How should I understand about switch port5? What is port#5?

eeebbune

Hello Professionals,

I'm using Netgate-2100 series and this is first time to configure switch ports.
I tried to follow references, but still I can't get it about the concept of port#5 (uplink).

Here is my config. I'm using LAN#1.

LAN#1: 10.10.50.1
WAN : 172.16.100.254

On Netgate-2100, I create VLAN4051 to LAN#2 and provided IP address.

LAN#2 (LAN.VLAN4052): 10.10.52.1/24
Port configuration>>
VLAN configuration>>

Please see my Ping Result on the drawing.
How can I make PC-B talk to PC-A?

When I traceroute from PC-A to PC-B,
Switch route to Netgate2100, but Netgate2100 route to Router even it has the interface about PC-B (10.10.52.1/24)

Moreover, why is it important to configure the port#5 to be tagged VLAN?
Port#5 is trunk port of LAN#1-4?

Please help me to get this.

Much appreciate it.

SteveITS

@eeebbune it’s the internal uplink for the switch to which 1-4 connect .

https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html

Edit: see the 3100 diagram here: https://www.netgate.com/blog/choosing-the-right-netgate-appliance

rcoleman-netgate

@steveits Indeed. Switch port 5 on the 3100 and 2100, 0 on the 1100, and 9&10 on the 7100 are what links the switching IC to the pfSense software. Any VLAN tagged or untagged needs to be on this for pfSense to use the traffic.

eeebbune

@rcoleman-netgate That menas if I let port5 know tagged VLAN 51 (of switch) then PC-B can talk to PC-A? please correct me if I am wrong.

SteveITS

@eeebbune See step 19 in the doc I linked (plus the other steps :) ):
"Click + Add Member to add the LAN Uplink, 5. This member should be tagged as shown."

If you follow the doc exactly you'll have created an isolated port that works just like a new interface.

After creating the new interface, firewall rules on that interface will control what it can access. So you can add a rule allowing 10.10.52.10 to talk to 10.10.51.10.

rcoleman-netgate

@eeebbune If VLAN 51 is needed on
(untagged) ports 2 and 3 and in (tagged) pfSense then need to make it untagged on 2 and 3 and tagged on 5.

If you don't want to pass it to pfSense you can skip 5... but I wouldn't use the router's switching IC for an offline VLAN. That's just more compute power being pulled away from other tasks.

eeebbune

@rcoleman-netgate Thank you very much. I realized that all I need to do is adding a LAN (in my case, LAN port#1) and uplink port (LAN port#5) to have a correct VLAN (VLAN4052). All my LAN ports are able to communicate with PC-A.