Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No DHCP on pfSense VLAN with Cisco Smart Switch

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    147 Posts 7 Posters 89.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @Cannondale
      last edited by johnpoz

      @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

      Can the PVID be changed in the CLI?

      I don't think so not for a access port.. On my sg300 if I change the access port vlan it auto changes the pvid..

      example here is port 28

      sg300-28#sho interfaces switchport gi28
      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
      Port : gi28
      Port Mode: Access 
      Gvrp Status: disabled
      Ingress Filtering: true
      Acceptable Frame Type: admitAll
      Ingress UnTagged VLAN ( NATIVE ): 10
       
      Port is member in: 
       
      Vlan               Name               Egress rule     Added by     
      ---- -------------------------------- ----------- ---------------- 
       10              disabled              Untagged          S         
      

      If I then put in say vlan 6.. via the with the little arrows to remove it from 10 and add 6 while picking untagged..

      guivlan.jpg

      sg300-28#sho interfaces switchport gi28
      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
      Port : gi28
      Port Mode: Access 
      Gvrp Status: disabled
      Ingress Filtering: true
      Acceptable Frame Type: admitAll
      Ingress UnTagged VLAN ( NATIVE ): 6
       
      Port is member in: 
       
      Vlan               Name               Egress rule     Added by     
      ---- -------------------------------- ----------- ---------------- 
       6               W_Guest               Untagged          S         
      

      You could try putting it in vlan 10 or 20 from the cli and see if that works..

      example - here is me moving it back to 10

      sg300-28#sho interfaces switchport gi28
      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
      Port : gi28
      Port Mode: Access 
      Gvrp Status: disabled
      Ingress Filtering: true
      Acceptable Frame Type: admitAll
      Ingress UnTagged VLAN ( NATIVE ): 6
       
      Port is member in: 
       
      Vlan               Name               Egress rule     Added by     
      ---- -------------------------------- ----------- ---------------- 
       6               W_Guest               Untagged          S         
      
       
      Forbidden VLANS: 
      Vlan               Name               
      ---- -------------------------------- 
      
       
      Classification rules: 
      sg300-28#conf t
      sg300-28(config)#int gi28
      sg300-28(config-if)#switchport access vlan 10
      sg300-28(config-if)#exit
      sg300-28(config)#exit
      sg300-28#sho interfaces switchport gi28
      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
      Port : gi28
      Port Mode: Access 
      Gvrp Status: disabled
      Ingress Filtering: true
      Acceptable Frame Type: admitAll
      Ingress UnTagged VLAN ( NATIVE ): 10
       
      Port is member in: 
       
      Vlan               Name               Egress rule     Added by     
      ---- -------------------------------- ----------- ---------------- 
       10              disabled              Untagged          S         
      
       
      Forbidden VLANS: 
      Vlan               Name               
      ---- -------------------------------- 
      
       
      Classification rules: 
      sg300-28#
      

      I don't really like that your gui doesn't show mode, nor the P that it has in its legends that should mark what the pvid is, etc. Maybe you want to roll back in the firmware.. Maybe there is something wrong with this firmware.. But it for sure is not going to work if untagged traffic coming from your device is going on to vlan 1 vs 10..

      maybe you could just put 22 or 24 into trunk mode or general mode.. And be able to set the pvid, and just set vlan 10 or 20 to be untagged..

      You might want to ask on the cisco forums.. I doubt you have support from cisco ;)

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      C 1 Reply Last reply Reply Quote 0
      • C
        Cannondale @johnpoz
        last edited by

        johnpoz, this is the output of sho interfaces switchport gi24 (VLAN10 port):

        Screenshot from 2023-05-21 16-51-04.png

        You are the expert here but it doesn't seem reasonable to not expose the PVID in the GUI for Access Mode ports if it is required for VLAN configuration.

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @Cannondale
          last edited by johnpoz

          @cannondale it doesn't need to be expose really since access port can only ever be in 1 vlan, and the pvid should be switched to the vlan you put the access port in.

          But seems yours is not doing that..

          Try toggle the vlan via cli and see if it switches the native (pvid) if it doesn't then its borked for sure. Not just gui, and I would try rolling back to previous firmware.

          A work around would be to put it in general mode where the pvid should be able to be changed.. or set to trunk with just using untagged for egress of vlan and native you can set..

          Mine exposes in that it shows what the pvid is in the gui..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          C 1 Reply Last reply Reply Quote 0
          • M
            mvikman
            last edited by

            I would say that those differences what the switches are showing are caused by the different way that the firmwares show stuff.
            My CBS250 switch shows config more or less the same way as Cannondale's and my network is working fine VLANs and all.

            Also these so called business/small business switches don't have the full IOS and different generations seem to behave differently from each other...

            pfSense Plus 24.11-RELEASE (amd64)
            Dell Optiplex 7040 SFF
            Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
            HPE 561T (X540-AT2), 2-port 10Gb RJ45
            HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

            johnpozJ 1 Reply Last reply Reply Quote 0
            • C
              Cannondale @johnpoz
              last edited by

              Thanks for all your help johnpoz! You get the gold star for hanging in there on this issue!
              I think I'll try to roll back the firmware as a first step.
              When I acquired the switch, it had fw v2.4.0.94, which I upgrade to the latest (v2.5.9.16).
              It's possible that it was not upgraded for a reason!

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @mvikman
                last edited by

                @mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                business switches don't have the full IOS

                Very true - but its close enough that if you are cisco guy in the enterprise, its damn close ;)

                The basics all pretty much the same.. When I first got mine I didn't even use the gui, but figured what the hell lt has it - lets give it a look see.

                I do recall having impossible time trying to get the gui to load a ssl for https, had to do that from the cli.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @Cannondale
                  last edited by

                  @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                  I think I'll try to roll back the firmware as a first step.

                  Did you try just changing the vlan from the cli, maybe its just a bug in the gui, and if you change the vlan at the client it correctly sets the pvid.

                  Also prob look in the cisco forums - I will do a quick little gui now that we know its not changing the native vlan for access ports.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  1 Reply Last reply Reply Quote 0
                  • M
                    marvosa @Cannondale
                    last edited by

                    @cannondale

                    interface GigabitEthernet1
                     switchport mode trunk
                     switchport trunk allowed vlan 1,10,20
                    

                    I'd remove vlan 1 from the allowed line on your trunk (Gi1).

                    Too many odd things that aren't adding up. Rolling back the firmware may work, but if it doesn't, I'd still recommend rebuilding the config from scratch from the cli. You'll likely save yourself countless hours of more troubleshooting.

                    C johnpozJ 2 Replies Last reply Reply Quote 0
                    • C
                      Cannondale @marvosa
                      last edited by

                      Thanks for the suggestions guys! You both have given me some additional options to try.

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @marvosa
                        last edited by johnpoz

                        @marvosa said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                        I'd remove vlan 1 from the allowed line on your trunk (Gi1).

                        He is using that, as the native vlan.. Its just untagged so he wouldn't remove it.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        C 1 Reply Last reply Reply Quote 0
                        • C
                          Cannondale @johnpoz
                          last edited by

                          Just an update. Successfully rolled the firmware back to v2.4.0.94.
                          This scrambled many of the previously configured settings in the switch so had to reconfirm everything to get back to where I was before the roll back. Unfortunately, the roll back did not change the PVID issue.

                          Changed port 24 (VLAN10) and port 22 (VLAN20) from Access to Trunk. Note that those are to only two options!
                          Ran show tech-support again (output of port 22 and 24 below). Both still show
                          Ingress UnTagged VLAN ( NATIVE ): 1

                          Classification rules: 
                          Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                          Port : gi22
                          Port Mode: 
                          Gvrp Status: disabled
                          Ingress Filtering: true
                          Acceptable Frame Type: admitAll
                          Ingress UnTagged VLAN ( NATIVE ): 1
                           
                          Port is member in: 
                           
                          Vlan               Name               Egress rule     Added by     
                          ---- -------------------------------- ----------- ---------------- 
                           20                VL20                Untagged          S         
                          
                           
                          Forbidden VLANS: 
                          Vlan               Name               
                          ---- -------------------------------- 
                           
                          Classification rules: 
                          Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                          Port : gi24
                          Port Mode: 
                          Gvrp Status: disabled
                          Ingress Filtering: true
                          Acceptable Frame Type: admitAll
                          Ingress UnTagged VLAN ( NATIVE ): 1
                           
                          Port is member in: 
                           
                          Vlan               Name               Egress rule     Added by     
                          ---- -------------------------------- ----------- ---------------- 
                           10                VL10                Untagged          S         
                          
                           
                          Forbidden VLANS: 
                          Vlan               Name               
                          ---- -------------------------------- 
                          

                          The output above is still not showing port mode so here is the output of "sho interfaces switchport gi24 and g122:

                          Roth-SG250-50P-1#sho interfaces switchport gi24
                          Gathering information...
                          
                          Name: gi24
                          Switchport: enable
                          Administrative Mode: trunk
                          Operational Mode: up
                          Access Mode VLAN: 10
                          Trunking Native Mode VLAN: 10
                          Trunking VLANs: 10
                                                  2-9,11-19,21-4094 (Inactive)
                          General PVID: 1
                          General VLANs: none
                          General Egress Tagged VLANs: none
                          General Forbidden VLANs: none
                          General Ingress Filtering: enabled
                          General Acceptable Frame Type: all
                          General GVRP status: disabled
                          Customer Mode VLAN: none
                          
                          
                          
                          Classification rules:
                                                                                
                          
                          Roth-SG250-50P-1#sho interfaces switchport gi22
                          Gathering information...
                          
                          Name: gi22
                          Switchport: enable
                          Administrative Mode: trunk
                          Operational Mode: down
                          Access Mode VLAN: 20
                          Trunking Native Mode VLAN: 20
                          Trunking VLANs: 20
                                                  2-9,11-19,21-4094 (Inactive)
                          General PVID: 1
                          General VLANs: none
                          General Egress Tagged VLANs: none
                          General Forbidden VLANs: none
                          General Ingress Filtering: enabled
                          General Acceptable Frame Type: all
                          General GVRP status: disabled
                          Customer Mode VLAN: none
                          
                          
                          

                          Next step is to rebuilding the config from scratch from the cli as marvosa suggested.
                          Thanks again!

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate @johnpoz
                            last edited by

                            @johnpoz I don't have access to a Cisco SG-series switch.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @Derelict
                              last edited by

                              @derelict NP - thanks for chiming in.. It was a shot, you and Steve normally have all kinds of stuff ;)

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              C 1 Reply Last reply Reply Quote 0
                              • C
                                Cannondale @johnpoz
                                last edited by

                                Thanks for trying to shake the trees johnpoz!
                                Started vlan config from scratch. Cleared all vlan config using GUI and only worked in the cli.
                                Clearing the vlan config using the GUI appears to leave remnant config information when doing the config via cli. Is there a way in cli to clear all vlan config for a particular vlan?

                                This is what I have so far:

                                Roth-SG250-50P-1(config)#do sho vlan
                                Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN
                                
                                Vlan       Name     gged Ports             UnTagged Ports      Created by    
                                ---- ----------------- ------------------ ------------------ ---------------- 
                                 1           1                             gi2-23,gi25-50,      DV        
                                                                                Po1-4                               
                                 10       AP-vl10                          gi24                 S         
                                
                                
                                
                                Roth-SG250-50P-1#do sho run int gi1             
                                interface GigabitEthernet1
                                 switchport mode trunk
                                 switchport access vlan 10
                                 switchport trunk allowed vlan 10
                                !
                                
                                Roth-SG250-50P-1#do sho run int gi24
                                interface GigabitEthernet24
                                 switchport access vlan 10
                                !
                                
                                
                                Roth-SG250-50P-1#sho interfaces switchport gi1
                                Name: gi1
                                Switchport: enable
                                Administrative Mode: trunk
                                Operational Mode: up
                                Access Mode VLAN: 10
                                Trunking Native Mode VLAN: 1 (Inactive)
                                Trunking VLANs: 10
                                General PVID: 1
                                General VLANs: none
                                General Egress Tagged VLANs: none
                                General Forbidden VLANs: none
                                General Ingress Filtering: enabled
                                General Acceptable Frame Type: all
                                General GVRP status: disabled
                                Customer Mode VLAN: none
                                
                                
                                Roth-SG250-50P-1#sho interfaces switchport gi24
                                Name: gi24
                                Switchport: enable
                                Administrative Mode: access
                                Operational Mode: up
                                Access Mode VLAN: 10
                                Trunking Native Mode VLAN: 1
                                Trunking VLANs: 1,10
                                                        2-9,11-4094 (Inactive)
                                General PVID: 1
                                General VLANs: none
                                General Egress Tagged VLANs: none
                                General Forbidden VLANs: none
                                General Ingress Filtering: enabled
                                General Acceptable Frame Type: all
                                General GVRP status: disabled
                                Customer Mode VLAN: none
                                

                                The one thing that looks odd to me is:
                                do sho run int gi1 shows: Trunking Native Mode VLAN: 1 (Inactive)

                                Does this output look correct?

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @Cannondale
                                  last edited by

                                  @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                  Does this output look correct?

                                  no not really..

                                  What does your sho tech show for port gi24?

                                  Name: gi24
                                  Switchport: enable
                                  Administrative Mode: access
                                  Operational Mode: up
                                  Access Mode VLAN: 10
                                  Trunking Native Mode VLAN: 1
                                  Trunking VLANs: 1,10
                                                          2-9,11-4094 (Inactive)
                                  General PVID: 1
                                  

                                  For an access port - the native vlan should be the same as the vlan.

                                  It is never going to work if inbound traffic into the port that is not tagged does not get put into vlan 10.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                  C 1 Reply Last reply Reply Quote 0
                                  • C
                                    Cannondale @johnpoz
                                    last edited by

                                    @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                    What does your sho tech show for port gi24?

                                    Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                    Port : gi24
                                    Port Mode: 
                                    Gvrp Status: disabled
                                    Ingress Filtering: true
                                    Acceptable Frame Type: admitAll
                                    Ingress UnTagged VLAN ( NATIVE ): 1
                                     
                                    Port is member in: 
                                     
                                    Vlan               Name               Egress rule     Added by     
                                    ---- -------------------------------- ----------- ---------------- 
                                     10              AP-vl10               Untagged          S
                                    

                                    Not good!

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @Cannondale
                                      last edited by

                                      @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                      Not good!

                                      Nope - this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1..

                                      Well time to start moving up the firmware releases from the one your on now - maybe they had one that wasn't broken..

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                      C 1 Reply Last reply Reply Quote 0
                                      • C
                                        Cannondale @johnpoz
                                        last edited by

                                        @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                        this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1

                                        LOL

                                        I flashed the firmware back to the latest version before starting the cli-based config.
                                        I’m thinking it time to move on from this switch. Not worth the many hours invested for such a simple task!
                                        I always thought highly of Cisco switches but this one has caused me to sour on the brand a bit!
                                        Is there another bland / model smart poe switch that you would suggest I research?

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @Cannondale
                                          last edited by

                                          @cannondale yeah I could see that, but I love my sg350's they have been rock freaking solid that is for sure..

                                          how many ports you need/want.. How many of those poe? I have been keeping an eye for my unicorn switch.. No luck as of yet..

                                          What poe are you looking for, I assume poe+, 802.3at, but there is the new 802.3bt in 60w and 100w options as well.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          C 1 Reply Last reply Reply Quote 0
                                          • C
                                            Cannondale @johnpoz
                                            last edited by

                                            Something similar to what I have now would be great!

                                            Capacity (mpps): 74
                                            Switching Capacity (Gbps): 100
                                            PoE: 802.3at PoE+, 802.3af
                                            PoE Ports: 48
                                            PoE Power (Watts): 375

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.