Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense on Watchguard M270

    Scheduled Pinned Locked Moved Hardware
    133 Posts 18 Posters 42.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Z
      zhellalex
      last edited by stephenw10

      Hello!
      Can't run pfsense plus on firebox m270, network interfaces don't work.
      I first installed pfSense-CE-memstick-serial-2.6.0-RELEASE-amd64 on the laptop. Activated and updated to pfSense Plus 23.01-RELEASE (amd64).
      Installed msata in firebox m270.
      When booting, pfsense plus the following:
      WAN interface as ix0, and LAN interface as ix1
      Added the following content to the /boot/device.hints file:

      hint.mdio.0.at="ix1"
hint.e6000sw.0.addr=0
hint.e6000sw.0.is6190=1
hint.e6000sw.0.port0disabled=1
hint.e6000sw.0.port9cpu=1
hint.e6000sw.0.port10cpu=1
hint.e6000sw.0.port9speed=2500
hint.e6000sw.0.port10speed=2500

      reboot firebox m270
      in the directory /usr/local/etc/rc.d/ created the file fbm270.sh and inserted the following into it:

      #!/bin/sh
#
# Script to setup the switch in the M270
#
# SteveW 5/6/2020
#

echo "Configuring switch..."
logger Configuring switch...

etherswitchcfg vlangroup1 vlan 1 members 9
etherswitchcfg vlangroup2 vlan 2 members 3,4,5,6,7,8,10
etherswitchcfg vlangroup3 vlan 3 members 2,4,5,6,7,8,10
etherswitchcfg vlangroup4 vlan 4 members 2,3,5,6,7,8,10
etherswitchcfg vlangroup5 vlan 5 members 2,3,4,6,7,8,10
etherswitchcfg vlangroup6 vlan 6 members 2,3,4,5,7,8,10
etherswitchcfg vlangroup7 vlan 7 members 2,3,4,5,6,8,10
etherswitchcfg vlangroup8 vlan 8 members 2,3,4,5,6,7,10
etherswitchcfg vlangroup9 vlan 9 members 1
etherswitchcfg vlangroup10 vlan 10 members 2,3,4,5,6,7,8
etherswitchcfg port1 forwarding
etherswitchcfg port2 forwarding
etherswitchcfg port3 forwarding
etherswitchcfg port4 forwarding
etherswitchcfg port5 forwarding
etherswitchcfg port6 forwarding
etherswitchcfg port7 forwarding
etherswitchcfg port8 forwarding

echo "done"
logger done

      run it chmod +x fbm270.sh
      run it ./fbm270.sh
      reboot firebox m270
      after loading pfsence
      boot.png
      firebox m270 ports 0-7 light up when a patch cord is connected. But the device itself is not available via IP 192.168.1.1 on ports 1-7. In the settings, wan chose to connect via dhcp, but with firebox m270 gigabit Ethernet 0 there are no requests to get an ip address via dhcp.
      Switch Configuration:

      etherswitch0: VLAN mode: PORT
port1:
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
port2:
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (1000baseT <full-duplex,master>)
        status: active
port3:
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port4:
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port5:
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port6:
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port7:
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port8:
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port9:
        state=1<DISABLED>
        flags=1<CPUPORT>
        media: Ethernet 2500Base-KX <full-duplex>
        status: active
port10:
        state=1<DISABLED>
        flags=1<CPUPORT>
        media: Ethernet 2500Base-KX <full-duplex>
        status: active
vlangroup1:
        port: 1
        members 9
vlangroup2:
        port: 2
        members 3,4,5,6,7,8,10
vlangroup3:
        port: 3
        members 2,4,5,6,7,8,10
vlangroup4:
        port: 4
        members 2,3,5,6,7,8,10
vlangroup5:
        port: 5
        members 2,3,4,6,7,8,10
vlangroup6:
        port: 6
        members 2,3,4,5,7,8,10
vlangroup7:
        port: 7
        members 2,3,4,5,6,8,10
vlangroup8:
        port: 8
        members 2,3,4,5,6,7,10
vlangroup9:
        port: 9
        members 1
vlangroup10:
        port: 10
        members 2,3,4,5,6,7,8

      Do not tell me what I did wrong or what else needs to be done to make the firebox m270 work?
      Thank you.

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        You can see the internal ports 9 and 10 are disabled. You need to add to the script:

        etherswitchcfg port9 forwarding
etherswitchcfg port10 forwarding

        That is a change in the default behaviour of the switch since I first looked at it.

        Steve

        Z 2 Replies Last reply Reply Quote 0
        • Z
          zhellalex @stephenw10
          last edited by

          @stephenw10

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            ??

            1 Reply Last reply Reply Quote 0
            • Z
              zhellalex @stephenw10
              last edited by

              @stephenw10 Thank you.
              Everything worked.

              1 Reply Last reply Reply Quote 1
              • S
                shaker
                last edited by

                I stephenw10,

                sorry for the late reply, I was on business.

                My etherswitchcfg shows this:

                [23.01-RELEASE][root@pfSense.home.arpa]/root: etherswitchcfg
etherswitch0: VLAN mode: DOT1Q
port1:
        pvid: 110
        state=1<DISABLED>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port2:
        pvid: 120
        state=1<DISABLED>
        flags=0<>
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
port3:
        pvid: 130
        state=1<DISABLED>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port4:
        pvid: 140
        state=1<DISABLED>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port5:
        pvid: 150
        state=1<DISABLED>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port6:
        pvid: 160
        state=1<DISABLED>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port7:
        pvid: 170
        state=1<DISABLED>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port8:
        pvid: 180
        state=1<DISABLED>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port9:
        pvid: 1
        state=1<DISABLED>
        flags=1<CPUPORT>
        media: Ethernet 2500Base-KX <full-duplex>
        status: active
port10:
        pvid: 1
        state=1<DISABLED>
        flags=1<CPUPORT>
        media: Ethernet 2500Base-KX <full-duplex>
        status: active
vlangroup0:
        vlan: 1
        members 1,2,3,4,5,6,7,8,9,10
vlangroup1:
        vlan: 110
        members 1,9t
vlangroup2:
        vlan: 120
        members 2,10t
vlangroup3:
        vlan: 130
        members 3,10t
vlangroup4:
        vlan: 140
        members 4,10t
vlangroup5:
        vlan: 150
        members 5,10t
vlangroup6:
        vlan: 160
        members 6,10t
vlangroup7:
        vlan: 170
        members 7,10t
vlangroup8:
        vlan: 180
        members 8,10t

                What should I do next?

                stephenw10S 1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator @shaker
                  last edited by stephenw10

                  All the ports are in state DISABLED so the script did not set them to FORWARDING correctly.

                  Otherwise it looks good.

                  1 Reply Last reply Reply Quote 0
                  • S
                    shaker
                    last edited by

                    This is the script:

                    #!/bin/sh
#

echo "Configuring switch..."
logger Configuring switch...

etherswitchcfg config vlan_mode DOT1Q

etherswitchcfg vlangroup1 vlan 110 members 1,9t
etherswitchcfg vlangroup2 vlan 120 members 2,10t
etherswitchcfg vlangroup3 vlan 130 members 3,10t
etherswitchcfg vlangroup4 vlan 140 members 4,10t
etherswitchcfg vlangroup5 vlan 150 members 5,10t
etherswitchcfg vlangroup6 vlan 160 members 6,10t
etherswitchcfg vlangroup7 vlan 170 members 7,10t
etherswitchcfg vlangroup8 vlan 180 members 8,10t

etherswitchcfg port1 pvid 110
etherswitchcfg port2 pvid 120
etherswitchcfg port3 pvid 130
etherswitchcfg port4 pvid 140
etherswitchcfg port5 pvid 150
etherswitchcfg port6 pvid 160
etherswitchcfg port7 pvid 170
etherswitchcfg port8 pvid 180


echo "done"
logger done

                    Do I need some forwardings too?

                    R 1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Yes all the switch ports are disabled by default, you still need the section to set each port to forwarding. You might be able to combine that with the pvid. I've not tried that in one command.

                      1 Reply Last reply Reply Quote 0
                      • S
                        shaker
                        last edited by

                        Ok, now it looks like this:

                        etherswitch0: VLAN mode: DOT1Q
port1:
        pvid: 110
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port2:
        pvid: 120
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
port3:
        pvid: 130
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port4:
        pvid: 140
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port5:
        pvid: 150
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port6:
        pvid: 160
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port7:
        pvid: 170
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port8:
        pvid: 180
        state=8<FORWARDING>
        flags=0<>
        media: Ethernet autoselect (none)
        status: no carrier
port9:
        pvid: 1
        state=8<FORWARDING>
        flags=1<CPUPORT>
        media: Ethernet 2500Base-KX <full-duplex>
        status: active
port10:
        pvid: 1
        state=8<FORWARDING>
        flags=1<CPUPORT>
        media: Ethernet 2500Base-KX <full-duplex>
        status: active
vlangroup0:
        vlan: 1
        members 1,2,3,4,5,6,7,8,9,10
vlangroup1:
        vlan: 110
        members 1,9t
vlangroup2:
        vlan: 120
        members 2,10t
vlangroup3:
        vlan: 130
        members 3,10t
vlangroup4:
        vlan: 140
        members 4,10t
vlangroup5:
        vlan: 150
        members 5,10t
vlangroup6:
        vlan: 160
        members 6,10t
vlangroup7:
        vlan: 170
        members 7,10t
vlangroup8:
        vlan: 180
        members 8,10t

                        I am going ahead and give it a try!
                        Thank you from here!

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Hmm, probably should remove VLAN1 from the switch. That's interesting, I guess that must be a default. You could probably just change the vlan groups you're defining to start at 0 so it gets replaced. However it won't affect anything since the PVID on the ports is set something other than 1.

                          Steve

                          1 Reply Last reply Reply Quote 0
                          • S
                            shaker
                            last edited by

                            It works fine for now. I didn't connect everything at the moment. But I am able to connect now, receiving IP and can organize the VLANs.
                            As next I need to configure pfsense. Will take some time. thanks guys

                            1 Reply Last reply Reply Quote 1
                            • V
                              verbatim419
                              last edited by

                              sorry to start the topic again.

                              I got an m270 and installed pfsense on it. I have inserted the hints for the switch but I can't insert the scripts, keeps throwing me an error No such file or directory when run comand chmod +x for sript
                              I new and sory for my english

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                You need to create those files.

                                How are you running those commands exactly?

                                V 1 Reply Last reply Reply Quote 0
                                • V
                                  verbatim419 @stephenw10
                                  last edited by verbatim419

                                  @stephenw10 I downloaded one file from the system that has the extension "sh" and modified it with the script gave in previous posts, after which I transferred the file to the "/usr/local/etc/rc.d/" folder. After saving, I tried to start the shell both via the console and via the guia, but it threw out the above error. I writen script in notepad++. I'm a beginner when it comes to these things, so I apologize for some banalities.

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Ok I assume you mean the switch configuration script as shown here?: https://forum.netgate.com/post/990474

                                    You should create that file not add the code to a existing script.

                                    In my setup I run that script using a shellcmd not via rc.d.

                                    Steve

                                    R V 2 Replies Last reply Reply Quote 0
                                    • R
                                      reiter_f @stephenw10
                                      last edited by

                                      hi, i'm running the M270 too, it works when i switch the ports to forwarding "etherswitchcfg port# forwarding", but it loos the information after rebooting. after the reboot, the ports are disabled

                                      stephenw10S 1 Reply Last reply Reply Quote 0
                                      • P
                                        psp
                                        last edited by

                                        In my setup, I'm running the script @startup in Cron.

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator @reiter_f
                                          last edited by

                                          @reiter_f said in pfSense on Watchguard M270:

                                          but it loos the information after rebooting. after the reboot, the ports are disabled

                                          Yes the switch is reset to defaults at boot. You have to reconfigure it at boot each time. It's easiest to do that using a script.

                                          R 1 Reply Last reply Reply Quote 0
                                          • R
                                            reiter_f @stephenw10
                                            last edited by reiter_f

                                            @stephenw10
                                            ha, there is no default config
                                            file that you are able to write in? i'm a little bit confused of this strategy,. because there is no ROM storage or something like that..... do you know where the config ist writen temporaly?
                                            how do i link the skript to the boot config, that it will run automatical at booting? ... the best would be to Clean all switch-configs before running the skript...

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.