Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No DHCP on pfSense VLAN with Cisco Smart Switch

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    147 Posts 7 Posters 89.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate @johnpoz
      last edited by

      @johnpoz I don't have access to a Cisco SG-series switch.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @Derelict
        last edited by

        @derelict NP - thanks for chiming in.. It was a shot, you and Steve normally have all kinds of stuff ;)

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        C 1 Reply Last reply Reply Quote 0
        • C
          Cannondale @johnpoz
          last edited by

          Thanks for trying to shake the trees johnpoz!
          Started vlan config from scratch. Cleared all vlan config using GUI and only worked in the cli.
          Clearing the vlan config using the GUI appears to leave remnant config information when doing the config via cli. Is there a way in cli to clear all vlan config for a particular vlan?

          This is what I have so far:

          Roth-SG250-50P-1(config)#do sho vlan
          Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN
          
          Vlan       Name     gged Ports             UnTagged Ports      Created by    
          ---- ----------------- ------------------ ------------------ ---------------- 
           1           1                             gi2-23,gi25-50,      DV        
                                                          Po1-4                               
           10       AP-vl10                          gi24                 S         
          
          
          
          Roth-SG250-50P-1#do sho run int gi1             
          interface GigabitEthernet1
           switchport mode trunk
           switchport access vlan 10
           switchport trunk allowed vlan 10
          !
          
          Roth-SG250-50P-1#do sho run int gi24
          interface GigabitEthernet24
           switchport access vlan 10
          !
          
          
          Roth-SG250-50P-1#sho interfaces switchport gi1
          Name: gi1
          Switchport: enable
          Administrative Mode: trunk
          Operational Mode: up
          Access Mode VLAN: 10
          Trunking Native Mode VLAN: 1 (Inactive)
          Trunking VLANs: 10
          General PVID: 1
          General VLANs: none
          General Egress Tagged VLANs: none
          General Forbidden VLANs: none
          General Ingress Filtering: enabled
          General Acceptable Frame Type: all
          General GVRP status: disabled
          Customer Mode VLAN: none
          
          
          Roth-SG250-50P-1#sho interfaces switchport gi24
          Name: gi24
          Switchport: enable
          Administrative Mode: access
          Operational Mode: up
          Access Mode VLAN: 10
          Trunking Native Mode VLAN: 1
          Trunking VLANs: 1,10
                                  2-9,11-4094 (Inactive)
          General PVID: 1
          General VLANs: none
          General Egress Tagged VLANs: none
          General Forbidden VLANs: none
          General Ingress Filtering: enabled
          General Acceptable Frame Type: all
          General GVRP status: disabled
          Customer Mode VLAN: none
          

          The one thing that looks odd to me is:
          do sho run int gi1 shows: Trunking Native Mode VLAN: 1 (Inactive)

          Does this output look correct?

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @Cannondale
            last edited by

            @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

            Does this output look correct?

            no not really..

            What does your sho tech show for port gi24?

            Name: gi24
            Switchport: enable
            Administrative Mode: access
            Operational Mode: up
            Access Mode VLAN: 10
            Trunking Native Mode VLAN: 1
            Trunking VLANs: 1,10
                                    2-9,11-4094 (Inactive)
            General PVID: 1
            

            For an access port - the native vlan should be the same as the vlan.

            It is never going to work if inbound traffic into the port that is not tagged does not get put into vlan 10.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            C 1 Reply Last reply Reply Quote 0
            • C
              Cannondale @johnpoz
              last edited by

              @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

              What does your sho tech show for port gi24?

              Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
              Port : gi24
              Port Mode: 
              Gvrp Status: disabled
              Ingress Filtering: true
              Acceptable Frame Type: admitAll
              Ingress UnTagged VLAN ( NATIVE ): 1
               
              Port is member in: 
               
              Vlan               Name               Egress rule     Added by     
              ---- -------------------------------- ----------- ---------------- 
               10              AP-vl10               Untagged          S
              

              Not good!

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @Cannondale
                last edited by

                @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                Not good!

                Nope - this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1..

                Well time to start moving up the firmware releases from the one your on now - maybe they had one that wasn't broken..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                C 1 Reply Last reply Reply Quote 0
                • C
                  Cannondale @johnpoz
                  last edited by

                  @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                  this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1

                  LOL

                  I flashed the firmware back to the latest version before starting the cli-based config.
                  I’m thinking it time to move on from this switch. Not worth the many hours invested for such a simple task!
                  I always thought highly of Cisco switches but this one has caused me to sour on the brand a bit!
                  Is there another bland / model smart poe switch that you would suggest I research?

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @Cannondale
                    last edited by

                    @cannondale yeah I could see that, but I love my sg350's they have been rock freaking solid that is for sure..

                    how many ports you need/want.. How many of those poe? I have been keeping an eye for my unicorn switch.. No luck as of yet..

                    What poe are you looking for, I assume poe+, 802.3at, but there is the new 802.3bt in 60w and 100w options as well.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    C 1 Reply Last reply Reply Quote 0
                    • C
                      Cannondale @johnpoz
                      last edited by

                      Something similar to what I have now would be great!

                      Capacity (mpps): 74
                      Switching Capacity (Gbps): 100
                      PoE: 802.3at PoE+, 802.3af
                      PoE Ports: 48
                      PoE Power (Watts): 375

                      1 Reply Last reply Reply Quote 0
                      • M
                        mvikman
                        last edited by mvikman

                        Just for fun, as a comparison, here's the config from my CBS250 switch, looks almost identical in format/command wise as Cannondale's SG250
                        Everything is working as it should, pfSense interface has only VLANS configured.

                        home-sw2_running-config.txt

                        pfSense Plus 24.11-RELEASE (amd64)
                        Dell Optiplex 7040 SFF
                        Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                        HPE 561T (X540-AT2), 2-port 10Gb RJ45
                        HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                        johnpozJ C 2 Replies Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @mvikman
                          last edited by

                          @mvikman Hey could you post the output of your show tech so we can see what it says the pvid is..

                          say ports 4 and 5 that have vlan 20 and 2000 on them.

                          Where his was showing..

                          Ingress UnTagged VLAN ( NATIVE ): 1

                          When the lan was suppose to be 10.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          C M 2 Replies Last reply Reply Quote 0
                          • C
                            Cannondale @johnpoz
                            last edited by

                            Fresh run of show text attached.

                            Cannondale show tech-support 20230522.txt

                            1 Reply Last reply Reply Quote 0
                            • C
                              Cannondale @mvikman
                              last edited by

                              @mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                              Just for fun, as a comparison, here's the config from my CBS250 switch

                              Thanks mvikman!

                              1 Reply Last reply Reply Quote 0
                              • M
                                mvikman @johnpoz
                                last edited by mvikman

                                @johnpoz I'll just put some of the relevant ports from the tech output

                                gi1: trunk port to pfSense
                                gi2: trunk port to Wifi Ap
                                gi3: access port to main pc
                                gi4: access port homeserver
                                gi5: empty port (in "port park" vlan)

                                ------------------ show interfaces switchport ------------------
                                Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                Port : gi1
                                Port Mode: 
                                Gvrp Status: disabled
                                Ingress Filtering: true
                                Acceptable Frame Type: admitAll
                                Ingress UnTagged VLAN ( NATIVE ): 1
                                 
                                Port is member in: 
                                 
                                Vlan               Name               Egress rule     Added by     
                                ---- -------------------------------- ----------- ---------------- 
                                 10                MGMT                 Tagged           S         
                                 20                LAN                  Tagged           S         
                                 25               MEDIA                 Tagged           S         
                                 30                WORK                 Tagged           S         
                                 35               CAMERA                Tagged           S         
                                 40                IOT                  Tagged           S         
                                 50               GUEST                 Tagged           S         
                                
                                 
                                Forbidden VLANS: 
                                Vlan               Name               
                                ---- -------------------------------- 
                                
                                 
                                Classification rules: 
                                Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                Port : gi2
                                Port Mode: 
                                Gvrp Status: disabled
                                Ingress Filtering: true
                                Acceptable Frame Type: admitAll
                                Ingress UnTagged VLAN ( NATIVE ): 1
                                 
                                Port is member in: 
                                 
                                Vlan               Name               Egress rule     Added by     
                                ---- -------------------------------- ----------- ---------------- 
                                 10                MGMT                 Tagged           S         
                                 20                LAN                  Tagged           S         
                                 25               MEDIA                 Tagged           S         
                                 30                WORK                 Tagged           S         
                                 35               CAMERA                Tagged           S         
                                 40                IOT                  Tagged           S         
                                 50               GUEST                 Tagged           S         
                                
                                 
                                Forbidden VLANS: 
                                Vlan               Name               
                                ---- -------------------------------- 
                                
                                 
                                Classification rules: 
                                Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                Port : gi3
                                Port Mode: 
                                Gvrp Status: disabled
                                Ingress Filtering: true
                                Acceptable Frame Type: admitAll
                                Ingress UnTagged VLAN ( NATIVE ): 1
                                 
                                Port is member in: 
                                 
                                Vlan               Name               Egress rule     Added by     
                                ---- -------------------------------- ----------- ---------------- 
                                 20                LAN                 Untagged          S         
                                
                                 
                                Forbidden VLANS: 
                                Vlan               Name               
                                ---- -------------------------------- 
                                
                                 
                                Classification rules: 
                                Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                Port : gi4
                                Port Mode: 
                                Gvrp Status: disabled
                                Ingress Filtering: true
                                Acceptable Frame Type: admitAll
                                Ingress UnTagged VLAN ( NATIVE ): 1
                                 
                                Port is member in: 
                                 
                                Vlan               Name               Egress rule     Added by     
                                ---- -------------------------------- ----------- ---------------- 
                                 20                LAN                 Untagged          S         
                                
                                 
                                Forbidden VLANS: 
                                Vlan               Name               
                                ---- -------------------------------- 
                                
                                 
                                Classification rules: 
                                Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                                Port : gi5
                                Port Mode: 
                                Gvrp Status: disabled
                                Ingress Filtering: true
                                Acceptable Frame Type: admitAll
                                Ingress UnTagged VLAN ( NATIVE ): 1
                                 
                                Port is member in: 
                                 
                                Vlan               Name               Egress rule     Added by     
                                ---- -------------------------------- ----------- ---------------- 
                                2000             PortPark              Untagged          S         
                                
                                 
                                Forbidden VLANS: 
                                Vlan               Name               
                                ---- -------------------------------- 
                                

                                Here's "sh int switchport" from CLI on some of the above ports

                                HOME-SW2#sh int switchport gi1
                                Name: gi1
                                Switchport: enable
                                Administrative Mode: trunk
                                Operational Mode: up
                                Access Mode VLAN: 1
                                Trunking Native Mode VLAN: 4000 (Inactive)
                                Trunking VLANs: 10,20,25,30,35,40,50
                                General PVID: 1
                                General VLANs: none
                                General Egress Tagged VLANs: none
                                General Forbidden VLANs: none
                                General Ingress Filtering: enabled
                                General Acceptable Frame Type: all
                                General GVRP status: disabled
                                Customer Mode VLAN: none
                                
                                Classification rules:
                                
                                
                                HOME-SW2#sh int switchport gi3
                                Name: gi3
                                Switchport: enable
                                Administrative Mode: access
                                Operational Mode: up
                                Access Mode VLAN: 20
                                Trunking Native Mode VLAN: 1
                                Trunking VLANs: 1
                                General PVID: 1
                                General VLANs: none
                                General Egress Tagged VLANs: none
                                General Forbidden VLANs: none
                                General Ingress Filtering: enabled
                                General Acceptable Frame Type: all
                                General GVRP status: disabled
                                Customer Mode VLAN: none
                                
                                Classification rules:
                                
                                
                                HOME-SW2#sh int switchport gi5
                                Name: gi5
                                Switchport: enable
                                Administrative Mode: access
                                Operational Mode: down
                                Access Mode VLAN: 2000
                                Trunking Native Mode VLAN: 1
                                Trunking VLANs: 1
                                General PVID: 1
                                General VLANs: none
                                General Egress Tagged VLANs: none
                                General Forbidden VLANs: none
                                General Ingress Filtering: enabled
                                General Acceptable Frame Type: all
                                General GVRP status: disabled
                                Customer Mode VLAN: none
                                
                                Classification rules:
                                
                                
                                HOME-SW2#
                                

                                pfSense Plus 24.11-RELEASE (amd64)
                                Dell Optiplex 7040 SFF
                                Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                                HPE 561T (X540-AT2), 2-port 10Gb RJ45
                                HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @mvikman
                                  last edited by

                                  @mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                  ngress UnTagged VLAN ( NATIVE ): 1

                                  Port is member in:

                                  Vlan Name Egress rule Added by


                                  2000 PortPark Untagged S

                                  Well yours is showing borked as well..

                                  How is that suppose to work if untagged traffic comes into that port onto vlan 1

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  P M 2 Replies Last reply Reply Quote 0
                                  • P
                                    pete35 @johnpoz
                                    last edited by

                                    I would say this is pretty normal.

                                    look at this sg350X :

                                    trunk port with native vlan 2, works perfectly.

                                    MUPSW02SG350X#sh int switchport gi1/0/1
                                    S-VLAN Ethernet Type: 0x8100 (802.1q)
                                    VLAN Mapping Tunnel L2 protocols Global CoS: 5
                                    Name: gi1/0/1
                                    Switchport: enable
                                    Administrative Mode: trunk
                                    Operational Mode: up
                                    Access Mode VLAN: 1
                                    Access Multicast TV VLAN: none
                                    Trunking Native Mode VLAN: 2
                                    Trunking VLANs: 1-2,10-11,14,21,111,113,120
                                    3-9,12-13,15-20,22-110,112,114-119,121-4094 (Inactive)
                                    General PVID: 1
                                    General VLANs: none
                                    General Egress Tagged VLANs: none
                                    General Forbidden VLANs: none
                                    General Ingress Filtering: enabled
                                    General Acceptable Frame Type: all
                                    General GVRP status: disabled

                                    <a href="https://carsonlam.ca">bintang88</a>
                                    <a href="https://carsonlam.ca">slot88</a>

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @pete35
                                      last edited by

                                      @pete35 not talking about trunk port

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mvikman @johnpoz
                                        last edited by

                                        @johnpoz

                                        Well, everything works even if it looks borked...

                                        Hmm... looking at the CBS-series CLI guide, "switchport mode" has these parameters
                                        • access—Specifies an untagged layer 2 VLAN port.
                                        • trunk—Specifies a trunking layer 2 VLAN port.
                                        • general—Specifies a full 802-1q-supported VLAN port.
                                        • customer—Specifies that an edge port connected to customer equipment. Traffic received from this port
                                        will be tunneled with the additional 802.1q VLAN tag (Q-in-Q VLAN tunneling).

                                        Also seems that those Ingress VLAN and PVID values are only used when the port is in General mode

                                        pfSense Plus 24.11-RELEASE (amd64)
                                        Dell Optiplex 7040 SFF
                                        Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                                        HPE 561T (X540-AT2), 2-port 10Gb RJ45
                                        HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                                        P 1 Reply Last reply Reply Quote 0
                                        • P
                                          pete35 @mvikman
                                          last edited by pete35

                                          hmmm lets asume that the switch is working properly.

                                          if we set the workstation manually to the desired ip address/mask and gateway, there
                                          should be a ping answer from the gateway on the pfsense.
                                          just an idea to check this out.

                                          next : change the workstation port to lets say port 23 and try to set the vlan there

                                          and maybe : reboot pfsense and change the cables

                                          <a href="https://carsonlam.ca">bintang88</a>
                                          <a href="https://carsonlam.ca">slot88</a>

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @pete35
                                            last edited by

                                            @pete35 all of that has already been done. Sniff on port going to pfsense no vlan tags - which has nothing to do with pfense

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            P 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.