pfSense on Watchguard M270
-
@stephenw10 Is it possible to get the switch to appear in the Web UI on the M270? I think the UI code makes a call to some function like platform_has_switch() to determine whether to show the switch items under the interfaces menu. How does pfsense come to know if a device has a switch or not?
-
There's no easy setting for that. You'd have to patch the code. Probably in a few places. The defaults would need to be set differently to the 7100.
-
Hi stephenw10,
I configured the M270 like you described above.
Activate 802.1Q mode, and configured the etherswitchcfg all tagged.Then I opened console and add a vlan 120, activate the IP on LAN, stuff like that.
Play a bit around.
This is how it looks like:WAN (wan) -> ix0 -> LAN (lan) -> ix1 -> v4: 192.168.10.1/24 OPT1 (opt1) -> ix1.120 -> v4: 192.168.120.1/24 0) Logout (SSH only) 9) pfTop 1) Assign Interfaces 10) Filter Logs 2) Set interface(s) IP address 11) Restart webConfigurator 3) Reset webConfigurator password 12) PHP shell + Netgate pfSense Plus tools 4) Reset to factory defaults 13) Update from console 5) Reboot system 14) Enable Secure Shell (sshd) 6) Halt system 15) Restore recent configuration 7) Ping host 16) Restart PHP-FPM 8) Shell
I tried to connect directly on port 1-7 and also with a switch, Tagged the port vom M270 on VLAN120 and untagged the port from my pc, but I can't reach the web from pfsense.
Do you know what I am doing wrong?
-
What does
etherswitchcfg
show? -
Hello!
Can't run pfsense plus on firebox m270, network interfaces don't work.
I first installed pfSense-CE-memstick-serial-2.6.0-RELEASE-amd64 on the laptop. Activated and updated to pfSense Plus 23.01-RELEASE (amd64).
Installed msata in firebox m270.
When booting, pfsense plus the following:
WAN interface as ix0, and LAN interface as ix1
Added the following content to the /boot/device.hints file:hint.mdio.0.at="ix1" hint.e6000sw.0.addr=0 hint.e6000sw.0.is6190=1 hint.e6000sw.0.port0disabled=1 hint.e6000sw.0.port9cpu=1 hint.e6000sw.0.port10cpu=1 hint.e6000sw.0.port9speed=2500 hint.e6000sw.0.port10speed=2500
reboot firebox m270
in the directory /usr/local/etc/rc.d/ created the file fbm270.sh and inserted the following into it:#!/bin/sh # # Script to setup the switch in the M270 # # SteveW 5/6/2020 # echo "Configuring switch..." logger Configuring switch... etherswitchcfg vlangroup1 vlan 1 members 9 etherswitchcfg vlangroup2 vlan 2 members 3,4,5,6,7,8,10 etherswitchcfg vlangroup3 vlan 3 members 2,4,5,6,7,8,10 etherswitchcfg vlangroup4 vlan 4 members 2,3,5,6,7,8,10 etherswitchcfg vlangroup5 vlan 5 members 2,3,4,6,7,8,10 etherswitchcfg vlangroup6 vlan 6 members 2,3,4,5,7,8,10 etherswitchcfg vlangroup7 vlan 7 members 2,3,4,5,6,8,10 etherswitchcfg vlangroup8 vlan 8 members 2,3,4,5,6,7,10 etherswitchcfg vlangroup9 vlan 9 members 1 etherswitchcfg vlangroup10 vlan 10 members 2,3,4,5,6,7,8 etherswitchcfg port1 forwarding etherswitchcfg port2 forwarding etherswitchcfg port3 forwarding etherswitchcfg port4 forwarding etherswitchcfg port5 forwarding etherswitchcfg port6 forwarding etherswitchcfg port7 forwarding etherswitchcfg port8 forwarding echo "done" logger done
run it chmod +x fbm270.sh
run it ./fbm270.sh
reboot firebox m270
after loading pfsence
firebox m270 ports 0-7 light up when a patch cord is connected. But the device itself is not available via IP 192.168.1.1 on ports 1-7. In the settings, wan chose to connect via dhcp, but with firebox m270 gigabit Ethernet 0 there are no requests to get an ip address via dhcp.
Switch Configuration:etherswitch0: VLAN mode: PORT port1: state=8<FORWARDING> flags=0<> media: Ethernet autoselect (1000baseT <full-duplex>) status: active port2: state=8<FORWARDING> flags=0<> media: Ethernet autoselect (1000baseT <full-duplex,master>) status: active port3: state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port4: state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port5: state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port6: state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port7: state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port8: state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port9: state=1<DISABLED> flags=1<CPUPORT> media: Ethernet 2500Base-KX <full-duplex> status: active port10: state=1<DISABLED> flags=1<CPUPORT> media: Ethernet 2500Base-KX <full-duplex> status: active vlangroup1: port: 1 members 9 vlangroup2: port: 2 members 3,4,5,6,7,8,10 vlangroup3: port: 3 members 2,4,5,6,7,8,10 vlangroup4: port: 4 members 2,3,5,6,7,8,10 vlangroup5: port: 5 members 2,3,4,6,7,8,10 vlangroup6: port: 6 members 2,3,4,5,7,8,10 vlangroup7: port: 7 members 2,3,4,5,6,8,10 vlangroup8: port: 8 members 2,3,4,5,6,7,10 vlangroup9: port: 9 members 1 vlangroup10: port: 10 members 2,3,4,5,6,7,8
Do not tell me what I did wrong or what else needs to be done to make the firebox m270 work?
Thank you. -
You can see the internal ports 9 and 10 are disabled. You need to add to the script:
etherswitchcfg port9 forwarding etherswitchcfg port10 forwarding
That is a change in the default behaviour of the switch since I first looked at it.
Steve
-
-
??
-
@stephenw10 Thank you.
Everything worked. -
I stephenw10,
sorry for the late reply, I was on business.
My etherswitchcfg shows this:
[23.01-RELEASE][root@pfSense.home.arpa]/root: etherswitchcfg etherswitch0: VLAN mode: DOT1Q port1: pvid: 110 state=1<DISABLED> flags=0<> media: Ethernet autoselect (none) status: no carrier port2: pvid: 120 state=1<DISABLED> flags=0<> media: Ethernet autoselect (1000baseT <full-duplex>) status: active port3: pvid: 130 state=1<DISABLED> flags=0<> media: Ethernet autoselect (none) status: no carrier port4: pvid: 140 state=1<DISABLED> flags=0<> media: Ethernet autoselect (none) status: no carrier port5: pvid: 150 state=1<DISABLED> flags=0<> media: Ethernet autoselect (none) status: no carrier port6: pvid: 160 state=1<DISABLED> flags=0<> media: Ethernet autoselect (none) status: no carrier port7: pvid: 170 state=1<DISABLED> flags=0<> media: Ethernet autoselect (none) status: no carrier port8: pvid: 180 state=1<DISABLED> flags=0<> media: Ethernet autoselect (none) status: no carrier port9: pvid: 1 state=1<DISABLED> flags=1<CPUPORT> media: Ethernet 2500Base-KX <full-duplex> status: active port10: pvid: 1 state=1<DISABLED> flags=1<CPUPORT> media: Ethernet 2500Base-KX <full-duplex> status: active vlangroup0: vlan: 1 members 1,2,3,4,5,6,7,8,9,10 vlangroup1: vlan: 110 members 1,9t vlangroup2: vlan: 120 members 2,10t vlangroup3: vlan: 130 members 3,10t vlangroup4: vlan: 140 members 4,10t vlangroup5: vlan: 150 members 5,10t vlangroup6: vlan: 160 members 6,10t vlangroup7: vlan: 170 members 7,10t vlangroup8: vlan: 180 members 8,10t
What should I do next?
-
All the ports are in state DISABLED so the script did not set them to FORWARDING correctly.
Otherwise it looks good.
-
This is the script:
#!/bin/sh # echo "Configuring switch..." logger Configuring switch... etherswitchcfg config vlan_mode DOT1Q etherswitchcfg vlangroup1 vlan 110 members 1,9t etherswitchcfg vlangroup2 vlan 120 members 2,10t etherswitchcfg vlangroup3 vlan 130 members 3,10t etherswitchcfg vlangroup4 vlan 140 members 4,10t etherswitchcfg vlangroup5 vlan 150 members 5,10t etherswitchcfg vlangroup6 vlan 160 members 6,10t etherswitchcfg vlangroup7 vlan 170 members 7,10t etherswitchcfg vlangroup8 vlan 180 members 8,10t etherswitchcfg port1 pvid 110 etherswitchcfg port2 pvid 120 etherswitchcfg port3 pvid 130 etherswitchcfg port4 pvid 140 etherswitchcfg port5 pvid 150 etherswitchcfg port6 pvid 160 etherswitchcfg port7 pvid 170 etherswitchcfg port8 pvid 180 echo "done" logger done
Do I need some forwardings too?
-
Yes all the switch ports are disabled by default, you still need the section to set each port to forwarding. You might be able to combine that with the pvid. I've not tried that in one command.
-
Ok, now it looks like this:
etherswitch0: VLAN mode: DOT1Q port1: pvid: 110 state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port2: pvid: 120 state=8<FORWARDING> flags=0<> media: Ethernet autoselect (1000baseT <full-duplex>) status: active port3: pvid: 130 state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port4: pvid: 140 state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port5: pvid: 150 state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port6: pvid: 160 state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port7: pvid: 170 state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port8: pvid: 180 state=8<FORWARDING> flags=0<> media: Ethernet autoselect (none) status: no carrier port9: pvid: 1 state=8<FORWARDING> flags=1<CPUPORT> media: Ethernet 2500Base-KX <full-duplex> status: active port10: pvid: 1 state=8<FORWARDING> flags=1<CPUPORT> media: Ethernet 2500Base-KX <full-duplex> status: active vlangroup0: vlan: 1 members 1,2,3,4,5,6,7,8,9,10 vlangroup1: vlan: 110 members 1,9t vlangroup2: vlan: 120 members 2,10t vlangroup3: vlan: 130 members 3,10t vlangroup4: vlan: 140 members 4,10t vlangroup5: vlan: 150 members 5,10t vlangroup6: vlan: 160 members 6,10t vlangroup7: vlan: 170 members 7,10t vlangroup8: vlan: 180 members 8,10t
I am going ahead and give it a try!
Thank you from here! -
Hmm, probably should remove VLAN1 from the switch. That's interesting, I guess that must be a default. You could probably just change the vlan groups you're defining to start at 0 so it gets replaced. However it won't affect anything since the PVID on the ports is set something other than 1.
Steve
-
It works fine for now. I didn't connect everything at the moment. But I am able to connect now, receiving IP and can organize the VLANs.
As next I need to configure pfsense. Will take some time. thanks guys -
sorry to start the topic again.
I got an m270 and installed pfsense on it. I have inserted the hints for the switch but I can't insert the scripts, keeps throwing me an error No such file or directory when run comand chmod +x for sript
I new and sory for my english -
You need to create those files.
How are you running those commands exactly?
-
@stephenw10 I downloaded one file from the system that has the extension "sh" and modified it with the script gave in previous posts, after which I transferred the file to the "/usr/local/etc/rc.d/" folder. After saving, I tried to start the shell both via the console and via the guia, but it threw out the above error. I writen script in notepad++. I'm a beginner when it comes to these things, so I apologize for some banalities.
-
Ok I assume you mean the switch configuration script as shown here?: https://forum.netgate.com/post/990474
You should create that file not add the code to a existing script.
In my setup I run that script using a shellcmd not via rc.d.
Steve