sonicwall 4500 and moving to PFSense. I have attempted many ways to connect my Layer3 network with VLANS to work 100% in PFSense. In the Sonicwall, I simply created an address object 192.168.128.2 = my Aruba switch stack. In the switch stack the IP route 0.0.0.0 0.0.0.0 192.168.128.1 <= my Sonicwall. All VLANS have static routes and the GW is the Arubastack. When I run anything on the VLANs 192.168.12.0, and then 13,15 respectfully they work. They get internet they can get to each other and they can connect to my layer 2 network the 192.168.128.0. Why all of this... I have a VMware 6.7 (LAB) environment, VLAN 12=servers, 13=linux servers/workstations, 128=users, 15=management, 18=IDrac there are a few other VLANS that I do not route example VLAN 6 is the LAGG for SAN to HOSTS.
So I have attempted to mimic my SonicWall in the PFSense. it kinda works but for example in a web interface on my VCenter (needing a manual refresh) or my SAN, the interface works but then resets and then works and resets. I also tried building a two-port lagg trunk and then VLANS on that connection. That kinda worked I could get it from my desktop at 192.168.128.100 to my VCenter at 192.168.15.30 but it can not connect to anything on the 192.168.128.0 network nor get to the internet. again this all worked fine in the Sonicwall.
My issue is not with my being technically savvy but more over not understanding PFSense's ways of configuration. Any guidance? I am suspecting maybe hair pinning in the PFSense.
-
@eschwar06 A drawing would help here.. I really can not make out how your trying to route this - but seems like your most likely asymmetrical
All VLANS have static routes and the GW is the Arubastack
I also tried building a two-port lagg trunk and then VLANS on that connectionHuh? If your Arubastack is routing, then pfsense would only be connected via a transit network. And really would have no clue to vlans other than routes.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.7.2, 24.11 -
Thank for getting back to me, here is a quick down and dirty.
Basically I want a full flat network for all VLAN except VLAN 6. The lab (Aruba Stack) and VMware environment is not always on. The 192.168.128.0/24 network Layer 2 is always on. My SonicWALL and prior to that my ASUS router/Firewalls were both able to do this with simple routing. My attempts were a) the same as the Sonicwall/ASUS with static routes, and ArubaStack 192.168.128.2 as their gateway. The other two attempts were creating a 2 port LAGG Trunk and create tagged VLANS over that trunk.. Did not work, Then another attempt was Tagged VLANS over the LAN with all VLANS tagged on the switch and the PFSense and untagged on the 192.168.128.0 default LAN. I also created any any rules for each VLAN in the firewall. I appreciate any insight you may have. -
@johnpoz This was only when attempting to use PFSense like I did the SonicWALL/ASUS in the past. Please read my latest.
-
@eschwar06 Well sure looks like your trying to use your lan as a transit - with hosts on it... That is going to cause you nothing but grief..
Connect your downstream router via transit network.. Seems like go over this every other day ;)
Any network that connects routers should not have "hosts" on it.. If you do then you will have to host route on each of them, or you will have to nat your downstream networks. Or you will run into asymmetrical traffic flow - which is extra bad when you have a stateful firewall doing the routing..
You can have networks directly off your pfsense, like your lan - but don't use it as a transit to some downstream router. Connect pfsense to this downstream router with a transit network (no hosts on it)
-
@johnpoz Thank you for your help, after thinking about everything, I decided to change the setup. I will keep the Layer 2 Network separate from the LAB, so the PFSense will mainly be focused on being an Edge firewall. I will use the extra Ethernet the PFSense has to connect to the Sonicwall and have the Sonicwall control the setting needed for when I turn on the whole LAB configuration. The easiest thing of course would be just to remove the sonicwall, keep the PFSense as is and use the Layer 3 for all networking and not to have the L2 switch. However, I'm attempting to have the whole lab environment, not one that runs all the time (Heat/electric, etc) but the L2 network, DC, Workstations, laptops, DVR, the camera's running all the time. Again thanks,
-
Not sure why you think you need the sonic wall.. The drawing posted shows you exactly how to run networks off pfsense, and also have a downstream router, or multiple downstream routers.
All that is required is a simple transit network.. You sure and the hell do not need yet another router (sonicwall) in the mix..
Sounds like to me, all your doing is hiding the downstream networks behind a nat firewall..
-
@johnpoz Thanks John, yes I know I do not need the SW and I can do it all without it. I think the main reason for the new thought was to not have my Wife and son give me a hard time as I play around :) However, I am still considering building the way you did in the diagram. I will let you know how I make out.
-
@eschwar06 said in Sonicwall to PFSense VLAN Routing issue.:
not have my Wife and son give me a hard time as I play around
Just put in the proper change controls - with a window for experimentation ;) hehehe
Send out the maintenance notification - and then they will have nothing to bitch about - hehehehe
Did you sign some binding SLA with them about no down time? Man I am on fire with this golden advice - rofl ;)
-
A little messy as I work on things. The blue screen is the PFSense box which has three NICs. Love the CrystalFontz screen which also added the feature to reboot or shutdown PFSense from that screen, however, what you do not see I also have a Web power switch that allows me to turn on and off power to equipment from my workstation, then IDrac's to turn on or manager the DC/File Server/Media Server and then the VMWare hosts and SAN. :) -
Sorry, for this dragging out :) So if I was to follow your diagram with Class B, I would need to re-IP the whole network. Could you define the diagram with Class C if you would not mind?
Note for the lab I would have no issues with re-IP addressing. However the L2 network = lots of other things I do not want to touch. I want to build this as Production (Layer 2) 192.168.128.xxx/24 and non-prod I am open to anything on all of the Layer 3. The main thing I need to make sure I can do is get from 192.168.128.100 to Non-Production and it can get to my DC at 192.168.128.250 (its the DNS, and DHCP + NFS store for ISO's). . I understand the simple thing would be to let the layer 3 do all the routing and plug everything into that layer 3 (I have plenty of ports). But Fans*2 switches full time is the reason I went to the flat 24 port for Production as it is dumb but quiet. The same can be said for the PFSense 1U Server very quiet. My home LAB aka non-prod is in my office (aka spare bedroom) in my house which doubles as my office which I do work from when not working at the work office. Again thanks for everything and mainly the time you have given me. LOL. I do have to laugh because I am actually a Network Manager and I have 6 Network Engineers that could help me. But I like to keep the things I have them do = work. I don't touch equipment at work, like I said manager, but been an engineer for years and I still like working in technology thus the reason for the lab (non-prod). Where I lack experience is PFSense, when I attempted to build PF sense as I stated before like the Sonicwall and ASUS before it well, let's just say I have corrupted the PFSense a few times and the fam was not happy.
-
@eschwar06 said in Sonicwall to PFSense VLAN Routing issue.:
diagram with Class B, I would need to re-IP the whole network
Huh?? Those IPs are just examples - you can use whatever rfc1918 space you want to use.. no need to renumber anything other than coming up with what transit network you want to use that doesn't conflict with any of your existing networks.
edit:
As to classes - that shit is like 30 years old.. I have no idea why it or even the term still comes up.. Classful networks have not be a thing since the early 90s - cidr came out like 93 or something.. -
Thanks I thought as much, I will give it a go.
