pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue
-
Exactly pfsense isn't setting vlan 0 on the incoming traffic.
Your trick now is to figure out where they are coming from.. This has nothing to do with pfsense other than old version via a problem was letting it work, now with 22.05 is acting how it should on such traffic.
-
@stephenw10 said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
The traffic coming into the pfSense LAN port should not vary between pfSense versions. What might be different is the way the driver is changing what tcpdump in pfSense sees. Though it's unlikely. So I'd stick with 22.01 until we know we have a good capture from the mirror port showing the traffic both ways with all the tags.
Your switch does have priority tagging. You showed it here: https://imgur.com/GdPzhEn
Set that to 802.1p mode and set a priority level on one of the ports. You should be able to see that in the pcap.Steve
You' re correct, but if I switch from Port based to 802.1p mode, I cannot set any priorities, the list will disappear.
I uploaded 2 more screenshots as an example:
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
Exactly pfsense isn't setting vlan 0 on the incoming traffic.
Your trick now is to figure out where they are coming from.. This has nothing to do with pfsense other than old version via a problem was letting it work, now with 22.05 is acting how it should on such traffic.
Got it, let's hope we find something :)
-
@nrgia delete those priorities
Why do you think you need to set priorities, and why can you not set them in 802.1p?
You have all the ports set for low priority - that is pointless to do anyway. Now if you actually had some ports set differently, etc. but all the same makes the whole setup useless..
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia delete those priorities
Why do you think you need to set priorities, and why can you not set them in 802.1p?
You have all the ports set for low priority - that is pointless to do anyway. Now if you actually had some ports set differently, etc. but all the same makes the whole setup useless..
I was just following the steps laid out for me. The first one, was to set the switch in 802.1p mode, or I did not read that right?
-
@nrgia huh - did I miss something? Steve told you to set port priority..
Or that was how it was before.. Let me see if I have my netgear switch around, its only 8 port model, but pretty sure from your screen show its the same feature set and software.
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia huh - did I miss something? Steve told you to set port priority..
Or that was how it was before.. Let me see if I have my netgear switch around, its only 8 port model, but pretty sure from your screen show its the same feature set and software.
Take your time
-
@nrgia ok just fired up old switch I had on my self
Its showing
I could for sure run some vlans through it and see what I see..
What firmware version you running - wonder if should see if there is an update, Im on
Firmware Version V2.06.14EN
edit: make that V2.06.17EN just updated.
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia ok just fired up old switch I had on my self
Its showing
I could for sure run some vlans through it and see what I see..
What firmware version you running - wonder if should see if there is an update, Im on
Firmware Version V2.06.14EN
My Model is GS116Ev2 firmware version 2.6.0.48.
You can check the firmware only on Netgear support page
For example the download page for my model is this one:
https://www.netgear.com/support/product/GS116Ev2.aspx#download
-
@nrgia so we are on slightly different firmware versions - but the interfaces look exactly the same..
-
@johnpoz
I agree, but now I think you understand my dilemma, I hope. The interface is the same. I just want to reproduce Steve's steps. How? -
@nrgia steve says to set to 802.1p mode, your in port mode and then set a priority and sniff - and you should see that priority set in the sniff.
You would have to set the priority on device that passes traffic through the switch.. Since in 802.1p mode the switch just honors the priority set.
For your issue, switch it to 802.1p mode should maybe fix your whole issue by removing the vlan 0 tagging
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia steve says to set to 802.1p mode, your in port mode and then set a priority and sniff - and you should see that priority set in the sniff.
You would have to set the priority on device that passes traffic through the switch.. Since in 802.1p mode the switch just honors the priority set.
Don't get mad, I don't want to play semantics but you meant "to the switch" or "through the switch" ? The only device that passes traffic to the switch is pfSense, and there, the priority is set to zero(0) for all VLANs.
For your issue, switch it to 802.1p mode should maybe fix your whole issue by removing the vlan 0 tagging
Tried that, I will retry again, and sniff the mirror port
-
@nrgia said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
The only device that passes traffic to the switch is pfSense
What.. You have no devices connect to the switch? That passes traffic "through" the switch to pfsense to be routed.
My point was
pfsense - switch -- device
You would have to set the 802.1p priority on the device.. We can play semantics all you want - but sorry that traffic flows through the switch..
-
@nrgia said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
and sniff the mirror port
Why are you sniffing the mirror port? Sorry but there is no way pfsense is adding the vlan 0 p0 onto traffic that is entering it.
Here is a test, get a dumb switch.. It would pass tags.. Now connect your AP to the dumb switch, and then from the dumb switch to pfsense port.
If this was my issue I would be looking how to make that vlan 0 go away, or figure out what is doing it.. You see them on 22.01 but it works, you see them on 22.05 and doesn't work - because it shouldn't you have no vlan 0 setup, etc so that traffic should be dropped.
Here is the thing - vlan 0 shouldn't be on the traffic in the first place - what is putting it on there? How would it be pfsense when the traffic is inbound into its interface...
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
The only device that passes traffic to the switch is pfSense
What.. You have no devices connect to the switch? That passes traffic "through" the switch to pfsense to be routed.
My point was
pfsense - switch -- device
You would have to set the 802.1p priority on the device.. We can play semantics all you want - but sorry that traffic flows through the switch..
Ok, then how do I set the priority on the device? Beeing a laptop, smart hub, Smart Tv, etc.?
pfSense - switch --device(laptop)
--device(IOT hub)
--smart TV -
@nrgia on some iot device not going to be possible... Would need to be another downstream switch that allows you to set it or setting it on the device.
With linux you could do with vconfig, you just set a egress map to change the priority. Windows can set it as well.. Just not as easy as with vconfig in linux.
But highly unlikely some smart lightbulb is going to let you set it ;)
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
and sniff the mirror port
Why are you sniffing the mirror port? Sorry but there is no way pfsense is adding the vlan 0 p0 onto traffic that is entering it.
Then guide me through a few steps, what should I sniff, from which host, and what port, please.
Here is a test, get a dumb switch.. It would pass tags.. Now connect your AP to the dumb switch, and then from the dumb switch to pfsense port.
I don't have a dumb switch.
If this was my issue I would be looking how to make that vlan 0 go away, or figure out what is doing it.. You see them on 22.01 but it works, you see them on 22.05 and doesn't work - because it shouldn't you have no vlan 0 setup, etc so that traffic should be dropped.
I'm doing that, but when I run something, I just want to reproduce what you are asking of me, I'm not trying to be smart.
Here is the thing - vlan 0 shouldn't be on the traffic in the first place - what is putting it on there? How would it be pfsense when the traffic is inbound into its interface...
-
@nrgia fist thing I would do is just change your switch to 802.1p mode... Are you seeing that vlan 0 on your sniff on pfsense.. Doesn't matter if 22.01 or 22.05
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia on some iot device not going to be possible... Would need to be another downstream switch that allows you to set it or setting it on the device.
With linux you could do with vconfig, you just set a egress map to change the priority. Windows can set it as well.. Just not as easy as with vconfig in linux.
But highly unlikely some smart lightbulb is going to let you set it ;)
:) I'm worried that neither my Hub that controls all the smart things cannot be set to do that, neither the smart tv. I will try what you say but if this priority cannot be set an all devices, how it will solve the issue? Only a laptop will work? Or is just for investigation?
