Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No DHCP on pfSense VLAN with Cisco Smart Switch

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    147 Posts 7 Posters 89.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      marvosa @Cannondale
      last edited by

      @cannondale

      interface GigabitEthernet1
       switchport mode trunk
       switchport trunk allowed vlan 1,10,20
      

      I'd remove vlan 1 from the allowed line on your trunk (Gi1).

      Too many odd things that aren't adding up. Rolling back the firmware may work, but if it doesn't, I'd still recommend rebuilding the config from scratch from the cli. You'll likely save yourself countless hours of more troubleshooting.

      C johnpozJ 2 Replies Last reply Reply Quote 0
      • C
        Cannondale @marvosa
        last edited by

        Thanks for the suggestions guys! You both have given me some additional options to try.

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @marvosa
          last edited by johnpoz

          @marvosa said in No DHCP on pfSense VLAN with Cisco Smart Switch:

          I'd remove vlan 1 from the allowed line on your trunk (Gi1).

          He is using that, as the native vlan.. Its just untagged so he wouldn't remove it.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          C 1 Reply Last reply Reply Quote 0
          • C
            Cannondale @johnpoz
            last edited by

            Just an update. Successfully rolled the firmware back to v2.4.0.94.
            This scrambled many of the previously configured settings in the switch so had to reconfirm everything to get back to where I was before the roll back. Unfortunately, the roll back did not change the PVID issue.

            Changed port 24 (VLAN10) and port 22 (VLAN20) from Access to Trunk. Note that those are to only two options!
            Ran show tech-support again (output of port 22 and 24 below). Both still show
            Ingress UnTagged VLAN ( NATIVE ): 1

            Classification rules: 
            Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
            Port : gi22
            Port Mode: 
            Gvrp Status: disabled
            Ingress Filtering: true
            Acceptable Frame Type: admitAll
            Ingress UnTagged VLAN ( NATIVE ): 1
             
            Port is member in: 
             
            Vlan               Name               Egress rule     Added by     
            ---- -------------------------------- ----------- ---------------- 
             20                VL20                Untagged          S         
            
             
            Forbidden VLANS: 
            Vlan               Name               
            ---- -------------------------------- 
             
            Classification rules: 
            Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
            Port : gi24
            Port Mode: 
            Gvrp Status: disabled
            Ingress Filtering: true
            Acceptable Frame Type: admitAll
            Ingress UnTagged VLAN ( NATIVE ): 1
             
            Port is member in: 
             
            Vlan               Name               Egress rule     Added by     
            ---- -------------------------------- ----------- ---------------- 
             10                VL10                Untagged          S         
            
             
            Forbidden VLANS: 
            Vlan               Name               
            ---- -------------------------------- 
            

            The output above is still not showing port mode so here is the output of "sho interfaces switchport gi24 and g122:

            Roth-SG250-50P-1#sho interfaces switchport gi24
            Gathering information...
            
            Name: gi24
            Switchport: enable
            Administrative Mode: trunk
            Operational Mode: up
            Access Mode VLAN: 10
            Trunking Native Mode VLAN: 10
            Trunking VLANs: 10
                                    2-9,11-19,21-4094 (Inactive)
            General PVID: 1
            General VLANs: none
            General Egress Tagged VLANs: none
            General Forbidden VLANs: none
            General Ingress Filtering: enabled
            General Acceptable Frame Type: all
            General GVRP status: disabled
            Customer Mode VLAN: none
            
            
            
            Classification rules:
                                                                  
            
            Roth-SG250-50P-1#sho interfaces switchport gi22
            Gathering information...
            
            Name: gi22
            Switchport: enable
            Administrative Mode: trunk
            Operational Mode: down
            Access Mode VLAN: 20
            Trunking Native Mode VLAN: 20
            Trunking VLANs: 20
                                    2-9,11-19,21-4094 (Inactive)
            General PVID: 1
            General VLANs: none
            General Egress Tagged VLANs: none
            General Forbidden VLANs: none
            General Ingress Filtering: enabled
            General Acceptable Frame Type: all
            General GVRP status: disabled
            Customer Mode VLAN: none
            
            
            

            Next step is to rebuilding the config from scratch from the cli as marvosa suggested.
            Thanks again!

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate @johnpoz
              last edited by

              @johnpoz I don't have access to a Cisco SG-series switch.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @Derelict
                last edited by

                @derelict NP - thanks for chiming in.. It was a shot, you and Steve normally have all kinds of stuff ;)

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                C 1 Reply Last reply Reply Quote 0
                • C
                  Cannondale @johnpoz
                  last edited by

                  Thanks for trying to shake the trees johnpoz!
                  Started vlan config from scratch. Cleared all vlan config using GUI and only worked in the cli.
                  Clearing the vlan config using the GUI appears to leave remnant config information when doing the config via cli. Is there a way in cli to clear all vlan config for a particular vlan?

                  This is what I have so far:

                  Roth-SG250-50P-1(config)#do sho vlan
                  Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN
                  
                  Vlan       Name     gged Ports             UnTagged Ports      Created by    
                  ---- ----------------- ------------------ ------------------ ---------------- 
                   1           1                             gi2-23,gi25-50,      DV        
                                                                  Po1-4                               
                   10       AP-vl10                          gi24                 S         
                  
                  
                  
                  Roth-SG250-50P-1#do sho run int gi1             
                  interface GigabitEthernet1
                   switchport mode trunk
                   switchport access vlan 10
                   switchport trunk allowed vlan 10
                  !
                  
                  Roth-SG250-50P-1#do sho run int gi24
                  interface GigabitEthernet24
                   switchport access vlan 10
                  !
                  
                  
                  Roth-SG250-50P-1#sho interfaces switchport gi1
                  Name: gi1
                  Switchport: enable
                  Administrative Mode: trunk
                  Operational Mode: up
                  Access Mode VLAN: 10
                  Trunking Native Mode VLAN: 1 (Inactive)
                  Trunking VLANs: 10
                  General PVID: 1
                  General VLANs: none
                  General Egress Tagged VLANs: none
                  General Forbidden VLANs: none
                  General Ingress Filtering: enabled
                  General Acceptable Frame Type: all
                  General GVRP status: disabled
                  Customer Mode VLAN: none
                  
                  
                  Roth-SG250-50P-1#sho interfaces switchport gi24
                  Name: gi24
                  Switchport: enable
                  Administrative Mode: access
                  Operational Mode: up
                  Access Mode VLAN: 10
                  Trunking Native Mode VLAN: 1
                  Trunking VLANs: 1,10
                                          2-9,11-4094 (Inactive)
                  General PVID: 1
                  General VLANs: none
                  General Egress Tagged VLANs: none
                  General Forbidden VLANs: none
                  General Ingress Filtering: enabled
                  General Acceptable Frame Type: all
                  General GVRP status: disabled
                  Customer Mode VLAN: none
                  

                  The one thing that looks odd to me is:
                  do sho run int gi1 shows: Trunking Native Mode VLAN: 1 (Inactive)

                  Does this output look correct?

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @Cannondale
                    last edited by

                    @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                    Does this output look correct?

                    no not really..

                    What does your sho tech show for port gi24?

                    Name: gi24
                    Switchport: enable
                    Administrative Mode: access
                    Operational Mode: up
                    Access Mode VLAN: 10
                    Trunking Native Mode VLAN: 1
                    Trunking VLANs: 1,10
                                            2-9,11-4094 (Inactive)
                    General PVID: 1
                    

                    For an access port - the native vlan should be the same as the vlan.

                    It is never going to work if inbound traffic into the port that is not tagged does not get put into vlan 10.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    C 1 Reply Last reply Reply Quote 0
                    • C
                      Cannondale @johnpoz
                      last edited by

                      @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                      What does your sho tech show for port gi24?

                      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                      Port : gi24
                      Port Mode: 
                      Gvrp Status: disabled
                      Ingress Filtering: true
                      Acceptable Frame Type: admitAll
                      Ingress UnTagged VLAN ( NATIVE ): 1
                       
                      Port is member in: 
                       
                      Vlan               Name               Egress rule     Added by     
                      ---- -------------------------------- ----------- ---------------- 
                       10              AP-vl10               Untagged          S
                      

                      Not good!

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @Cannondale
                        last edited by

                        @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                        Not good!

                        Nope - this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1..

                        Well time to start moving up the firmware releases from the one your on now - maybe they had one that wasn't broken..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        C 1 Reply Last reply Reply Quote 0
                        • C
                          Cannondale @johnpoz
                          last edited by

                          @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                          this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1

                          LOL

                          I flashed the firmware back to the latest version before starting the cli-based config.
                          I’m thinking it time to move on from this switch. Not worth the many hours invested for such a simple task!
                          I always thought highly of Cisco switches but this one has caused me to sour on the brand a bit!
                          Is there another bland / model smart poe switch that you would suggest I research?

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @Cannondale
                            last edited by

                            @cannondale yeah I could see that, but I love my sg350's they have been rock freaking solid that is for sure..

                            how many ports you need/want.. How many of those poe? I have been keeping an eye for my unicorn switch.. No luck as of yet..

                            What poe are you looking for, I assume poe+, 802.3at, but there is the new 802.3bt in 60w and 100w options as well.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            C 1 Reply Last reply Reply Quote 0
                            • C
                              Cannondale @johnpoz
                              last edited by

                              Something similar to what I have now would be great!

                              Capacity (mpps): 74
                              Switching Capacity (Gbps): 100
                              PoE: 802.3at PoE+, 802.3af
                              PoE Ports: 48
                              PoE Power (Watts): 375

                              1 Reply Last reply Reply Quote 0
                              • M
                                mvikman
                                last edited by mvikman

                                Just for fun, as a comparison, here's the config from my CBS250 switch, looks almost identical in format/command wise as Cannondale's SG250
                                Everything is working as it should, pfSense interface has only VLANS configured.

                                home-sw2_running-config.txt

                                pfSense Plus 24.11-RELEASE (amd64)
                                Dell Optiplex 7040 SFF
                                Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                                HPE 561T (X540-AT2), 2-port 10Gb RJ45
                                HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                                johnpozJ C 2 Replies Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @mvikman
                                  last edited by

                                  @mvikman Hey could you post the output of your show tech so we can see what it says the pvid is..

                                  say ports 4 and 5 that have vlan 20 and 2000 on them.

                                  Where his was showing..

                                  Ingress UnTagged VLAN ( NATIVE ): 1

                                  When the lan was suppose to be 10.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  C M 2 Replies Last reply Reply Quote 0
                                  • C
                                    Cannondale @johnpoz
                                    last edited by

                                    Fresh run of show text attached.

                                    Cannondale show tech-support 20230522.txt

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      Cannondale @mvikman
                                      last edited by

                                      @mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                      Just for fun, as a comparison, here's the config from my CBS250 switch

                                      Thanks mvikman!

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mvikman @johnpoz
                                        last edited by mvikman

                                        @johnpoz I'll just put some of the relevant ports from the tech output

                                        gi1: trunk port to pfSense
                                        gi2: trunk port to Wifi Ap
                                        gi3: access port to main pc
                                        gi4: access port homeserver
                                        gi5: empty port (in "port park" vlan)

                                        ------------------ show interfaces switchport ------------------
                                        Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                        Port : gi1
                                        Port Mode: 
                                        Gvrp Status: disabled
                                        Ingress Filtering: true
                                        Acceptable Frame Type: admitAll
                                        Ingress UnTagged VLAN ( NATIVE ): 1
                                         
                                        Port is member in: 
                                         
                                        Vlan               Name               Egress rule     Added by     
                                        ---- -------------------------------- ----------- ---------------- 
                                         10                MGMT                 Tagged           S         
                                         20                LAN                  Tagged           S         
                                         25               MEDIA                 Tagged           S         
                                         30                WORK                 Tagged           S         
                                         35               CAMERA                Tagged           S         
                                         40                IOT                  Tagged           S         
                                         50               GUEST                 Tagged           S         
                                        
                                         
                                        Forbidden VLANS: 
                                        Vlan               Name               
                                        ---- -------------------------------- 
                                        
                                         
                                        Classification rules: 
                                        Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                        Port : gi2
                                        Port Mode: 
                                        Gvrp Status: disabled
                                        Ingress Filtering: true
                                        Acceptable Frame Type: admitAll
                                        Ingress UnTagged VLAN ( NATIVE ): 1
                                         
                                        Port is member in: 
                                         
                                        Vlan               Name               Egress rule     Added by     
                                        ---- -------------------------------- ----------- ---------------- 
                                         10                MGMT                 Tagged           S         
                                         20                LAN                  Tagged           S         
                                         25               MEDIA                 Tagged           S         
                                         30                WORK                 Tagged           S         
                                         35               CAMERA                Tagged           S         
                                         40                IOT                  Tagged           S         
                                         50               GUEST                 Tagged           S         
                                        
                                         
                                        Forbidden VLANS: 
                                        Vlan               Name               
                                        ---- -------------------------------- 
                                        
                                         
                                        Classification rules: 
                                        Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                        Port : gi3
                                        Port Mode: 
                                        Gvrp Status: disabled
                                        Ingress Filtering: true
                                        Acceptable Frame Type: admitAll
                                        Ingress UnTagged VLAN ( NATIVE ): 1
                                         
                                        Port is member in: 
                                         
                                        Vlan               Name               Egress rule     Added by     
                                        ---- -------------------------------- ----------- ---------------- 
                                         20                LAN                 Untagged          S         
                                        
                                         
                                        Forbidden VLANS: 
                                        Vlan               Name               
                                        ---- -------------------------------- 
                                        
                                         
                                        Classification rules: 
                                        Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                        Port : gi4
                                        Port Mode: 
                                        Gvrp Status: disabled
                                        Ingress Filtering: true
                                        Acceptable Frame Type: admitAll
                                        Ingress UnTagged VLAN ( NATIVE ): 1
                                         
                                        Port is member in: 
                                         
                                        Vlan               Name               Egress rule     Added by     
                                        ---- -------------------------------- ----------- ---------------- 
                                         20                LAN                 Untagged          S         
                                        
                                         
                                        Forbidden VLANS: 
                                        Vlan               Name               
                                        ---- -------------------------------- 
                                        
                                         
                                        Classification rules: 
                                        Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                        Port : gi5
                                        Port Mode: 
                                        Gvrp Status: disabled
                                        Ingress Filtering: true
                                        Acceptable Frame Type: admitAll
                                        Ingress UnTagged VLAN ( NATIVE ): 1
                                         
                                        Port is member in: 
                                         
                                        Vlan               Name               Egress rule     Added by     
                                        ---- -------------------------------- ----------- ---------------- 
                                        2000             PortPark              Untagged          S         
                                        
                                         
                                        Forbidden VLANS: 
                                        Vlan               Name               
                                        ---- -------------------------------- 
                                        

                                        Here's "sh int switchport" from CLI on some of the above ports

                                        HOME-SW2#sh int switchport gi1
                                        Name: gi1
                                        Switchport: enable
                                        Administrative Mode: trunk
                                        Operational Mode: up
                                        Access Mode VLAN: 1
                                        Trunking Native Mode VLAN: 4000 (Inactive)
                                        Trunking VLANs: 10,20,25,30,35,40,50
                                        General PVID: 1
                                        General VLANs: none
                                        General Egress Tagged VLANs: none
                                        General Forbidden VLANs: none
                                        General Ingress Filtering: enabled
                                        General Acceptable Frame Type: all
                                        General GVRP status: disabled
                                        Customer Mode VLAN: none
                                        
                                        Classification rules:
                                        
                                        
                                        HOME-SW2#sh int switchport gi3
                                        Name: gi3
                                        Switchport: enable
                                        Administrative Mode: access
                                        Operational Mode: up
                                        Access Mode VLAN: 20
                                        Trunking Native Mode VLAN: 1
                                        Trunking VLANs: 1
                                        General PVID: 1
                                        General VLANs: none
                                        General Egress Tagged VLANs: none
                                        General Forbidden VLANs: none
                                        General Ingress Filtering: enabled
                                        General Acceptable Frame Type: all
                                        General GVRP status: disabled
                                        Customer Mode VLAN: none
                                        
                                        Classification rules:
                                        
                                        
                                        HOME-SW2#sh int switchport gi5
                                        Name: gi5
                                        Switchport: enable
                                        Administrative Mode: access
                                        Operational Mode: down
                                        Access Mode VLAN: 2000
                                        Trunking Native Mode VLAN: 1
                                        Trunking VLANs: 1
                                        General PVID: 1
                                        General VLANs: none
                                        General Egress Tagged VLANs: none
                                        General Forbidden VLANs: none
                                        General Ingress Filtering: enabled
                                        General Acceptable Frame Type: all
                                        General GVRP status: disabled
                                        Customer Mode VLAN: none
                                        
                                        Classification rules:
                                        
                                        
                                        HOME-SW2#
                                        

                                        pfSense Plus 24.11-RELEASE (amd64)
                                        Dell Optiplex 7040 SFF
                                        Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                                        HPE 561T (X540-AT2), 2-port 10Gb RJ45
                                        HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @mvikman
                                          last edited by

                                          @mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                          ngress UnTagged VLAN ( NATIVE ): 1

                                          Port is member in:

                                          Vlan Name Egress rule Added by


                                          2000 PortPark Untagged S

                                          Well yours is showing borked as well..

                                          How is that suppose to work if untagged traffic comes into that port onto vlan 1

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          P M 2 Replies Last reply Reply Quote 0
                                          • P
                                            pete35 @johnpoz
                                            last edited by

                                            I would say this is pretty normal.

                                            look at this sg350X :

                                            trunk port with native vlan 2, works perfectly.

                                            MUPSW02SG350X#sh int switchport gi1/0/1
                                            S-VLAN Ethernet Type: 0x8100 (802.1q)
                                            VLAN Mapping Tunnel L2 protocols Global CoS: 5
                                            Name: gi1/0/1
                                            Switchport: enable
                                            Administrative Mode: trunk
                                            Operational Mode: up
                                            Access Mode VLAN: 1
                                            Access Multicast TV VLAN: none
                                            Trunking Native Mode VLAN: 2
                                            Trunking VLANs: 1-2,10-11,14,21,111,113,120
                                            3-9,12-13,15-20,22-110,112,114-119,121-4094 (Inactive)
                                            General PVID: 1
                                            General VLANs: none
                                            General Egress Tagged VLANs: none
                                            General Forbidden VLANs: none
                                            General Ingress Filtering: enabled
                                            General Acceptable Frame Type: all
                                            General GVRP status: disabled

                                            <a href="https://carsonlam.ca">bintang88</a>
                                            <a href="https://carsonlam.ca">slot88</a>

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.