Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense on Watchguard M270

    Hardware
    18
    133
    32.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      shaker
      last edited by

      Yes I gestartet every time I made changes

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        OPNSense doesn't have the required drivers to access the switch. The same reason CE won't work. It can only work with pfSense Plus currently.

        Steve

        1 Reply Last reply Reply Quote 0
        • S
          shaker
          last edited by

          What a pitty.
          I thought the base is Free BSD which give the possibility in general.
          Is there no way to bring the correct driver to FreeBSD and let it work?

          By the way, if somebody need access to the BIOS, just let me know.

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            It only happens to work in pfSense Plus because we have done the development work for the 7100. There is basically zero incentive for Deciso to sponsor that in OPN so I'd say it's very unlikely.

            1 Reply Last reply Reply Quote 0
            • S
              shaker
              last edited by

              OK that's cool. Thank you.
              So one last question. When it works with plus only, do I need top buy it, or is there a way to get it for private use.
              I read there is a way to upgrade CE to plus, but therefore you need Internet access first on the device.
              So what's the best option?

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                The easiest way is to install CE and upgrade to plus in something else then move the boot device across into the m270. Then re-register it there once you've added the switch scripts so it has connectivity.

                1 Reply Last reply Reply Quote 0
                • S
                  shaker
                  last edited by shaker

                  Thank you very much for the support.
                  I have now running pfsense plus on my M270.
                  🤙

                  1 Reply Last reply Reply Quote 1
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Cool!
                    Be aware that the driver code was never intended to run on that hardware so the startup scripts that ensure the 7100 works as expected will end up breaking it for the m270 at upgrade. At least currently.
                    So if/when you do a firmware upgrade you will need access to the console to copy back the device hints and regain connectivity. I usually just have a backup of the file I can quickly copy back into place.

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • S
                      shaker
                      last edited by

                      Yes I will do. I made some notes to not forget.

                      Actually the ethernetswitch is configured to use 1 WAN and 7 LAN interfaces, working in switch mode.
                      Is it possible to configure it to have 7 independent LAN ports, where to activate VLANs on each?

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Yes, you just to set them up as that in the switch configure script using etherswitchcfg.

                        1 Reply Last reply Reply Quote 0
                        • S
                          shaker
                          last edited by shaker

                          Is this the right config to have all ports individual?

                          #!/bin/sh
                          #
                          
                          echo "Configuring switch..."
                          logger Configuring switch...
                          
                          etherswitchcfg vlangroup1 vlan 1 members 9
                          etherswitchcfg vlangroup2 vlan 2 members 10
                          etherswitchcfg vlangroup3 vlan 3 members 10
                          etherswitchcfg vlangroup4 vlan 4 members 10
                          etherswitchcfg vlangroup5 vlan 5 members 10
                          etherswitchcfg vlangroup6 vlan 6 members 10
                          etherswitchcfg vlangroup7 vlan 7 members 10
                          etherswitchcfg vlangroup8 vlan 8 members 10
                          etherswitchcfg vlangroup9 vlan 9 members 1
                          etherswitchcfg vlangroup10 vlan 10 members 2,3,4,5,6,7,8
                          
                          etherswitchcfg port1 forwarding
                          etherswitchcfg port2 forwarding
                          etherswitchcfg port3 forwarding
                          etherswitchcfg port4 forwarding
                          etherswitchcfg port5 forwarding
                          etherswitchcfg port6 forwarding
                          etherswitchcfg port7 forwarding
                          etherswitchcfg port8 forwarding
                          etherswitchcfg port9 forwarding
                          etherswitchcfg port10 forwarding
                          
                          echo "done"
                          logger done
                          

                          I am not really sure how I need to configure it.

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            You need to set the switch in 802.1Q mode, it's in port vlan mode by default:

                            etherswitchcfg config vlan_mode DOT1Q
                            

                            Then add the internal ports as tagged members to each group so you can address them as VLANs in pfSense. Also never use VLAN 1 (or 0) directly unless there no other way so:

                            etherswitchcfg vlangroup1 vlan 101 members 1,9t
                            etherswitchcfg vlangroup2 vlan 102 members 2,10t
                            etherswitchcfg vlangroup3 vlan 103 members 3,10t
                            etherswitchcfg vlangroup4 vlan 104 members 4,10t
                            etherswitchcfg vlangroup5 vlan 105 members 5,10t
                            etherswitchcfg vlangroup6 vlan 106 members 6,10t
                            etherswitchcfg vlangroup7 vlan 107 members 7,10t
                            etherswitchcfg vlangroup8 vlan 108 members 8,10t
                            

                            Then you need to set the PVID for each port so untagged traffic arriving is placed in the correct vlan:

                            etherswitchcfg port1 pvid 101
                            etherswitchcfg port2 pvid 102
                            etherswitchcfg port3 pvid 103
                            etherswitchcfg port4 pvid 104
                            etherswitchcfg port5 pvid 105
                            etherswitchcfg port6 pvid 106
                            etherswitchcfg port7 pvid 107
                            etherswitchcfg port8 pvid 108
                            

                            Because you only have one VLAN on port 9 you could also just use that untagged internally but if you ever want to move the VLANs around or add more on port 9 it's easier to set it up tagged now.
                            You can also do other things like setup the two internal ports as a lagg to the switch and put all the VLANs on that. We do that in the 7100 because in some situations it can provide more bandwidth. But you really have to try hard to pass more than 2.5Gbps total and it adds more complexity.

                            Steve

                            I 1 Reply Last reply Reply Quote 0
                            • I
                              ivanbarr @stephenw10
                              last edited by

                              @stephenw10 Is it possible to get the switch to appear in the Web UI on the M270? I think the UI code makes a call to some function like platform_has_switch() to determine whether to show the switch items under the interfaces menu. How does pfsense come to know if a device has a switch or not?

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                There's no easy setting for that. You'd have to patch the code. Probably in a few places. The defaults would need to be set differently to the 7100.

                                1 Reply Last reply Reply Quote 0
                                • S
                                  shaker
                                  last edited by

                                  Hi stephenw10,

                                  I configured the M270 like you described above.
                                  Activate 802.1Q mode, and configured the etherswitchcfg all tagged.

                                  Then I opened console and add a vlan 120, activate the IP on LAN, stuff like that.
                                  Play a bit around.
                                  This is how it looks like:

                                   WAN (wan)       -> ix0        ->
                                   LAN (lan)       -> ix1        -> v4: 192.168.10.1/24
                                   OPT1 (opt1)     -> ix1.120    -> v4: 192.168.120.1/24
                                  
                                   0) Logout (SSH only)                  9) pfTop
                                   1) Assign Interfaces                 10) Filter Logs
                                   2) Set interface(s) IP address       11) Restart webConfigurator
                                   3) Reset webConfigurator password    12) PHP shell + Netgate pfSense Plus tools
                                   4) Reset to factory defaults         13) Update from console
                                   5) Reboot system                     14) Enable Secure Shell (sshd)
                                   6) Halt system                       15) Restore recent configuration
                                   7) Ping host                         16) Restart PHP-FPM
                                   8) Shell
                                  
                                  

                                  I tried to connect directly on port 1-7 and also with a switch, Tagged the port vom M270 on VLAN120 and untagged the port from my pc, but I can't reach the web from pfsense.

                                  Do you know what I am doing wrong?

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    What does etherswitchcfg show?

                                    1 Reply Last reply Reply Quote 0
                                    • Z
                                      zhellalex
                                      last edited by stephenw10

                                      Hello!
                                      Can't run pfsense plus on firebox m270, network interfaces don't work.
                                      I first installed pfSense-CE-memstick-serial-2.6.0-RELEASE-amd64 on the laptop. Activated and updated to pfSense Plus 23.01-RELEASE (amd64).
                                      Installed msata in firebox m270.
                                      When booting, pfsense plus the following:
                                      WAN interface as ix0, and LAN interface as ix1
                                      Added the following content to the /boot/device.hints file:

                                      hint.mdio.0.at="ix1"
                                      hint.e6000sw.0.addr=0
                                      hint.e6000sw.0.is6190=1
                                      hint.e6000sw.0.port0disabled=1
                                      hint.e6000sw.0.port9cpu=1
                                      hint.e6000sw.0.port10cpu=1
                                      hint.e6000sw.0.port9speed=2500
                                      hint.e6000sw.0.port10speed=2500
                                      

                                      reboot firebox m270
                                      in the directory /usr/local/etc/rc.d/ created the file fbm270.sh and inserted the following into it:

                                      #!/bin/sh
                                      #
                                      # Script to setup the switch in the M270
                                      #
                                      # SteveW 5/6/2020
                                      #
                                      
                                      echo "Configuring switch..."
                                      logger Configuring switch...
                                      
                                      etherswitchcfg vlangroup1 vlan 1 members 9
                                      etherswitchcfg vlangroup2 vlan 2 members 3,4,5,6,7,8,10
                                      etherswitchcfg vlangroup3 vlan 3 members 2,4,5,6,7,8,10
                                      etherswitchcfg vlangroup4 vlan 4 members 2,3,5,6,7,8,10
                                      etherswitchcfg vlangroup5 vlan 5 members 2,3,4,6,7,8,10
                                      etherswitchcfg vlangroup6 vlan 6 members 2,3,4,5,7,8,10
                                      etherswitchcfg vlangroup7 vlan 7 members 2,3,4,5,6,8,10
                                      etherswitchcfg vlangroup8 vlan 8 members 2,3,4,5,6,7,10
                                      etherswitchcfg vlangroup9 vlan 9 members 1
                                      etherswitchcfg vlangroup10 vlan 10 members 2,3,4,5,6,7,8
                                      etherswitchcfg port1 forwarding
                                      etherswitchcfg port2 forwarding
                                      etherswitchcfg port3 forwarding
                                      etherswitchcfg port4 forwarding
                                      etherswitchcfg port5 forwarding
                                      etherswitchcfg port6 forwarding
                                      etherswitchcfg port7 forwarding
                                      etherswitchcfg port8 forwarding
                                      
                                      echo "done"
                                      logger done
                                      

                                      run it chmod +x fbm270.sh
                                      run it ./fbm270.sh
                                      reboot firebox m270
                                      after loading pfsence
                                      boot.png
                                      firebox m270 ports 0-7 light up when a patch cord is connected. But the device itself is not available via IP 192.168.1.1 on ports 1-7. In the settings, wan chose to connect via dhcp, but with firebox m270 gigabit Ethernet 0 there are no requests to get an ip address via dhcp.
                                      Switch Configuration:

                                      etherswitch0: VLAN mode: PORT
                                      port1:
                                              state=8<FORWARDING>
                                              flags=0<>
                                              media: Ethernet autoselect (1000baseT <full-duplex>)
                                              status: active
                                      port2:
                                              state=8<FORWARDING>
                                              flags=0<>
                                              media: Ethernet autoselect (1000baseT <full-duplex,master>)
                                              status: active
                                      port3:
                                              state=8<FORWARDING>
                                              flags=0<>
                                              media: Ethernet autoselect (none)
                                              status: no carrier
                                      port4:
                                              state=8<FORWARDING>
                                              flags=0<>
                                              media: Ethernet autoselect (none)
                                              status: no carrier
                                      port5:
                                              state=8<FORWARDING>
                                              flags=0<>
                                              media: Ethernet autoselect (none)
                                              status: no carrier
                                      port6:
                                              state=8<FORWARDING>
                                              flags=0<>
                                              media: Ethernet autoselect (none)
                                              status: no carrier
                                      port7:
                                              state=8<FORWARDING>
                                              flags=0<>
                                              media: Ethernet autoselect (none)
                                              status: no carrier
                                      port8:
                                              state=8<FORWARDING>
                                              flags=0<>
                                              media: Ethernet autoselect (none)
                                              status: no carrier
                                      port9:
                                              state=1<DISABLED>
                                              flags=1<CPUPORT>
                                              media: Ethernet 2500Base-KX <full-duplex>
                                              status: active
                                      port10:
                                              state=1<DISABLED>
                                              flags=1<CPUPORT>
                                              media: Ethernet 2500Base-KX <full-duplex>
                                              status: active
                                      vlangroup1:
                                              port: 1
                                              members 9
                                      vlangroup2:
                                              port: 2
                                              members 3,4,5,6,7,8,10
                                      vlangroup3:
                                              port: 3
                                              members 2,4,5,6,7,8,10
                                      vlangroup4:
                                              port: 4
                                              members 2,3,5,6,7,8,10
                                      vlangroup5:
                                              port: 5
                                              members 2,3,4,6,7,8,10
                                      vlangroup6:
                                              port: 6
                                              members 2,3,4,5,7,8,10
                                      vlangroup7:
                                              port: 7
                                              members 2,3,4,5,6,8,10
                                      vlangroup8:
                                              port: 8
                                              members 2,3,4,5,6,7,10
                                      vlangroup9:
                                              port: 9
                                              members 1
                                      vlangroup10:
                                              port: 10
                                              members 2,3,4,5,6,7,8
                                      

                                      Do not tell me what I did wrong or what else needs to be done to make the firebox m270 work?
                                      Thank you.

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        You can see the internal ports 9 and 10 are disabled. You need to add to the script:

                                        etherswitchcfg port9 forwarding
                                        etherswitchcfg port10 forwarding
                                        

                                        That is a change in the default behaviour of the switch since I first looked at it.

                                        Steve

                                        Z 2 Replies Last reply Reply Quote 0
                                        • Z
                                          zhellalex @stephenw10
                                          last edited by

                                          @stephenw10

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            ??

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.