Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No DHCP on pfSense VLAN with Cisco Smart Switch

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    147 Posts 7 Posters 89.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      Cannondale
      last edited by

      Yes pfSense is connected to port 1 of the switch. There are many other machines/devices currently connected to this switch on LAN1 (igb1). All work as expected and have been for months. Only the newly created VLAN10 on port 24 does not work.
      I plugged the workstation (connect to port 24 (VLAN10)) into another switch port and got an DHCP IP as a test to confirm that the workstation was requesting an IP from DHCP on LAN1 (igb1).

      @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

      also where is your pvid listing? Your table shows a P for PVID

      Not sure why the GUI does not show the PVID in the table on the membership page.
      However, it does show PVID under the Customer Mode if I select port 24 and display the membership port details page:

      Screenshot from 2023-05-21 09-48-00.png

      I suspect that the GUI displays the PVID in the membership table depending on the port mode but that's just a guess!

      johnpozJ 1 Reply Last reply Reply Quote 0
      • C
        Cannondale @johnpoz
        last edited by

        @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

        is that a UI, with the I meaning inactive..

        Regarding, the I meaning inactive for port 1, I went into the Port to Lan settings for port 1 and found it was set to "Excluded". I changed it to "Untagged" as I believe that is what it should be. Although it did make any difference. All LAN1 traffic works as expected and VLAN10 still does not.

        Screenshot from 2023-05-21 10-11-17a.png

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @Cannondale
          last edited by

          @cannondale well one thing for sure - not a fan of what I have seen of the sg250 cli vs gui ;)

          Your table legend clearly shows that P would be for the pvid, yet it doesn't show it in the table. From your table vlan 1 on your port 1 is inactive and not even listed as operational on that port, so how would it work?

          Here is what my opinion sofar - something wrong in your switch.. This isn't complicated - native vlan (which is working) comes in untagged, with a trunk port your your other vlans you setup on the trunk would be tagged.

          Traffic coming in on an access port in vlan X should go out any other ports in vlan X be tagged or untagged via the settings on the port... So when your client sends a discover broadcast into a access port in vlan 10, it should come out the port that is marked to be tagged vlan 10..

          Are you running maybe dhcp snooping/guarding?

          snooping.jpg

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          C 1 Reply Last reply Reply Quote 0
          • C
            Cannondale @johnpoz
            last edited by

            @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

            Are you running maybe dhcp snooping/guarding?

            This is not an option in the GUI:

            Screenshot from 2023-05-21 10-22-19.png

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @Cannondale
              last edited by johnpoz

              @cannondale well I am at a loss.. Other than the inconsistencies about your pvid, and showing vlan 1 inactive on your port 1, but your saying it works.. this is pretty basic stuff.

              I have never had any issues setting tagged and untagged vlans on any cisco switch ever worked on, or even any other cheap vlan switch or any other..

              Its just tagged or untagged..

              But from your sniff if pfsense never sees traffic come in tagged, then no its not going to work.

              Maybe someone with a sg250 will chime in on something we are missing..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              C 1 Reply Last reply Reply Quote 0
              • C
                Cannondale @johnpoz
                last edited by

                Thanks for all your help johnpoz! Not sure where to go from here but will wait for others to hopefully chime in as you suggest.

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @Cannondale
                  last edited by

                  @cannondale I would think someone around here would have a sg250 - @stephenw10 and crazy amount of stuff in his lab, or @Derelict also..

                  I even looked if I could get one off amazon for reasonable price ;) I don't mind having switches to play with on my shelf.. I got netgear, dlink, even crappy tplink that had all kinds of issues with vlan, not being able to remove vlan 1 - but they finally fixed that.. And even a unifi flex mini, etc. But my main switches are sg300, a 28 and 10 port..

                  With work have used pretty much every enterprise/smb switch under the sun and have never seen such an issue..

                  Trunk with native untagged vlan and then tagged vlan, device in on port untagged.. Its pretty basic stuff - so missing something stupid.. Does the port 24 work if you just set it back to vlan 1, maybe the port is bad?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  C DerelictD 2 Replies Last reply Reply Quote 0
                  • C
                    Cannondale @johnpoz
                    last edited by

                    I have created vlan 20 on switchport 22 as another test.

                    Screenshot from 2023-05-21 11-01-41.png

                    Screenshot from 2023-05-21 11-04-34.png

                    Do I need to add/configure VLAN20 in pfSense in order to run tcpdump?

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @Cannondale
                      last edited by

                      @cannondale no you don't need to have it setup in pfsense to see the vlan tag with tcpdump -e

                      But now your port vlan membership looks better it doesn't have 1UI, still odd that it doesn't show the P for for which vlan is the pvid, even though it lists there at the top of the table in the legend that P would mean PVID.. so those 1U should show up as 1UP

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      C 1 Reply Last reply Reply Quote 0
                      • C
                        Cannondale @johnpoz
                        last edited by

                        Great! I'll give that a try.

                        @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                        But now your port vlan membership looks better it doesn't have 1UI

                        I went into the Port to Lan settings for port 1 and found it was set to "Excluded". I changed it to "Untagged" earlier.

                        @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                        still odd that it doesn't show the P for for which vlan is the pvid, even though it lists there at the top of the table in the legend that P would mean PVID.. so those 1U should show up as 1UP

                        Agreed! You would know better than me! Maybe a quirky Cisco thing! :)
                        I have only had this switch for about two months. I knew going in that Cisco UI's were a bit funky but it had the features that I was looking for!

                        johnpozJ M 2 Replies Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @Cannondale
                          last edited by

                          @cannondale never been a gui guy with most switches.. Other than the cheap 40$ vlan ones - so not sure how quirky cisco gui is, these sg300s are the first cisco switches have used a gui with.

                          I don't recall coming across and weirdness in the sg300 gui, even with previous firmwares - I think there was awhile that one specific feature page wouldn't work with firefox.. But don't recall if that went away with update to firefox, or update to firmware.. This firmware is dated, this switch is nearing eol, and its firmware has not been updated in quite some time. At least your sg250 firmware is recent..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • M
                            marvosa @Cannondale
                            last edited by

                            @cannondale Can post the full running-config from the switch and the firewall rule(s) on the VLAN10 interface?

                            johnpozJ C 2 Replies Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @marvosa
                              last edited by

                              @marvosa he says he did post the config - but doesn't look full to me at all, maybe he snipped out stuff? Cuz its clearly missing a bunch of info..

                              Maybe maybe a "sho tech-support" would be good thing to take a look.

                              As to his rules on his vlan 10 interface, doesn't really matter at this point what those are - if his dhcp is enabled then their would be hidden rules to allow that, and doesn't matter what rules are there when he did his tcpdump -e and didn't see anything with vlan 10 tag.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              M 1 Reply Last reply Reply Quote 0
                              • M
                                marvosa @johnpoz
                                last edited by marvosa

                                @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                he says he did post the config - but doesn't look full to me at all, maybe he snipped out stuff? Cuz its clearly missing a bunch of info..

                                Yeah, I saw that. Agreed, it's clearly missing tons of info... was hoping to take a peek at the "full" config if possible. As mentioned, if a sh run doesn't get us there (and idk why it wouldn't), try attaching a show tech.

                                @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                As to his rules on his vlan 10 interface, doesn't really matter at this point what those are - if his dhcp is enabled then their would be hidden rules to allow that, and doesn't matter what rules are there when he did his tcpdump -e and didn't see anything with vlan 10 tag.

                                I don't disagree. I'm more curious than anything... considering on occasion... what's been stated doesn't always match up with what's actually been configured.... so putting eyes on it can be helpful.

                                TBH, if we're not seeing tagged vlan 10 traffic from the PFsense capture, then nothing's leaving the switch (or the capture was taken on the wrong interface). I'd personally do a write erase and re-configure the switch from the CLI. However, still curious to see the full config and the firewall rules regardless ;)

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @marvosa
                                  last edited by

                                  @marvosa said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                  write erase and re-configure the switch from the CLI.

                                  It sure couldn't hurt - its not like he has anything fancy already on there - looks like everything is just vlan 1.. So not like he would have to take down his whole network while he redoes some crazy config.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    Cannondale @marvosa
                                    last edited by

                                    marvosa, thanks for chiming in. I copied the previously posted from a backup made in the GUI Administration | File Management | File Operations. If there is another way to produce a more complete file, let me know.

                                    VLAN10 firewall rule below:
                                    Screenshot from 2023-05-21 15-11-59.png

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @Cannondale
                                      last edited by

                                      @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                      produce a more complete file, let me know.

                                      a show run should give you the whole config..

                                      Or a show tech-support would spit out everything..

                                      So it doesn't page on you, not sure if works on sg250, but works on my sg300 I do a

                                      term datadump

                                      This prevents long outputs from stopping and have to hit key to see more, etc.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      C 2 Replies Last reply Reply Quote 0
                                      • C
                                        Cannondale @johnpoz
                                        last edited by

                                        @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                        a show run should give you the whole config.

                                        Output from show run:

                                        Roth-SG250-50P-1#show run
                                        config-file-header
                                        Roth-SG250-50P-1
                                        v2.5.9.16 / RCBS3.1_930_871_108
                                        CLI v1.0
                                        file SSD indicator encrypted
                                        @
                                        ssd-control-start
                                        ssd config
                                        ssd file passphrase control unrestricted
                                        no ssd file integrity control
                                        ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0
                                        !
                                        !
                                        unit-type-control-start
                                        unit-type unit 1 network gi uplink none
                                        unit-type-control-end
                                        !
                                        vlan database
                                        vlan 10,20
                                        exit
                                        voice vlan state auto-triggered
                                        voice vlan oui-table add 0001e3 Siemens_AG_phone________
                                        voice vlan oui-table add 00036b Cisco_phone_____________
                                        voice vlan oui-table add 00096e Avaya___________________
                                        voice vlan oui-table add 000fe2 H3C_Aolynk______________
                                        voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
                                        voice vlan oui-table add 00d01e Pingtel_phone___________
                                        voice vlan oui-table add 00e075 Polycom/Veritel_phone___
                                        voice vlan oui-table add 00e0bb 3Com_phone______________
                                        no boot host auto-config
                                        no boot host auto-update
                                        no bonjour enable
                                        bonjour interface range vlan 1
                                        hostname Roth-SG250-50P-1
                                        line telnet
                                        exec-timeout 30
                                        exit
                                        username jer password encrypted $86$5/Jf/f1pY8/95XGv$kPRdzeRMBXmEdsjyTZ1l4+OqCg9fuZ7uKSe5I7LV9IbcgUpUgGQXoGLMEO1AZF52onsZ3HTShH3OYBSXslXbVA== privilege 15
                                        username jer2 password encrypted $86$Jd6VBm9YYE9hsEqS$Wr7/T+o2oqDACWSHr0SNJrmwXG2QQ3MS+4EG1j6BknUM6Z8LMYb1/kokfIc3KefDaW5JkhtnW3+gJTnr3sbDJA== privilege 15
                                        username cisco password encrypted $86$/AkLn2WkB5AHHhIy$e/TgE126IBbIHLLsdMMw6ozjTovM1bR132PxH3lGmJeltzZ4U3ug9F3ZaUl+BclKIcE60h2j7Sn6o7RYksS53g==
                                        ip ssh server
                                        ip http timeout-policy 0
                                        clock timezone J -4
                                        clock dhcp timezone
                                        ip telnet server                                      
                                        !
                                        interface vlan 10
                                         name "VL10"
                                         no snmp trap link-status
                                        !
                                        interface vlan 20
                                         name "VL20"
                                         no snmp trap link-status
                                        !
                                        interface GigabitEthernet1
                                         switchport mode trunk
                                         switchport trunk allowed vlan 1,10,20
                                        !
                                        interface GigabitEthernet22
                                         switchport access vlan 20
                                        !
                                        interface GigabitEthernet24
                                         switchport access vlan 10
                                        !
                                        exit
                                        Roth-SG250-50P-1#
                                        
                                        
                                        M 1 Reply Last reply Reply Quote 0
                                        • C
                                          Cannondale @johnpoz
                                          last edited by

                                          @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                          Or a show tech-support would spit out everything.

                                          show tech-support output attached as file.

                                          Cannondale show tech-support 20230521.txt

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @Cannondale
                                            last edited by johnpoz

                                            @cannondale ok this would explain why not working..

                                            Port : gi22
                                            Port Mode: 
                                            Gvrp Status: disabled
                                            Ingress Filtering: true
                                            Acceptable Frame Type: admitAll
                                            Ingress UnTagged VLAN ( NATIVE ): 1
                                             
                                            Port is member in: 
                                             
                                            Vlan               Name               Egress rule     Added by     
                                            ---- -------------------------------- ----------- ---------------- 
                                             20                VL20                Untagged          S         
                                            
                                            Port : gi24
                                            Port Mode: 
                                            Gvrp Status: disabled
                                            Ingress Filtering: true
                                            Acceptable Frame Type: admitAll
                                            Ingress UnTagged VLAN ( NATIVE ): 1
                                             
                                            Port is member in: 
                                             
                                            Vlan               Name               Egress rule     Added by     
                                            ---- -------------------------------- ----------- ---------------- 
                                             10                VL10                Untagged          S         
                                            

                                            Notice the
                                            Ingress UnTagged VLAN ( NATIVE ): 1

                                            This is the PVID.. So your untagged traffic coming into the switch from your device would be on vlan 1, so no it would never go out port 1 tagged for the vlan 10 or 20 on these ports.

                                            And your ports would be egress untagged on 10 and 20 of these ports.. But the answer from pfsense on its lan for dhcp would would be on vlan 1...

                                            You should of been seeing the dhcp from these devices - just on the wrong dhcp server.

                                            Port : gi1
                                            Port Mode: 
                                            Gvrp Status: disabled
                                            Ingress Filtering: true
                                            Acceptable Frame Type: admitAll
                                            Ingress UnTagged VLAN ( NATIVE ): 1
                                             
                                            Port is member in: 
                                             
                                            Vlan               Name               Egress rule     Added by     
                                            ---- -------------------------------- ----------- ---------------- 
                                             1                  1                  Untagged          V         
                                             10                VL10                 Tagged           S         
                                             20                VL20                 Tagged           S         
                                            

                                            edit: notice one of my ports that I have a device on vlan 6, which is one that is tagged to pfsense, see the native vlan or pvid for that port is set to 6

                                            sg300-28#show interfaces switchport gi18
                                            Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                            Port : gi18
                                            Port Mode: Access 
                                            Gvrp Status: disabled
                                            Ingress Filtering: true
                                            Acceptable Frame Type: admitAll
                                            Ingress UnTagged VLAN ( NATIVE ): 6
                                             
                                            Port is member in: 
                                             
                                            Vlan               Name               Egress rule     Added by     
                                            ---- -------------------------------- ----------- ---------------- 
                                             6               W_Guest               Untagged          S         
                                            

                                            Also curious why all your ports mode is just blank

                                            Port Mode:

                                            It should be showing trunk or access.. see mine above for gi18, and then on the one that goes to my pfsense

                                            sg300-28#show interfaces switchport gi5
                                            Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                            Port : gi5
                                            Port Mode: Trunk
                                            Gvrp Status: disabled
                                            Ingress Filtering: true
                                            Acceptable Frame Type: admitAll
                                            Ingress UnTagged VLAN ( NATIVE ): 2
                                             
                                            Port is member in: 
                                             
                                            Vlan               Name               Egress rule     Added by     
                                            ---- -------------------------------- ----------- ---------------- 
                                             2                 Wlan                Untagged          S         
                                             4                W_PSK                 Tagged           S         
                                             6               W_Guest                Tagged           S         
                                            

                                            So your port 1 looks ok, other then the missing port mode that is odd. But your ports 22 and 24 should have the native vlan (pvid) set to vlan 10 and 20 etc..

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            C 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.