No DHCP on pfSense VLAN with Cisco Smart Switch
-
Just an update. Successfully rolled the firmware back to v2.4.0.94.
This scrambled many of the previously configured settings in the switch so had to reconfirm everything to get back to where I was before the roll back. Unfortunately, the roll back did not change the PVID issue.Changed port 24 (VLAN10) and port 22 (VLAN20) from Access to Trunk. Note that those are to only two options!
Ran show tech-support again (output of port 22 and 24 below). Both still show
Ingress UnTagged VLAN ( NATIVE ): 1Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi22 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 20 VL20 Untagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi24 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 10 VL10 Untagged S Forbidden VLANS: Vlan Name ---- --------------------------------The output above is still not showing port mode so here is the output of "sho interfaces switchport gi24 and g122:
Roth-SG250-50P-1#sho interfaces switchport gi24 Gathering information... Name: gi24 Switchport: enable Administrative Mode: trunk Operational Mode: up Access Mode VLAN: 10 Trunking Native Mode VLAN: 10 Trunking VLANs: 10 2-9,11-19,21-4094 (Inactive) General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Classification rules: Roth-SG250-50P-1#sho interfaces switchport gi22 Gathering information... Name: gi22 Switchport: enable Administrative Mode: trunk Operational Mode: down Access Mode VLAN: 20 Trunking Native Mode VLAN: 20 Trunking VLANs: 20 2-9,11-19,21-4094 (Inactive) General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: noneNext step is to rebuilding the config from scratch from the cli as marvosa suggested.
Thanks again! -
@johnpoz I don't have access to a Cisco SG-series switch.
-
@derelict NP - thanks for chiming in.. It was a shot, you and Steve normally have all kinds of stuff ;)
-
Thanks for trying to shake the trees johnpoz!
Started vlan config from scratch. Cleared all vlan config using GUI and only worked in the cli.
Clearing the vlan config using the GUI appears to leave remnant config information when doing the config via cli. Is there a way in cli to clear all vlan config for a particular vlan?This is what I have so far:
Roth-SG250-50P-1(config)#do sho vlan Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN Vlan Name gged Ports UnTagged Ports Created by ---- ----------------- ------------------ ------------------ ---------------- 1 1 gi2-23,gi25-50, DV Po1-4 10 AP-vl10 gi24 S Roth-SG250-50P-1#do sho run int gi1 interface GigabitEthernet1 switchport mode trunk switchport access vlan 10 switchport trunk allowed vlan 10 ! Roth-SG250-50P-1#do sho run int gi24 interface GigabitEthernet24 switchport access vlan 10 ! Roth-SG250-50P-1#sho interfaces switchport gi1 Name: gi1 Switchport: enable Administrative Mode: trunk Operational Mode: up Access Mode VLAN: 10 Trunking Native Mode VLAN: 1 (Inactive) Trunking VLANs: 10 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Roth-SG250-50P-1#sho interfaces switchport gi24 Name: gi24 Switchport: enable Administrative Mode: access Operational Mode: up Access Mode VLAN: 10 Trunking Native Mode VLAN: 1 Trunking VLANs: 1,10 2-9,11-4094 (Inactive) General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: noneThe one thing that looks odd to me is:
do sho run int gi1 shows: Trunking Native Mode VLAN: 1 (Inactive)Does this output look correct?
-
@cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:
Does this output look correct?
no not really..
What does your sho tech show for port gi24?
Name: gi24 Switchport: enable Administrative Mode: access Operational Mode: up Access Mode VLAN: 10 Trunking Native Mode VLAN: 1 Trunking VLANs: 1,10 2-9,11-4094 (Inactive) General PVID: 1For an access port - the native vlan should be the same as the vlan.
It is never going to work if inbound traffic into the port that is not tagged does not get put into vlan 10.
-
@johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:
What does your sho tech show for port gi24?
Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi24 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 10 AP-vl10 Untagged SNot good!
-
@cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:
Not good!
Nope - this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1..
Well time to start moving up the firmware releases from the one your on now - maybe they had one that wasn't broken..
-
@johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:
this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1
LOL
I flashed the firmware back to the latest version before starting the cli-based config.
I’m thinking it time to move on from this switch. Not worth the many hours invested for such a simple task!
I always thought highly of Cisco switches but this one has caused me to sour on the brand a bit!
Is there another bland / model smart poe switch that you would suggest I research? -
@cannondale yeah I could see that, but I love my sg350's they have been rock freaking solid that is for sure..
how many ports you need/want.. How many of those poe? I have been keeping an eye for my unicorn switch.. No luck as of yet..
What poe are you looking for, I assume poe+, 802.3at, but there is the new 802.3bt in 60w and 100w options as well.
-
Something similar to what I have now would be great!
Capacity (mpps): 74
Switching Capacity (Gbps): 100
PoE: 802.3at PoE+, 802.3af
PoE Ports: 48
PoE Power (Watts): 375 -
Just for fun, as a comparison, here's the config from my CBS250 switch, looks almost identical in format/command wise as Cannondale's SG250
Everything is working as it should, pfSense interface has only VLANS configured.pfSense Plus 24.11-RELEASE (amd64)
Dell Optiplex 7040 SFF
Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
HPE 561T (X540-AT2), 2-port 10Gb RJ45
HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+ -
@mvikman Hey could you post the output of your show tech so we can see what it says the pvid is..
say ports 4 and 5 that have vlan 20 and 2000 on them.
Where his was showing..
Ingress UnTagged VLAN ( NATIVE ): 1
When the lan was suppose to be 10.
-
Fresh run of show text attached.
-
@mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:
Just for fun, as a comparison, here's the config from my CBS250 switch
Thanks mvikman!
-
@johnpoz I'll just put some of the relevant ports from the tech output
gi1: trunk port to pfSense
gi2: trunk port to Wifi Ap
gi3: access port to main pc
gi4: access port homeserver
gi5: empty port (in "port park" vlan)------------------ show interfaces switchport ------------------ Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi1 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 10 MGMT Tagged S 20 LAN Tagged S 25 MEDIA Tagged S 30 WORK Tagged S 35 CAMERA Tagged S 40 IOT Tagged S 50 GUEST Tagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi2 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 10 MGMT Tagged S 20 LAN Tagged S 25 MEDIA Tagged S 30 WORK Tagged S 35 CAMERA Tagged S 40 IOT Tagged S 50 GUEST Tagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi3 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 20 LAN Untagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi4 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 20 LAN Untagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi5 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 2000 PortPark Untagged S Forbidden VLANS: Vlan Name ---- --------------------------------Here's "sh int switchport" from CLI on some of the above ports
HOME-SW2#sh int switchport gi1 Name: gi1 Switchport: enable Administrative Mode: trunk Operational Mode: up Access Mode VLAN: 1 Trunking Native Mode VLAN: 4000 (Inactive) Trunking VLANs: 10,20,25,30,35,40,50 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Classification rules: HOME-SW2#sh int switchport gi3 Name: gi3 Switchport: enable Administrative Mode: access Operational Mode: up Access Mode VLAN: 20 Trunking Native Mode VLAN: 1 Trunking VLANs: 1 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Classification rules: HOME-SW2#sh int switchport gi5 Name: gi5 Switchport: enable Administrative Mode: access Operational Mode: down Access Mode VLAN: 2000 Trunking Native Mode VLAN: 1 Trunking VLANs: 1 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Classification rules: HOME-SW2# -
@mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:
ngress UnTagged VLAN ( NATIVE ): 1
Port is member in:
Vlan Name Egress rule Added by
2000 PortPark Untagged S
Well yours is showing borked as well..
How is that suppose to work if untagged traffic comes into that port onto vlan 1
-
I would say this is pretty normal.
look at this sg350X :
trunk port with native vlan 2, works perfectly.
MUPSW02SG350X#sh int switchport gi1/0/1
S-VLAN Ethernet Type: 0x8100 (802.1q)
VLAN Mapping Tunnel L2 protocols Global CoS: 5
Name: gi1/0/1
Switchport: enable
Administrative Mode: trunk
Operational Mode: up
Access Mode VLAN: 1
Access Multicast TV VLAN: none
Trunking Native Mode VLAN: 2
Trunking VLANs: 1-2,10-11,14,21,111,113,120
3-9,12-13,15-20,22-110,112,114-119,121-4094 (Inactive)
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled -
@pete35 not talking about trunk port
-
Well, everything works even if it looks borked...
Hmm... looking at the CBS-series CLI guide, "switchport mode" has these parameters
• access—Specifies an untagged layer 2 VLAN port.
• trunk—Specifies a trunking layer 2 VLAN port.
• general—Specifies a full 802-1q-supported VLAN port.
• customer—Specifies that an edge port connected to customer equipment. Traffic received from this port
will be tunneled with the additional 802.1q VLAN tag (Q-in-Q VLAN tunneling).Also seems that those Ingress VLAN and PVID values are only used when the port is in General mode
-
hmmm lets asume that the switch is working properly.
if we set the workstation manually to the desired ip address/mask and gateway, there
should be a ping answer from the gateway on the pfsense.
just an idea to check this out.next : change the workstation port to lets say port 23 and try to set the vlan there
and maybe : reboot pfsense and change the cables
