How should I understand about switch port5? What is port#5?
-
Hello Professionals,
I'm using Netgate-2100 series and this is first time to configure switch ports.
I tried to follow references, but still I can't get it about the concept of port#5 (uplink).Here is my config. I'm using LAN#1.
- LAN#1: 10.10.50.1
- WAN : 172.16.100.254
On Netgate-2100, I create VLAN4051 to LAN#2 and provided IP address.
-
LAN#2 (LAN.VLAN4052): 10.10.52.1/24
Port configuration>>
-
VLAN configuration>>
Please see my Ping Result on the drawing.
How can I make PC-B talk to PC-A?When I traceroute from PC-A to PC-B,
Switch route to Netgate2100, but Netgate2100 route to Router even it has the interface about PC-B (10.10.52.1/24)Moreover, why is it important to configure the port#5 to be tagged VLAN?
Port#5 is trunk port of LAN#1-4?Please help me to get this.
Much appreciate it.
-
@eeebbune it’s the internal uplink for the switch to which 1-4 connect .
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html
Edit: see the 3100 diagram here: https://www.netgate.com/blog/choosing-the-right-netgate-appliance
-
@steveits Indeed. Switch port 5 on the 3100 and 2100, 0 on the 1100, and 9&10 on the 7100 are what links the switching IC to the pfSense software. Any VLAN tagged or untagged needs to be on this for pfSense to use the traffic.
-
@rcoleman-netgate That menas if I let port5 know tagged VLAN 51 (of switch) then PC-B can talk to PC-A? please correct me if I am wrong.
-
@eeebbune See step 19 in the doc I linked (plus the other steps :) ):
"Click + Add Member to add the LAN Uplink, 5. This member should be tagged as shown."If you follow the doc exactly you'll have created an isolated port that works just like a new interface.
After creating the new interface, firewall rules on that interface will control what it can access. So you can add a rule allowing 10.10.52.10 to talk to 10.10.51.10.
-
@eeebbune If VLAN 51 is needed on
(untagged) ports 2 and 3 and in (tagged) pfSense then need to make it untagged on 2 and 3 and tagged on 5.If you don't want to pass it to pfSense you can skip 5... but I wouldn't use the router's switching IC for an offline VLAN. That's just more compute power being pulled away from other tasks.
-
@rcoleman-netgate Thank you very much. I realized that all I need to do is adding a LAN (in my case, LAN port#1) and uplink port (LAN port#5) to have a correct VLAN (VLAN4052). All my LAN ports are able to communicate with PC-A.