No DHCP on pfSense VLAN with Cisco Smart Switch

johnpoz · May 21, 2023, 9:32 PM

@mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

business switches don't have the full IOS

Very true - but its close enough that if you are cisco guy in the enterprise, its damn close ;)

The basics all pretty much the same.. When I first got mine I didn't even use the gui, but figured what the hell lt has it - lets give it a look see.

I do recall having impossible time trying to get the gui to load a ssl for https, had to do that from the cli.

johnpoz · May 21, 2023, 9:35 PM

@cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

I think I'll try to roll back the firmware as a first step.

Did you try just changing the vlan from the cli, maybe its just a bug in the gui, and if you change the vlan at the client it correctly sets the pvid.

Also prob look in the cisco forums - I will do a quick little gui now that we know its not changing the native vlan for access ports.

marvosa · May 21, 2023, 10:32 PM

@cannondale

interface GigabitEthernet1
 switchport mode trunk
 switchport trunk allowed vlan 1,10,20

I'd remove vlan 1 from the allowed line on your trunk (Gi1).

Too many odd things that aren't adding up. Rolling back the firmware may work, but if it doesn't, I'd still recommend rebuilding the config from scratch from the cli. You'll likely save yourself countless hours of more troubleshooting.

Cannondale · May 21, 2023, 11:27 PM

Thanks for the suggestions guys! You both have given me some additional options to try.

johnpoz · May 22, 2023, 1:13 AM

@marvosa said in No DHCP on pfSense VLAN with Cisco Smart Switch:

I'd remove vlan 1 from the allowed line on your trunk (Gi1).

He is using that, as the native vlan.. Its just untagged so he wouldn't remove it.

Cannondale · May 22, 2023, 1:13 AM

Just an update. Successfully rolled the firmware back to v2.4.0.94.
This scrambled many of the previously configured settings in the switch so had to reconfirm everything to get back to where I was before the roll back. Unfortunately, the roll back did not change the PVID issue.

Changed port 24 (VLAN10) and port 22 (VLAN20) from Access to Trunk. Note that those are to only two options!
Ran show tech-support again (output of port 22 and 24 below). Both still show
Ingress UnTagged VLAN ( NATIVE ): 1

Classification rules: 
Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
Port : gi22
Port Mode: 
Gvrp Status: disabled
Ingress Filtering: true
Acceptable Frame Type: admitAll
Ingress UnTagged VLAN ( NATIVE ): 1
 
Port is member in: 
 
Vlan               Name               Egress rule     Added by     
---- -------------------------------- ----------- ---------------- 
 20                VL20                Untagged          S         

 
Forbidden VLANS: 
Vlan               Name               
---- -------------------------------- 
 
Classification rules: 
Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
Port : gi24
Port Mode: 
Gvrp Status: disabled
Ingress Filtering: true
Acceptable Frame Type: admitAll
Ingress UnTagged VLAN ( NATIVE ): 1
 
Port is member in: 
 
Vlan               Name               Egress rule     Added by     
---- -------------------------------- ----------- ---------------- 
 10                VL10                Untagged          S         

 
Forbidden VLANS: 
Vlan               Name               
---- --------------------------------

The output above is still not showing port mode so here is the output of "sho interfaces switchport gi24 and g122:

Roth-SG250-50P-1#sho interfaces switchport gi24
Gathering information...

Name: gi24
Switchport: enable
Administrative Mode: trunk
Operational Mode: up
Access Mode VLAN: 10
Trunking Native Mode VLAN: 10
Trunking VLANs: 10
                        2-9,11-19,21-4094 (Inactive)
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled
Customer Mode VLAN: none



Classification rules:
                                                      

Roth-SG250-50P-1#sho interfaces switchport gi22
Gathering information...

Name: gi22
Switchport: enable
Administrative Mode: trunk
Operational Mode: down
Access Mode VLAN: 20
Trunking Native Mode VLAN: 20
Trunking VLANs: 20
                        2-9,11-19,21-4094 (Inactive)
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled
Customer Mode VLAN: none

Next step is to rebuilding the config from scratch from the cli as marvosa suggested.
Thanks again!

Derelict · May 22, 2023, 4:37 PM

@johnpoz I don't have access to a Cisco SG-series switch.

johnpoz · May 22, 2023, 4:52 PM

@derelict NP - thanks for chiming in.. It was a shot, you and Steve normally have all kinds of stuff ;)

Cannondale · May 22, 2023, 5:54 PM

Thanks for trying to shake the trees johnpoz!
Started vlan config from scratch. Cleared all vlan config using GUI and only worked in the cli.
Clearing the vlan config using the GUI appears to leave remnant config information when doing the config via cli. Is there a way in cli to clear all vlan config for a particular vlan?

This is what I have so far:

Roth-SG250-50P-1(config)#do sho vlan
Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN

Vlan       Name     gged Ports             UnTagged Ports      Created by    
---- ----------------- ------------------ ------------------ ---------------- 
 1           1                             gi2-23,gi25-50,      DV        
                                                Po1-4                               
 10       AP-vl10                          gi24                 S         



Roth-SG250-50P-1#do sho run int gi1             
interface GigabitEthernet1
 switchport mode trunk
 switchport access vlan 10
 switchport trunk allowed vlan 10
!

Roth-SG250-50P-1#do sho run int gi24
interface GigabitEthernet24
 switchport access vlan 10
!


Roth-SG250-50P-1#sho interfaces switchport gi1
Name: gi1
Switchport: enable
Administrative Mode: trunk
Operational Mode: up
Access Mode VLAN: 10
Trunking Native Mode VLAN: 1 (Inactive)
Trunking VLANs: 10
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled
Customer Mode VLAN: none


Roth-SG250-50P-1#sho interfaces switchport gi24
Name: gi24
Switchport: enable
Administrative Mode: access
Operational Mode: up
Access Mode VLAN: 10
Trunking Native Mode VLAN: 1
Trunking VLANs: 1,10
                        2-9,11-4094 (Inactive)
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled
Customer Mode VLAN: none

The one thing that looks odd to me is:
do sho run int gi1 shows: Trunking Native Mode VLAN: 1 (Inactive)

Does this output look correct?

johnpoz · May 22, 2023, 6:10 PM

@cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

Does this output look correct?

no not really..

What does your sho tech show for port gi24?

Name: gi24
Switchport: enable
Administrative Mode: access
Operational Mode: up
Access Mode VLAN: 10
Trunking Native Mode VLAN: 1
Trunking VLANs: 1,10
                        2-9,11-4094 (Inactive)
General PVID: 1

For an access port - the native vlan should be the same as the vlan.

It is never going to work if inbound traffic into the port that is not tagged does not get put into vlan 10.

Cannondale · May 22, 2023, 6:58 PM

@johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

What does your sho tech show for port gi24?

Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
Port : gi24
Port Mode: 
Gvrp Status: disabled
Ingress Filtering: true
Acceptable Frame Type: admitAll
Ingress UnTagged VLAN ( NATIVE ): 1
 
Port is member in: 
 
Vlan               Name               Egress rule     Added by     
---- -------------------------------- ----------- ---------------- 
 10              AP-vl10               Untagged          S

Not good!

johnpoz · May 22, 2023, 7:09 PM

@cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

Not good!

Nope - this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1..

Well time to start moving up the firmware releases from the one your on now - maybe they had one that wasn't broken..

Cannondale · May 22, 2023, 7:13 PM

@johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1

LOL

I flashed the firmware back to the latest version before starting the cli-based config.
I’m thinking it time to move on from this switch. Not worth the many hours invested for such a simple task!
I always thought highly of Cisco switches but this one has caused me to sour on the brand a bit!
Is there another bland / model smart poe switch that you would suggest I research?

johnpoz · May 22, 2023, 7:19 PM

@cannondale yeah I could see that, but I love my sg350's they have been rock freaking solid that is for sure..

how many ports you need/want.. How many of those poe? I have been keeping an eye for my unicorn switch.. No luck as of yet..

What poe are you looking for, I assume poe+, 802.3at, but there is the new 802.3bt in 60w and 100w options as well.

Cannondale · May 22, 2023, 7:30 PM

Something similar to what I have now would be great!

Capacity (mpps): 74
Switching Capacity (Gbps): 100
PoE: 802.3at PoE+, 802.3af
PoE Ports: 48
PoE Power (Watts): 375

mvikman · May 22, 2023, 9:44 PM

Just for fun, as a comparison, here's the config from my CBS250 switch, looks almost identical in format/command wise as Cannondale's SG250
Everything is working as it should, pfSense interface has only VLANS configured.

home-sw2_running-config.txt

johnpoz · May 22, 2023, 9:52 PM

@mvikman Hey could you post the output of your show tech so we can see what it says the pvid is..

say ports 4 and 5 that have vlan 20 and 2000 on them.

Where his was showing..

Ingress UnTagged VLAN ( NATIVE ): 1

When the lan was suppose to be 10.

Cannondale · May 22, 2023, 10:46 PM

Fresh run of show text attached.

Cannondale show tech-support 20230522.txt

Cannondale · May 22, 2023, 10:47 PM

@mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

Just for fun, as a comparison, here's the config from my CBS250 switch

Thanks mvikman!

mvikman · May 23, 2023, 9:30 AM

@johnpoz I'll just put some of the relevant ports from the tech output

gi1: trunk port to pfSense
gi2: trunk port to Wifi Ap
gi3: access port to main pc
gi4: access port homeserver
gi5: empty port (in "port park" vlan)

------------------ show interfaces switchport ------------------
Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
Port : gi1
Port Mode: 
Gvrp Status: disabled
Ingress Filtering: true
Acceptable Frame Type: admitAll
Ingress UnTagged VLAN ( NATIVE ): 1
 
Port is member in: 
 
Vlan               Name               Egress rule     Added by     
---- -------------------------------- ----------- ---------------- 
 10                MGMT                 Tagged           S         
 20                LAN                  Tagged           S         
 25               MEDIA                 Tagged           S         
 30                WORK                 Tagged           S         
 35               CAMERA                Tagged           S         
 40                IOT                  Tagged           S         
 50               GUEST                 Tagged           S         

 
Forbidden VLANS: 
Vlan               Name               
---- -------------------------------- 

 
Classification rules: 
Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
Port : gi2
Port Mode: 
Gvrp Status: disabled
Ingress Filtering: true
Acceptable Frame Type: admitAll
Ingress UnTagged VLAN ( NATIVE ): 1
 
Port is member in: 
 
Vlan               Name               Egress rule     Added by     
---- -------------------------------- ----------- ---------------- 
 10                MGMT                 Tagged           S         
 20                LAN                  Tagged           S         
 25               MEDIA                 Tagged           S         
 30                WORK                 Tagged           S         
 35               CAMERA                Tagged           S         
 40                IOT                  Tagged           S         
 50               GUEST                 Tagged           S         

 
Forbidden VLANS: 
Vlan               Name               
---- -------------------------------- 

 
Classification rules: 
Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
Port : gi3
Port Mode: 
Gvrp Status: disabled
Ingress Filtering: true
Acceptable Frame Type: admitAll
Ingress UnTagged VLAN ( NATIVE ): 1
 
Port is member in: 
 
Vlan               Name               Egress rule     Added by     
---- -------------------------------- ----------- ---------------- 
 20                LAN                 Untagged          S         

 
Forbidden VLANS: 
Vlan               Name               
---- -------------------------------- 

 
Classification rules: 
Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
Port : gi4
Port Mode: 
Gvrp Status: disabled
Ingress Filtering: true
Acceptable Frame Type: admitAll
Ingress UnTagged VLAN ( NATIVE ): 1
 
Port is member in: 
 
Vlan               Name               Egress rule     Added by     
---- -------------------------------- ----------- ---------------- 
 20                LAN                 Untagged          S         

 
Forbidden VLANS: 
Vlan               Name               
---- -------------------------------- 

 
Classification rules: 
Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
Port : gi5
Port Mode: 
Gvrp Status: disabled
Ingress Filtering: true
Acceptable Frame Type: admitAll
Ingress UnTagged VLAN ( NATIVE ): 1
 
Port is member in: 
 
Vlan               Name               Egress rule     Added by     
---- -------------------------------- ----------- ---------------- 
2000             PortPark              Untagged          S         

 
Forbidden VLANS: 
Vlan               Name               
---- --------------------------------

Here's "sh int switchport" from CLI on some of the above ports

HOME-SW2#sh int switchport gi1
Name: gi1
Switchport: enable
Administrative Mode: trunk
Operational Mode: up
Access Mode VLAN: 1
Trunking Native Mode VLAN: 4000 (Inactive)
Trunking VLANs: 10,20,25,30,35,40,50
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled
Customer Mode VLAN: none

Classification rules:


HOME-SW2#sh int switchport gi3
Name: gi3
Switchport: enable
Administrative Mode: access
Operational Mode: up
Access Mode VLAN: 20
Trunking Native Mode VLAN: 1
Trunking VLANs: 1
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled
Customer Mode VLAN: none

Classification rules:


HOME-SW2#sh int switchport gi5
Name: gi5
Switchport: enable
Administrative Mode: access
Operational Mode: down
Access Mode VLAN: 2000
Trunking Native Mode VLAN: 1
Trunking VLANs: 1
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled
Customer Mode VLAN: none

Classification rules:


HOME-SW2#