No DHCP on pfSense VLAN with Cisco Smart Switch
-
Thanks for trying to shake the trees johnpoz!
Started vlan config from scratch. Cleared all vlan config using GUI and only worked in the cli.
Clearing the vlan config using the GUI appears to leave remnant config information when doing the config via cli. Is there a way in cli to clear all vlan config for a particular vlan?This is what I have so far:
Roth-SG250-50P-1(config)#do sho vlan Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN Vlan Name gged Ports UnTagged Ports Created by ---- ----------------- ------------------ ------------------ ---------------- 1 1 gi2-23,gi25-50, DV Po1-4 10 AP-vl10 gi24 S Roth-SG250-50P-1#do sho run int gi1 interface GigabitEthernet1 switchport mode trunk switchport access vlan 10 switchport trunk allowed vlan 10 ! Roth-SG250-50P-1#do sho run int gi24 interface GigabitEthernet24 switchport access vlan 10 ! Roth-SG250-50P-1#sho interfaces switchport gi1 Name: gi1 Switchport: enable Administrative Mode: trunk Operational Mode: up Access Mode VLAN: 10 Trunking Native Mode VLAN: 1 (Inactive) Trunking VLANs: 10 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Roth-SG250-50P-1#sho interfaces switchport gi24 Name: gi24 Switchport: enable Administrative Mode: access Operational Mode: up Access Mode VLAN: 10 Trunking Native Mode VLAN: 1 Trunking VLANs: 1,10 2-9,11-4094 (Inactive) General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: noneThe one thing that looks odd to me is:
do sho run int gi1 shows: Trunking Native Mode VLAN: 1 (Inactive)Does this output look correct?
-
@cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:
Does this output look correct?
no not really..
What does your sho tech show for port gi24?
Name: gi24 Switchport: enable Administrative Mode: access Operational Mode: up Access Mode VLAN: 10 Trunking Native Mode VLAN: 1 Trunking VLANs: 1,10 2-9,11-4094 (Inactive) General PVID: 1For an access port - the native vlan should be the same as the vlan.
It is never going to work if inbound traffic into the port that is not tagged does not get put into vlan 10.
-
@johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:
What does your sho tech show for port gi24?
Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi24 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 10 AP-vl10 Untagged SNot good!
-
@cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:
Not good!
Nope - this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1..
Well time to start moving up the firmware releases from the one your on now - maybe they had one that wasn't broken..
-
@johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:
this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1
LOL
I flashed the firmware back to the latest version before starting the cli-based config.
I’m thinking it time to move on from this switch. Not worth the many hours invested for such a simple task!
I always thought highly of Cisco switches but this one has caused me to sour on the brand a bit!
Is there another bland / model smart poe switch that you would suggest I research? -
@cannondale yeah I could see that, but I love my sg350's they have been rock freaking solid that is for sure..
how many ports you need/want.. How many of those poe? I have been keeping an eye for my unicorn switch.. No luck as of yet..
What poe are you looking for, I assume poe+, 802.3at, but there is the new 802.3bt in 60w and 100w options as well.
-
Something similar to what I have now would be great!
Capacity (mpps): 74
Switching Capacity (Gbps): 100
PoE: 802.3at PoE+, 802.3af
PoE Ports: 48
PoE Power (Watts): 375 -
Just for fun, as a comparison, here's the config from my CBS250 switch, looks almost identical in format/command wise as Cannondale's SG250
Everything is working as it should, pfSense interface has only VLANS configured.pfSense Plus 24.11-RELEASE (amd64)
Dell Optiplex 7040 SFF
Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
HPE 561T (X540-AT2), 2-port 10Gb RJ45
HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+ -
@mvikman Hey could you post the output of your show tech so we can see what it says the pvid is..
say ports 4 and 5 that have vlan 20 and 2000 on them.
Where his was showing..
Ingress UnTagged VLAN ( NATIVE ): 1
When the lan was suppose to be 10.
-
Fresh run of show text attached.
-
@mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:
Just for fun, as a comparison, here's the config from my CBS250 switch
Thanks mvikman!
-
@johnpoz I'll just put some of the relevant ports from the tech output
gi1: trunk port to pfSense
gi2: trunk port to Wifi Ap
gi3: access port to main pc
gi4: access port homeserver
gi5: empty port (in "port park" vlan)------------------ show interfaces switchport ------------------ Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi1 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 10 MGMT Tagged S 20 LAN Tagged S 25 MEDIA Tagged S 30 WORK Tagged S 35 CAMERA Tagged S 40 IOT Tagged S 50 GUEST Tagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi2 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 10 MGMT Tagged S 20 LAN Tagged S 25 MEDIA Tagged S 30 WORK Tagged S 35 CAMERA Tagged S 40 IOT Tagged S 50 GUEST Tagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi3 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 20 LAN Untagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi4 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 20 LAN Untagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi5 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 2000 PortPark Untagged S Forbidden VLANS: Vlan Name ---- --------------------------------Here's "sh int switchport" from CLI on some of the above ports
HOME-SW2#sh int switchport gi1 Name: gi1 Switchport: enable Administrative Mode: trunk Operational Mode: up Access Mode VLAN: 1 Trunking Native Mode VLAN: 4000 (Inactive) Trunking VLANs: 10,20,25,30,35,40,50 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Classification rules: HOME-SW2#sh int switchport gi3 Name: gi3 Switchport: enable Administrative Mode: access Operational Mode: up Access Mode VLAN: 20 Trunking Native Mode VLAN: 1 Trunking VLANs: 1 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Classification rules: HOME-SW2#sh int switchport gi5 Name: gi5 Switchport: enable Administrative Mode: access Operational Mode: down Access Mode VLAN: 2000 Trunking Native Mode VLAN: 1 Trunking VLANs: 1 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Classification rules: HOME-SW2# -
@mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:
ngress UnTagged VLAN ( NATIVE ): 1
Port is member in:
Vlan Name Egress rule Added by
2000 PortPark Untagged S
Well yours is showing borked as well..
How is that suppose to work if untagged traffic comes into that port onto vlan 1
-
I would say this is pretty normal.
look at this sg350X :
trunk port with native vlan 2, works perfectly.
MUPSW02SG350X#sh int switchport gi1/0/1
S-VLAN Ethernet Type: 0x8100 (802.1q)
VLAN Mapping Tunnel L2 protocols Global CoS: 5
Name: gi1/0/1
Switchport: enable
Administrative Mode: trunk
Operational Mode: up
Access Mode VLAN: 1
Access Multicast TV VLAN: none
Trunking Native Mode VLAN: 2
Trunking VLANs: 1-2,10-11,14,21,111,113,120
3-9,12-13,15-20,22-110,112,114-119,121-4094 (Inactive)
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled -
@pete35 not talking about trunk port
-
Well, everything works even if it looks borked...
Hmm... looking at the CBS-series CLI guide, "switchport mode" has these parameters
• access—Specifies an untagged layer 2 VLAN port.
• trunk—Specifies a trunking layer 2 VLAN port.
• general—Specifies a full 802-1q-supported VLAN port.
• customer—Specifies that an edge port connected to customer equipment. Traffic received from this port
will be tunneled with the additional 802.1q VLAN tag (Q-in-Q VLAN tunneling).Also seems that those Ingress VLAN and PVID values are only used when the port is in General mode
-
hmmm lets asume that the switch is working properly.
if we set the workstation manually to the desired ip address/mask and gateway, there
should be a ping answer from the gateway on the pfsense.
just an idea to check this out.next : change the workstation port to lets say port 23 and try to set the vlan there
and maybe : reboot pfsense and change the cables
-
@pete35 all of that has already been done. Sniff on port going to pfsense no vlan tags - which has nothing to do with pfense
-
@johnpoz
we are using a lot of these switches and i never saw such problems. There are other problems with this switches but not within those basic vlan stuff. As these switches have a lifetime warranty from cisco, maybe a return and exchange will solve this issue. Otherwise im out of ideas what is wrong here. -
I plugged in a Linux workstation into switch port 20, which was a normal lan port.
Got an IP from pfSense as expected.
Configured switch port 20 as a vlan using the cli. Note: port 20 was not previously configured as a vlan.Output below of:
show vlan
sho run int
show interfaces switchportNote: Switch port 1 is the pfSense Trunk port.
Roth-SG250-50P-1(config-if)#do show vlan Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN Vlan Name Tagged Ports UnTagged Ports Created by ---- ----------------- ------------------ ------------------ ---------------- 1 1 gi2-19,gi21-23, DV gi25-50,Po1-4 10 testvl10 gi1 gi24 S 20 testvl20 gi1 gi20 S Roth-SG250-50P-1#sho run int gi1 interface GigabitEthernet1 switchport mode trunk switchport access vlan 10 switchport trunk allowed vlan 10,20 ! Roth-SG250-50P-1#sho run int gi20 interface GigabitEthernet20 switchport access vlan 20 ! Roth-SG250-50P-1(config-if)#do show interfaces switchport ge1 Name: gi1 Switchport: enable Administrative Mode: trunk Operational Mode: up Access Mode VLAN: 10 Trunking Native Mode VLAN: 1 (Inactive) Trunking VLANs: 10,20 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Roth-SG250-50P-1(config-if)#do show interfaces switchport ge20 Name: gi20 Switchport: enable Administrative Mode: access Operational Mode: down Access Mode VLAN: 20 Trunking Native Mode VLAN: 1 Trunking VLANs: 1,10,20 2-9,11-19,21-4094 (Inactive) General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Roth-SG250-50P-1(config-if)#do show interfaces switchport ge24 Name: gi24 Switchport: enable Administrative Mode: access Operational Mode: up Access Mode VLAN: 10 Trunking Native Mode VLAN: 1 Trunking VLANs: 1,10,20 2-9,11-19,21-4094 (Inactive) General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: noneI ran tcpdump -i igb1 -e on the pfSense server while plugging in the Linux workstation into port 20.
Searched the sniffer output for "vlan" and did not find that string.
