Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No DHCP on pfSense VLAN with Cisco Smart Switch

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    147 Posts 7 Posters 88.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      Cannondale @marvosa
      last edited by

      Thanks for the suggestions guys! You both have given me some additional options to try.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @marvosa
        last edited by johnpoz

        @marvosa said in No DHCP on pfSense VLAN with Cisco Smart Switch:

        I'd remove vlan 1 from the allowed line on your trunk (Gi1).

        He is using that, as the native vlan.. Its just untagged so he wouldn't remove it.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        C 1 Reply Last reply Reply Quote 0
        • C
          Cannondale @johnpoz
          last edited by

          Just an update. Successfully rolled the firmware back to v2.4.0.94.
          This scrambled many of the previously configured settings in the switch so had to reconfirm everything to get back to where I was before the roll back. Unfortunately, the roll back did not change the PVID issue.

          Changed port 24 (VLAN10) and port 22 (VLAN20) from Access to Trunk. Note that those are to only two options!
          Ran show tech-support again (output of port 22 and 24 below). Both still show
          Ingress UnTagged VLAN ( NATIVE ): 1

          Classification rules: 
          Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
          Port : gi22
          Port Mode: 
          Gvrp Status: disabled
          Ingress Filtering: true
          Acceptable Frame Type: admitAll
          Ingress UnTagged VLAN ( NATIVE ): 1
           
          Port is member in: 
           
          Vlan               Name               Egress rule     Added by     
          ---- -------------------------------- ----------- ---------------- 
           20                VL20                Untagged          S         
          
           
          Forbidden VLANS: 
          Vlan               Name               
          ---- -------------------------------- 
           
          Classification rules: 
          Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
          Port : gi24
          Port Mode: 
          Gvrp Status: disabled
          Ingress Filtering: true
          Acceptable Frame Type: admitAll
          Ingress UnTagged VLAN ( NATIVE ): 1
           
          Port is member in: 
           
          Vlan               Name               Egress rule     Added by     
          ---- -------------------------------- ----------- ---------------- 
           10                VL10                Untagged          S         
          
           
          Forbidden VLANS: 
          Vlan               Name               
          ---- -------------------------------- 
          

          The output above is still not showing port mode so here is the output of "sho interfaces switchport gi24 and g122:

          Roth-SG250-50P-1#sho interfaces switchport gi24
          Gathering information...
          
          Name: gi24
          Switchport: enable
          Administrative Mode: trunk
          Operational Mode: up
          Access Mode VLAN: 10
          Trunking Native Mode VLAN: 10
          Trunking VLANs: 10
                                  2-9,11-19,21-4094 (Inactive)
          General PVID: 1
          General VLANs: none
          General Egress Tagged VLANs: none
          General Forbidden VLANs: none
          General Ingress Filtering: enabled
          General Acceptable Frame Type: all
          General GVRP status: disabled
          Customer Mode VLAN: none
          
          
          
          Classification rules:
                                                                
          
          Roth-SG250-50P-1#sho interfaces switchport gi22
          Gathering information...
          
          Name: gi22
          Switchport: enable
          Administrative Mode: trunk
          Operational Mode: down
          Access Mode VLAN: 20
          Trunking Native Mode VLAN: 20
          Trunking VLANs: 20
                                  2-9,11-19,21-4094 (Inactive)
          General PVID: 1
          General VLANs: none
          General Egress Tagged VLANs: none
          General Forbidden VLANs: none
          General Ingress Filtering: enabled
          General Acceptable Frame Type: all
          General GVRP status: disabled
          Customer Mode VLAN: none
          
          
          

          Next step is to rebuilding the config from scratch from the cli as marvosa suggested.
          Thanks again!

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate @johnpoz
            last edited by

            @johnpoz I don't have access to a Cisco SG-series switch.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @Derelict
              last edited by

              @derelict NP - thanks for chiming in.. It was a shot, you and Steve normally have all kinds of stuff ;)

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              C 1 Reply Last reply Reply Quote 0
              • C
                Cannondale @johnpoz
                last edited by

                Thanks for trying to shake the trees johnpoz!
                Started vlan config from scratch. Cleared all vlan config using GUI and only worked in the cli.
                Clearing the vlan config using the GUI appears to leave remnant config information when doing the config via cli. Is there a way in cli to clear all vlan config for a particular vlan?

                This is what I have so far:

                Roth-SG250-50P-1(config)#do sho vlan
                Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN
                
                Vlan       Name     gged Ports             UnTagged Ports      Created by    
                ---- ----------------- ------------------ ------------------ ---------------- 
                 1           1                             gi2-23,gi25-50,      DV        
                                                                Po1-4                               
                 10       AP-vl10                          gi24                 S         
                
                
                
                Roth-SG250-50P-1#do sho run int gi1             
                interface GigabitEthernet1
                 switchport mode trunk
                 switchport access vlan 10
                 switchport trunk allowed vlan 10
                !
                
                Roth-SG250-50P-1#do sho run int gi24
                interface GigabitEthernet24
                 switchport access vlan 10
                !
                
                
                Roth-SG250-50P-1#sho interfaces switchport gi1
                Name: gi1
                Switchport: enable
                Administrative Mode: trunk
                Operational Mode: up
                Access Mode VLAN: 10
                Trunking Native Mode VLAN: 1 (Inactive)
                Trunking VLANs: 10
                General PVID: 1
                General VLANs: none
                General Egress Tagged VLANs: none
                General Forbidden VLANs: none
                General Ingress Filtering: enabled
                General Acceptable Frame Type: all
                General GVRP status: disabled
                Customer Mode VLAN: none
                
                
                Roth-SG250-50P-1#sho interfaces switchport gi24
                Name: gi24
                Switchport: enable
                Administrative Mode: access
                Operational Mode: up
                Access Mode VLAN: 10
                Trunking Native Mode VLAN: 1
                Trunking VLANs: 1,10
                                        2-9,11-4094 (Inactive)
                General PVID: 1
                General VLANs: none
                General Egress Tagged VLANs: none
                General Forbidden VLANs: none
                General Ingress Filtering: enabled
                General Acceptable Frame Type: all
                General GVRP status: disabled
                Customer Mode VLAN: none
                

                The one thing that looks odd to me is:
                do sho run int gi1 shows: Trunking Native Mode VLAN: 1 (Inactive)

                Does this output look correct?

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @Cannondale
                  last edited by

                  @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                  Does this output look correct?

                  no not really..

                  What does your sho tech show for port gi24?

                  Name: gi24
                  Switchport: enable
                  Administrative Mode: access
                  Operational Mode: up
                  Access Mode VLAN: 10
                  Trunking Native Mode VLAN: 1
                  Trunking VLANs: 1,10
                                          2-9,11-4094 (Inactive)
                  General PVID: 1
                  

                  For an access port - the native vlan should be the same as the vlan.

                  It is never going to work if inbound traffic into the port that is not tagged does not get put into vlan 10.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  C 1 Reply Last reply Reply Quote 0
                  • C
                    Cannondale @johnpoz
                    last edited by

                    @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                    What does your sho tech show for port gi24?

                    Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                    Port : gi24
                    Port Mode: 
                    Gvrp Status: disabled
                    Ingress Filtering: true
                    Acceptable Frame Type: admitAll
                    Ingress UnTagged VLAN ( NATIVE ): 1
                     
                    Port is member in: 
                     
                    Vlan               Name               Egress rule     Added by     
                    ---- -------------------------------- ----------- ---------------- 
                     10              AP-vl10               Untagged          S
                    

                    Not good!

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @Cannondale
                      last edited by

                      @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                      Not good!

                      Nope - this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1..

                      Well time to start moving up the firmware releases from the one your on now - maybe they had one that wasn't broken..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      C 1 Reply Last reply Reply Quote 0
                      • C
                        Cannondale @johnpoz
                        last edited by

                        @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                        this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1

                        LOL

                        I flashed the firmware back to the latest version before starting the cli-based config.
                        I’m thinking it time to move on from this switch. Not worth the many hours invested for such a simple task!
                        I always thought highly of Cisco switches but this one has caused me to sour on the brand a bit!
                        Is there another bland / model smart poe switch that you would suggest I research?

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @Cannondale
                          last edited by

                          @cannondale yeah I could see that, but I love my sg350's they have been rock freaking solid that is for sure..

                          how many ports you need/want.. How many of those poe? I have been keeping an eye for my unicorn switch.. No luck as of yet..

                          What poe are you looking for, I assume poe+, 802.3at, but there is the new 802.3bt in 60w and 100w options as well.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          C 1 Reply Last reply Reply Quote 0
                          • C
                            Cannondale @johnpoz
                            last edited by

                            Something similar to what I have now would be great!

                            Capacity (mpps): 74
                            Switching Capacity (Gbps): 100
                            PoE: 802.3at PoE+, 802.3af
                            PoE Ports: 48
                            PoE Power (Watts): 375

                            1 Reply Last reply Reply Quote 0
                            • M
                              mvikman
                              last edited by mvikman

                              Just for fun, as a comparison, here's the config from my CBS250 switch, looks almost identical in format/command wise as Cannondale's SG250
                              Everything is working as it should, pfSense interface has only VLANS configured.

                              home-sw2_running-config.txt

                              pfSense Plus 24.11-RELEASE (amd64)
                              Dell Optiplex 7040 SFF
                              Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                              HPE 561T (X540-AT2), 2-port 10Gb RJ45
                              HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                              johnpozJ C 2 Replies Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @mvikman
                                last edited by

                                @mvikman Hey could you post the output of your show tech so we can see what it says the pvid is..

                                say ports 4 and 5 that have vlan 20 and 2000 on them.

                                Where his was showing..

                                Ingress UnTagged VLAN ( NATIVE ): 1

                                When the lan was suppose to be 10.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                C M 2 Replies Last reply Reply Quote 0
                                • C
                                  Cannondale @johnpoz
                                  last edited by

                                  Fresh run of show text attached.

                                  Cannondale show tech-support 20230522.txt

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    Cannondale @mvikman
                                    last edited by

                                    @mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                    Just for fun, as a comparison, here's the config from my CBS250 switch

                                    Thanks mvikman!

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mvikman @johnpoz
                                      last edited by mvikman

                                      @johnpoz I'll just put some of the relevant ports from the tech output

                                      gi1: trunk port to pfSense
                                      gi2: trunk port to Wifi Ap
                                      gi3: access port to main pc
                                      gi4: access port homeserver
                                      gi5: empty port (in "port park" vlan)

                                      ------------------ show interfaces switchport ------------------
                                      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                      Port : gi1
                                      Port Mode: 
                                      Gvrp Status: disabled
                                      Ingress Filtering: true
                                      Acceptable Frame Type: admitAll
                                      Ingress UnTagged VLAN ( NATIVE ): 1
                                       
                                      Port is member in: 
                                       
                                      Vlan               Name               Egress rule     Added by     
                                      ---- -------------------------------- ----------- ---------------- 
                                       10                MGMT                 Tagged           S         
                                       20                LAN                  Tagged           S         
                                       25               MEDIA                 Tagged           S         
                                       30                WORK                 Tagged           S         
                                       35               CAMERA                Tagged           S         
                                       40                IOT                  Tagged           S         
                                       50               GUEST                 Tagged           S         
                                      
                                       
                                      Forbidden VLANS: 
                                      Vlan               Name               
                                      ---- -------------------------------- 
                                      
                                       
                                      Classification rules: 
                                      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                      Port : gi2
                                      Port Mode: 
                                      Gvrp Status: disabled
                                      Ingress Filtering: true
                                      Acceptable Frame Type: admitAll
                                      Ingress UnTagged VLAN ( NATIVE ): 1
                                       
                                      Port is member in: 
                                       
                                      Vlan               Name               Egress rule     Added by     
                                      ---- -------------------------------- ----------- ---------------- 
                                       10                MGMT                 Tagged           S         
                                       20                LAN                  Tagged           S         
                                       25               MEDIA                 Tagged           S         
                                       30                WORK                 Tagged           S         
                                       35               CAMERA                Tagged           S         
                                       40                IOT                  Tagged           S         
                                       50               GUEST                 Tagged           S         
                                      
                                       
                                      Forbidden VLANS: 
                                      Vlan               Name               
                                      ---- -------------------------------- 
                                      
                                       
                                      Classification rules: 
                                      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                      Port : gi3
                                      Port Mode: 
                                      Gvrp Status: disabled
                                      Ingress Filtering: true
                                      Acceptable Frame Type: admitAll
                                      Ingress UnTagged VLAN ( NATIVE ): 1
                                       
                                      Port is member in: 
                                       
                                      Vlan               Name               Egress rule     Added by     
                                      ---- -------------------------------- ----------- ---------------- 
                                       20                LAN                 Untagged          S         
                                      
                                       
                                      Forbidden VLANS: 
                                      Vlan               Name               
                                      ---- -------------------------------- 
                                      
                                       
                                      Classification rules: 
                                      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                      Port : gi4
                                      Port Mode: 
                                      Gvrp Status: disabled
                                      Ingress Filtering: true
                                      Acceptable Frame Type: admitAll
                                      Ingress UnTagged VLAN ( NATIVE ): 1
                                       
                                      Port is member in: 
                                       
                                      Vlan               Name               Egress rule     Added by     
                                      ---- -------------------------------- ----------- ---------------- 
                                       20                LAN                 Untagged          S         
                                      
                                       
                                      Forbidden VLANS: 
                                      Vlan               Name               
                                      ---- -------------------------------- 
                                      
                                       
                                      Classification rules: 
                                      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                      Port : gi5
                                      Port Mode: 
                                      Gvrp Status: disabled
                                      Ingress Filtering: true
                                      Acceptable Frame Type: admitAll
                                      Ingress UnTagged VLAN ( NATIVE ): 1
                                       
                                      Port is member in: 
                                       
                                      Vlan               Name               Egress rule     Added by     
                                      ---- -------------------------------- ----------- ---------------- 
                                      2000             PortPark              Untagged          S         
                                      
                                       
                                      Forbidden VLANS: 
                                      Vlan               Name               
                                      ---- -------------------------------- 
                                      

                                      Here's "sh int switchport" from CLI on some of the above ports

                                      HOME-SW2#sh int switchport gi1
                                      Name: gi1
                                      Switchport: enable
                                      Administrative Mode: trunk
                                      Operational Mode: up
                                      Access Mode VLAN: 1
                                      Trunking Native Mode VLAN: 4000 (Inactive)
                                      Trunking VLANs: 10,20,25,30,35,40,50
                                      General PVID: 1
                                      General VLANs: none
                                      General Egress Tagged VLANs: none
                                      General Forbidden VLANs: none
                                      General Ingress Filtering: enabled
                                      General Acceptable Frame Type: all
                                      General GVRP status: disabled
                                      Customer Mode VLAN: none
                                      
                                      Classification rules:
                                      
                                      
                                      HOME-SW2#sh int switchport gi3
                                      Name: gi3
                                      Switchport: enable
                                      Administrative Mode: access
                                      Operational Mode: up
                                      Access Mode VLAN: 20
                                      Trunking Native Mode VLAN: 1
                                      Trunking VLANs: 1
                                      General PVID: 1
                                      General VLANs: none
                                      General Egress Tagged VLANs: none
                                      General Forbidden VLANs: none
                                      General Ingress Filtering: enabled
                                      General Acceptable Frame Type: all
                                      General GVRP status: disabled
                                      Customer Mode VLAN: none
                                      
                                      Classification rules:
                                      
                                      
                                      HOME-SW2#sh int switchport gi5
                                      Name: gi5
                                      Switchport: enable
                                      Administrative Mode: access
                                      Operational Mode: down
                                      Access Mode VLAN: 2000
                                      Trunking Native Mode VLAN: 1
                                      Trunking VLANs: 1
                                      General PVID: 1
                                      General VLANs: none
                                      General Egress Tagged VLANs: none
                                      General Forbidden VLANs: none
                                      General Ingress Filtering: enabled
                                      General Acceptable Frame Type: all
                                      General GVRP status: disabled
                                      Customer Mode VLAN: none
                                      
                                      Classification rules:
                                      
                                      
                                      HOME-SW2#
                                      

                                      pfSense Plus 24.11-RELEASE (amd64)
                                      Dell Optiplex 7040 SFF
                                      Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                                      HPE 561T (X540-AT2), 2-port 10Gb RJ45
                                      HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                                      johnpozJ 1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator @mvikman
                                        last edited by

                                        @mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                        ngress UnTagged VLAN ( NATIVE ): 1

                                        Port is member in:

                                        Vlan Name Egress rule Added by


                                        2000 PortPark Untagged S

                                        Well yours is showing borked as well..

                                        How is that suppose to work if untagged traffic comes into that port onto vlan 1

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                        P M 2 Replies Last reply Reply Quote 0
                                        • P
                                          pete35 @johnpoz
                                          last edited by

                                          I would say this is pretty normal.

                                          look at this sg350X :

                                          trunk port with native vlan 2, works perfectly.

                                          MUPSW02SG350X#sh int switchport gi1/0/1
                                          S-VLAN Ethernet Type: 0x8100 (802.1q)
                                          VLAN Mapping Tunnel L2 protocols Global CoS: 5
                                          Name: gi1/0/1
                                          Switchport: enable
                                          Administrative Mode: trunk
                                          Operational Mode: up
                                          Access Mode VLAN: 1
                                          Access Multicast TV VLAN: none
                                          Trunking Native Mode VLAN: 2
                                          Trunking VLANs: 1-2,10-11,14,21,111,113,120
                                          3-9,12-13,15-20,22-110,112,114-119,121-4094 (Inactive)
                                          General PVID: 1
                                          General VLANs: none
                                          General Egress Tagged VLANs: none
                                          General Forbidden VLANs: none
                                          General Ingress Filtering: enabled
                                          General Acceptable Frame Type: all
                                          General GVRP status: disabled

                                          <a href="https://carsonlam.ca">bintang88</a>
                                          <a href="https://carsonlam.ca">slot88</a>

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @pete35
                                            last edited by

                                            @pete35 not talking about trunk port

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.