pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue
-
@nrgia said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
Here you go:
tcpdump_pfsense_22.01.txt
I think you will need a pcap from pfSense 22.05 also.OK, so where exactly was that captured? On the mirror port? pfSense LAN port directly?
Looks like probably the latter since there are no replies. Try pcaping like that on the mirror port with successful traffic passing. We should be able to see all the traffic on the link between pfSense and the switch.
-
One other test you might try here is to actually set a priority tag other than 0 in the switch and see where that is applied to traffic in the pcap. I expect it to be on the VLAN 20/30tag but if it appears on the VLAN0 tag that would implicate the switch.
And just to review (since we've been at this some days now!) we initially though the switch was tagging the packets with VLAN0 but ruled that out when you ran a test with the AP connect to pfSense directly and still saw VLAN0 tags. Can you just reconfirm that? If I've misunderstood that result the switch still seems like the mist likely suspect.
Steve
-
@stephenw10 said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
Here you go:
tcpdump_pfsense_22.01.txt
I think you will need a pcap from pfSense 22.05 also.OK, so where exactly was that captured? On the mirror port? pfSense LAN port directly?
Looks like probably the latter since there are no replies. Try pcaping like that on the mirror port with successful traffic passing. We should be able to see all the traffic on the link between pfSense and the switch.
It wasn't the mirror port. It was the port where the AP was connected, and had access to Native LAN, VLAN20 and VLAN30. (you can forget about VLAN30, there is no traffic, is just a guest VLAN)
The problem was, the Host OS was Windows, and the interface couldn't be set into promisc mode to capture vlan tags. It worked from a host with a Linux OS
-
@stephenw10 said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
One other test you might try here is to actually set a priority tag other than 0 in the switch and see where that is applied to traffic in the pcap. I expect it to be on the VLAN 20/30tag but if it appears on the VLAN0 tag that would implicate the switch.
I looked in the switch menus, I don't think my switch can assign a priority. Only by port in QoS menu. I saw that only in pfSense (in my network config)
And just to review (since we've been at this some days now!) we initially though the switch was tagging the packets with VLAN0 but ruled that out when you ran a test with the AP connect to pfSense directly and still saw VLAN0 tags. Can you just reconfirm that? If I've misunderstood that result the switch still seems like the mist likely suspect.
Steve
You are correct, I confirm.
Also I use a laptop with Manjaro now, so I can plug in any port and the pcap will catch vlan tags also. Maybe to make sure our result were not botched by Windows OS, I can repeat them.
Please always specify the pfSense version on which you want me to run them.
Thank you, and waiting for your input
-
The traffic coming into the pfSense LAN port should not vary between pfSense versions. What might be different is the way the driver is changing what tcpdump in pfSense sees. Though it's unlikely. So I'd stick with 22.01 until we know we have a good capture from the mirror port showing the traffic both ways with all the tags.
Your switch does have priority tagging. You showed it here: https://imgur.com/GdPzhEn
Set that to 802.1p mode and set a priority level on one of the ports. You should be able to see that in the pcap.Steve
-
Exactly pfsense isn't setting vlan 0 on the incoming traffic.
Your trick now is to figure out where they are coming from.. This has nothing to do with pfsense other than old version via a problem was letting it work, now with 22.05 is acting how it should on such traffic.
-
@stephenw10 said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
The traffic coming into the pfSense LAN port should not vary between pfSense versions. What might be different is the way the driver is changing what tcpdump in pfSense sees. Though it's unlikely. So I'd stick with 22.01 until we know we have a good capture from the mirror port showing the traffic both ways with all the tags.
Your switch does have priority tagging. You showed it here: https://imgur.com/GdPzhEn
Set that to 802.1p mode and set a priority level on one of the ports. You should be able to see that in the pcap.Steve
You' re correct, but if I switch from Port based to 802.1p mode, I cannot set any priorities, the list will disappear.
I uploaded 2 more screenshots as an example:
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
Exactly pfsense isn't setting vlan 0 on the incoming traffic.
Your trick now is to figure out where they are coming from.. This has nothing to do with pfsense other than old version via a problem was letting it work, now with 22.05 is acting how it should on such traffic.
Got it, let's hope we find something :)
-
@nrgia delete those priorities
Why do you think you need to set priorities, and why can you not set them in 802.1p?
You have all the ports set for low priority - that is pointless to do anyway. Now if you actually had some ports set differently, etc. but all the same makes the whole setup useless..
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia delete those priorities
Why do you think you need to set priorities, and why can you not set them in 802.1p?
You have all the ports set for low priority - that is pointless to do anyway. Now if you actually had some ports set differently, etc. but all the same makes the whole setup useless..
I was just following the steps laid out for me. The first one, was to set the switch in 802.1p mode, or I did not read that right?
-
@nrgia huh - did I miss something? Steve told you to set port priority..
Or that was how it was before.. Let me see if I have my netgear switch around, its only 8 port model, but pretty sure from your screen show its the same feature set and software.
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia huh - did I miss something? Steve told you to set port priority..
Or that was how it was before.. Let me see if I have my netgear switch around, its only 8 port model, but pretty sure from your screen show its the same feature set and software.
Take your time
-
@nrgia ok just fired up old switch I had on my self
Its showing
I could for sure run some vlans through it and see what I see..
What firmware version you running - wonder if should see if there is an update, Im on
Firmware Version V2.06.14EN
edit: make that V2.06.17EN just updated.
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia ok just fired up old switch I had on my self
Its showing
I could for sure run some vlans through it and see what I see..
What firmware version you running - wonder if should see if there is an update, Im on
Firmware Version V2.06.14EN
My Model is GS116Ev2 firmware version 2.6.0.48.
You can check the firmware only on Netgear support page
For example the download page for my model is this one:
https://www.netgear.com/support/product/GS116Ev2.aspx#download
-
@nrgia so we are on slightly different firmware versions - but the interfaces look exactly the same..
-
@johnpoz
I agree, but now I think you understand my dilemma, I hope. The interface is the same. I just want to reproduce Steve's steps. How? -
@nrgia steve says to set to 802.1p mode, your in port mode and then set a priority and sniff - and you should see that priority set in the sniff.
You would have to set the priority on device that passes traffic through the switch.. Since in 802.1p mode the switch just honors the priority set.
For your issue, switch it to 802.1p mode should maybe fix your whole issue by removing the vlan 0 tagging
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia steve says to set to 802.1p mode, your in port mode and then set a priority and sniff - and you should see that priority set in the sniff.
You would have to set the priority on device that passes traffic through the switch.. Since in 802.1p mode the switch just honors the priority set.
Don't get mad, I don't want to play semantics but you meant "to the switch" or "through the switch" ? The only device that passes traffic to the switch is pfSense, and there, the priority is set to zero(0) for all VLANs.
For your issue, switch it to 802.1p mode should maybe fix your whole issue by removing the vlan 0 tagging
Tried that, I will retry again, and sniff the mirror port
-
@nrgia said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
The only device that passes traffic to the switch is pfSense
What.. You have no devices connect to the switch? That passes traffic "through" the switch to pfsense to be routed.
My point was
pfsense - switch -- device
You would have to set the 802.1p priority on the device.. We can play semantics all you want - but sorry that traffic flows through the switch..
-
@nrgia said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
and sniff the mirror port
Why are you sniffing the mirror port? Sorry but there is no way pfsense is adding the vlan 0 p0 onto traffic that is entering it.
Here is a test, get a dumb switch.. It would pass tags.. Now connect your AP to the dumb switch, and then from the dumb switch to pfsense port.
If this was my issue I would be looking how to make that vlan 0 go away, or figure out what is doing it.. You see them on 22.01 but it works, you see them on 22.05 and doesn't work - because it shouldn't you have no vlan 0 setup, etc so that traffic should be dropped.
Here is the thing - vlan 0 shouldn't be on the traffic in the first place - what is putting it on there? How would it be pfsense when the traffic is inbound into its interface...
