No DHCP on pfSense VLAN with Cisco Smart Switch

[Cannondale]

johnpoz, this is the output of sho interfaces switchport gi24 (VLAN10 port):

You are the expert here but it doesn't seem reasonable to not expose the PVID in the GUI for Access Mode ports if it is required for VLAN configuration.

[johnpoz]

@cannondale it doesn't need to be expose really since access port can only ever be in 1 vlan, and the pvid should be switched to the vlan you put the access port in.

But seems yours is not doing that..

Try toggle the vlan via cli and see if it switches the native (pvid) if it doesn't then its borked for sure. Not just gui, and I would try rolling back to previous firmware.

A work around would be to put it in general mode where the pvid should be able to be changed.. or set to trunk with just using untagged for egress of vlan and native you can set..

Mine exposes in that it shows what the pvid is in the gui..

[mvikman]

I would say that those differences what the switches are showing are caused by the different way that the firmwares show stuff.
My CBS250 switch shows config more or less the same way as Cannondale's and my network is working fine VLANs and all.

Also these so called business/small business switches don't have the full IOS and different generations seem to behave differently from each other...

[Cannondale]

Thanks for all your help johnpoz! You get the gold star for hanging in there on this issue!
I think I'll try to roll back the firmware as a first step.
When I acquired the switch, it had fw v2.4.0.94, which I upgrade to the latest (v2.5.9.16).
It's possible that it was not upgraded for a reason!

[johnpoz]

@mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

business switches don't have the full IOS

Very true - but its close enough that if you are cisco guy in the enterprise, its damn close ;)

The basics all pretty much the same.. When I first got mine I didn't even use the gui, but figured what the hell lt has it - lets give it a look see.

I do recall having impossible time trying to get the gui to load a ssl for https, had to do that from the cli.

[johnpoz]

@cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

I think I'll try to roll back the firmware as a first step.

Did you try just changing the vlan from the cli, maybe its just a bug in the gui, and if you change the vlan at the client it correctly sets the pvid.

Also prob look in the cisco forums - I will do a quick little gui now that we know its not changing the native vlan for access ports.

[marvosa]

@cannondale

interface GigabitEthernet1
 switchport mode trunk
 switchport trunk allowed vlan 1,10,20

I'd remove vlan 1 from the allowed line on your trunk (Gi1).

Too many odd things that aren't adding up. Rolling back the firmware may work, but if it doesn't, I'd still recommend rebuilding the config from scratch from the cli. You'll likely save yourself countless hours of more troubleshooting.

[Cannondale]

Thanks for the suggestions guys! You both have given me some additional options to try.

[johnpoz]

@marvosa said in No DHCP on pfSense VLAN with Cisco Smart Switch:

I'd remove vlan 1 from the allowed line on your trunk (Gi1).

He is using that, as the native vlan.. Its just untagged so he wouldn't remove it.

[Cannondale]

Just an update. Successfully rolled the firmware back to v2.4.0.94.
This scrambled many of the previously configured settings in the switch so had to reconfirm everything to get back to where I was before the roll back. Unfortunately, the roll back did not change the PVID issue.

Changed port 24 (VLAN10) and port 22 (VLAN20) from Access to Trunk. Note that those are to only two options!
Ran show tech-support again (output of port 22 and 24 below). Both still show
Ingress UnTagged VLAN ( NATIVE ): 1

Classification rules: 
Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
Port : gi22
Port Mode: 
Gvrp Status: disabled
Ingress Filtering: true
Acceptable Frame Type: admitAll
Ingress UnTagged VLAN ( NATIVE ): 1
 
Port is member in: 
 
Vlan               Name               Egress rule     Added by     
---- -------------------------------- ----------- ---------------- 
 20                VL20                Untagged          S         

 
Forbidden VLANS: 
Vlan               Name               
---- -------------------------------- 
 
Classification rules: 
Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
Port : gi24
Port Mode: 
Gvrp Status: disabled
Ingress Filtering: true
Acceptable Frame Type: admitAll
Ingress UnTagged VLAN ( NATIVE ): 1
 
Port is member in: 
 
Vlan               Name               Egress rule     Added by     
---- -------------------------------- ----------- ---------------- 
 10                VL10                Untagged          S         

 
Forbidden VLANS: 
Vlan               Name               
---- -------------------------------- 

The output above is still not showing port mode so here is the output of "sho interfaces switchport gi24 and g122:

Roth-SG250-50P-1#sho interfaces switchport gi24
Gathering information...

Name: gi24
Switchport: enable
Administrative Mode: trunk
Operational Mode: up
Access Mode VLAN: 10
Trunking Native Mode VLAN: 10
Trunking VLANs: 10
                        2-9,11-19,21-4094 (Inactive)
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled
Customer Mode VLAN: none



Classification rules:
                                                      

Roth-SG250-50P-1#sho interfaces switchport gi22
Gathering information...

Name: gi22
Switchport: enable
Administrative Mode: trunk
Operational Mode: down
Access Mode VLAN: 20
Trunking Native Mode VLAN: 20
Trunking VLANs: 20
                        2-9,11-19,21-4094 (Inactive)
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled
Customer Mode VLAN: none

Next step is to rebuilding the config from scratch from the cli as marvosa suggested.
Thanks again!

[Derelict]

@johnpoz I don't have access to a Cisco SG-series switch.

[johnpoz]

@derelict NP - thanks for chiming in.. It was a shot, you and Steve normally have all kinds of stuff ;)

[Cannondale]

Thanks for trying to shake the trees johnpoz!
Started vlan config from scratch. Cleared all vlan config using GUI and only worked in the cli.
Clearing the vlan config using the GUI appears to leave remnant config information when doing the config via cli. Is there a way in cli to clear all vlan config for a particular vlan?

This is what I have so far:

Roth-SG250-50P-1(config)#do sho vlan
Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN

Vlan       Name     gged Ports             UnTagged Ports      Created by    
---- ----------------- ------------------ ------------------ ---------------- 
 1           1                             gi2-23,gi25-50,      DV        
                                                Po1-4                               
 10       AP-vl10                          gi24                 S         



Roth-SG250-50P-1#do sho run int gi1             
interface GigabitEthernet1
 switchport mode trunk
 switchport access vlan 10
 switchport trunk allowed vlan 10
!

Roth-SG250-50P-1#do sho run int gi24
interface GigabitEthernet24
 switchport access vlan 10
!


Roth-SG250-50P-1#sho interfaces switchport gi1
Name: gi1
Switchport: enable
Administrative Mode: trunk
Operational Mode: up
Access Mode VLAN: 10
Trunking Native Mode VLAN: 1 (Inactive)
Trunking VLANs: 10
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled
Customer Mode VLAN: none


Roth-SG250-50P-1#sho interfaces switchport gi24
Name: gi24
Switchport: enable
Administrative Mode: access
Operational Mode: up
Access Mode VLAN: 10
Trunking Native Mode VLAN: 1
Trunking VLANs: 1,10
                        2-9,11-4094 (Inactive)
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled
Customer Mode VLAN: none

The one thing that looks odd to me is:
do sho run int gi1 shows: Trunking Native Mode VLAN: 1 (Inactive)

Does this output look correct?

[johnpoz]

@cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

Does this output look correct?

no not really..

What does your sho tech show for port gi24?

Name: gi24
Switchport: enable
Administrative Mode: access
Operational Mode: up
Access Mode VLAN: 10
Trunking Native Mode VLAN: 1
Trunking VLANs: 1,10
                        2-9,11-4094 (Inactive)
General PVID: 1

For an access port - the native vlan should be the same as the vlan.

It is never going to work if inbound traffic into the port that is not tagged does not get put into vlan 10.

[Cannondale]

@johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

What does your sho tech show for port gi24?

Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
Port : gi24
Port Mode: 
Gvrp Status: disabled
Ingress Filtering: true
Acceptable Frame Type: admitAll
Ingress UnTagged VLAN ( NATIVE ): 1
 
Port is member in: 
 
Vlan               Name               Egress rule     Added by     
---- -------------------------------- ----------- ---------------- 
 10              AP-vl10               Untagged          S

Not good!

[johnpoz]

@cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

Not good!

Nope - this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1..

Well time to start moving up the firmware releases from the one your on now - maybe they had one that wasn't broken..

[Cannondale]

@johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1

LOL

I flashed the firmware back to the latest version before starting the cli-based config.
I’m thinking it time to move on from this switch. Not worth the many hours invested for such a simple task!
I always thought highly of Cisco switches but this one has caused me to sour on the brand a bit!
Is there another bland / model smart poe switch that you would suggest I research?

[johnpoz]

@cannondale yeah I could see that, but I love my sg350's they have been rock freaking solid that is for sure..

how many ports you need/want.. How many of those poe? I have been keeping an eye for my unicorn switch.. No luck as of yet..

What poe are you looking for, I assume poe+, 802.3at, but there is the new 802.3bt in 60w and 100w options as well.

[Cannondale]

Something similar to what I have now would be great!

Capacity (mpps): 74
Switching Capacity (Gbps): 100
PoE: 802.3at PoE+, 802.3af
PoE Ports: 48
PoE Power (Watts): 375

[mvikman]

Just for fun, as a comparison, here's the config from my CBS250 switch, looks almost identical in format/command wise as Cannondale's SG250
Everything is working as it should, pfSense interface has only VLANS configured.

home-sw2_running-config.txt