pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue
-
@nrgia so we are on slightly different firmware versions - but the interfaces look exactly the same..
-
@johnpoz
I agree, but now I think you understand my dilemma, I hope. The interface is the same. I just want to reproduce Steve's steps. How? -
@nrgia steve says to set to 802.1p mode, your in port mode and then set a priority and sniff - and you should see that priority set in the sniff.
You would have to set the priority on device that passes traffic through the switch.. Since in 802.1p mode the switch just honors the priority set.
For your issue, switch it to 802.1p mode should maybe fix your whole issue by removing the vlan 0 tagging
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia steve says to set to 802.1p mode, your in port mode and then set a priority and sniff - and you should see that priority set in the sniff.
You would have to set the priority on device that passes traffic through the switch.. Since in 802.1p mode the switch just honors the priority set.
Don't get mad, I don't want to play semantics but you meant "to the switch" or "through the switch" ? The only device that passes traffic to the switch is pfSense, and there, the priority is set to zero(0) for all VLANs.
For your issue, switch it to 802.1p mode should maybe fix your whole issue by removing the vlan 0 tagging
Tried that, I will retry again, and sniff the mirror port
-
@nrgia said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
The only device that passes traffic to the switch is pfSense
What.. You have no devices connect to the switch? That passes traffic "through" the switch to pfsense to be routed.
My point was
pfsense - switch -- device
You would have to set the 802.1p priority on the device.. We can play semantics all you want - but sorry that traffic flows through the switch..
-
@nrgia said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
and sniff the mirror port
Why are you sniffing the mirror port? Sorry but there is no way pfsense is adding the vlan 0 p0 onto traffic that is entering it.
Here is a test, get a dumb switch.. It would pass tags.. Now connect your AP to the dumb switch, and then from the dumb switch to pfsense port.
If this was my issue I would be looking how to make that vlan 0 go away, or figure out what is doing it.. You see them on 22.01 but it works, you see them on 22.05 and doesn't work - because it shouldn't you have no vlan 0 setup, etc so that traffic should be dropped.
Here is the thing - vlan 0 shouldn't be on the traffic in the first place - what is putting it on there? How would it be pfsense when the traffic is inbound into its interface...
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
The only device that passes traffic to the switch is pfSense
What.. You have no devices connect to the switch? That passes traffic "through" the switch to pfsense to be routed.
My point was
pfsense - switch -- device
You would have to set the 802.1p priority on the device.. We can play semantics all you want - but sorry that traffic flows through the switch..
Ok, then how do I set the priority on the device? Beeing a laptop, smart hub, Smart Tv, etc.?
pfSense - switch --device(laptop)
--device(IOT hub)
--smart TV -
@nrgia on some iot device not going to be possible... Would need to be another downstream switch that allows you to set it or setting it on the device.
With linux you could do with vconfig, you just set a egress map to change the priority. Windows can set it as well.. Just not as easy as with vconfig in linux.
But highly unlikely some smart lightbulb is going to let you set it ;)
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
and sniff the mirror port
Why are you sniffing the mirror port? Sorry but there is no way pfsense is adding the vlan 0 p0 onto traffic that is entering it.
Then guide me through a few steps, what should I sniff, from which host, and what port, please.
Here is a test, get a dumb switch.. It would pass tags.. Now connect your AP to the dumb switch, and then from the dumb switch to pfsense port.
I don't have a dumb switch.
If this was my issue I would be looking how to make that vlan 0 go away, or figure out what is doing it.. You see them on 22.01 but it works, you see them on 22.05 and doesn't work - because it shouldn't you have no vlan 0 setup, etc so that traffic should be dropped.
I'm doing that, but when I run something, I just want to reproduce what you are asking of me, I'm not trying to be smart.
Here is the thing - vlan 0 shouldn't be on the traffic in the first place - what is putting it on there? How would it be pfsense when the traffic is inbound into its interface...
-
@nrgia fist thing I would do is just change your switch to 802.1p mode... Are you seeing that vlan 0 on your sniff on pfsense.. Doesn't matter if 22.01 or 22.05
-
@johnpoz said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
@nrgia on some iot device not going to be possible... Would need to be another downstream switch that allows you to set it or setting it on the device.
With linux you could do with vconfig, you just set a egress map to change the priority. Windows can set it as well.. Just not as easy as with vconfig in linux.
But highly unlikely some smart lightbulb is going to let you set it ;)
:) I'm worried that neither my Hub that controls all the smart things cannot be set to do that, neither the smart tv. I will try what you say but if this priority cannot be set an all devices, how it will solve the issue? Only a laptop will work? Or is just for investigation?
-
@nrgia solve what remove vlan 0, not sure why you would have to do anything on your device.. I find it hard to believe devices are adding that..
Can you do a simple test and change your switch to 802.1p mode, and sniff - are you seeing that vlan 0?
-
-
@nrgia well I don't see any vlan 0 in there.. So your saying still not working?
Your saying when you change to 22.05 you is only time you see that vlan 0?
-
@johnpoz
I'm not just saying, the above dumps shows that.
But that's the idea yes.Should I upgrade and see what happens ?
I only want for this to work, if it works, tell me how to donate, for wasting your time, no joke intended.
-
In 22.01, sniffing in pfSense, the VLAN0 tags never show and the traffic works as expected.
We are speculating that is because the ix driver is incorrectly stripping the VLAN 0 tags before tcpdump sees it.
To prove that what we really want to see is the mirror port in the switch showing the VLAN0 tagged traffic but as far as I know we have not been able to catch that.
However if it was the switch tagging the packets incorrectly we would not have seen them with the AP directly on the pfSense port, yet we did.
We also saw them without an AP connected, just using an access port on the switch.
So that leaves.... ??? -
@stephenw10 said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
So that leaves.... ???
That is the $64,000 ? it seems... Very odd for sure.. I missed a bit of the thread it seems.. sorry.
What is putting the vlan 0 tag on there?? I just do not see how it could be pfsense, make no sense that would see them in the tcpdump for inbound traffic.
@stephenw10 you have not been able to duplicate with your 22.01 box with ix nics?
-
@stephenw10 said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
So that leaves.... ???
TAC Support maybe.
-
@johnpoz @stephenw10
Took a tcpdump from a linux host this time, to be sure it can sniff all the traffic.Connected to the mirror port:
linux_tcp_dump_mirror_port.txt
My opinion is in the title of this post, of who the culprit is, but I don't want point fingers. I'm expecting to find out from one of you guys. :)
-
@nrgia well clearly something is going on, but if 22.05 broke vlans - I would expect the boards would be a fire with people complaining. Even if was only ix interfaces, have to assume your not the only one using ix and vlans that have moved to 22.05
