Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No DHCP on pfSense VLAN with Cisco Smart Switch

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    147 Posts 7 Posters 89.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @Cannondale
      last edited by

      @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

      Not good!

      Nope - this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1..

      Well time to start moving up the firmware releases from the one your on now - maybe they had one that wasn't broken..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      C 1 Reply Last reply Reply Quote 0
      • C
        Cannondale @johnpoz
        last edited by

        @johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

        this switch seems worse then the shit tplink when they wouldn't let you remove vlan 1

        LOL

        I flashed the firmware back to the latest version before starting the cli-based config.
        I’m thinking it time to move on from this switch. Not worth the many hours invested for such a simple task!
        I always thought highly of Cisco switches but this one has caused me to sour on the brand a bit!
        Is there another bland / model smart poe switch that you would suggest I research?

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @Cannondale
          last edited by

          @cannondale yeah I could see that, but I love my sg350's they have been rock freaking solid that is for sure..

          how many ports you need/want.. How many of those poe? I have been keeping an eye for my unicorn switch.. No luck as of yet..

          What poe are you looking for, I assume poe+, 802.3at, but there is the new 802.3bt in 60w and 100w options as well.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          C 1 Reply Last reply Reply Quote 0
          • C
            Cannondale @johnpoz
            last edited by

            Something similar to what I have now would be great!

            Capacity (mpps): 74
            Switching Capacity (Gbps): 100
            PoE: 802.3at PoE+, 802.3af
            PoE Ports: 48
            PoE Power (Watts): 375

            1 Reply Last reply Reply Quote 0
            • M
              mvikman
              last edited by mvikman

              Just for fun, as a comparison, here's the config from my CBS250 switch, looks almost identical in format/command wise as Cannondale's SG250
              Everything is working as it should, pfSense interface has only VLANS configured.

              home-sw2_running-config.txt

              pfSense Plus 24.11-RELEASE (amd64)
              Dell Optiplex 7040 SFF
              Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
              HPE 561T (X540-AT2), 2-port 10Gb RJ45
              HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

              johnpozJ C 2 Replies Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @mvikman
                last edited by

                @mvikman Hey could you post the output of your show tech so we can see what it says the pvid is..

                say ports 4 and 5 that have vlan 20 and 2000 on them.

                Where his was showing..

                Ingress UnTagged VLAN ( NATIVE ): 1

                When the lan was suppose to be 10.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                C M 2 Replies Last reply Reply Quote 0
                • C
                  Cannondale @johnpoz
                  last edited by

                  Fresh run of show text attached.

                  Cannondale show tech-support 20230522.txt

                  1 Reply Last reply Reply Quote 0
                  • C
                    Cannondale @mvikman
                    last edited by

                    @mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                    Just for fun, as a comparison, here's the config from my CBS250 switch

                    Thanks mvikman!

                    1 Reply Last reply Reply Quote 0
                    • M
                      mvikman @johnpoz
                      last edited by mvikman

                      @johnpoz I'll just put some of the relevant ports from the tech output

                      gi1: trunk port to pfSense
                      gi2: trunk port to Wifi Ap
                      gi3: access port to main pc
                      gi4: access port homeserver
                      gi5: empty port (in "port park" vlan)

                      ------------------ show interfaces switchport ------------------
                      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                      Port : gi1
                      Port Mode: 
                      Gvrp Status: disabled
                      Ingress Filtering: true
                      Acceptable Frame Type: admitAll
                      Ingress UnTagged VLAN ( NATIVE ): 1
                       
                      Port is member in: 
                       
                      Vlan               Name               Egress rule     Added by     
                      ---- -------------------------------- ----------- ---------------- 
                       10                MGMT                 Tagged           S         
                       20                LAN                  Tagged           S         
                       25               MEDIA                 Tagged           S         
                       30                WORK                 Tagged           S         
                       35               CAMERA                Tagged           S         
                       40                IOT                  Tagged           S         
                       50               GUEST                 Tagged           S         
                      
                       
                      Forbidden VLANS: 
                      Vlan               Name               
                      ---- -------------------------------- 
                      
                       
                      Classification rules: 
                      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                      Port : gi2
                      Port Mode: 
                      Gvrp Status: disabled
                      Ingress Filtering: true
                      Acceptable Frame Type: admitAll
                      Ingress UnTagged VLAN ( NATIVE ): 1
                       
                      Port is member in: 
                       
                      Vlan               Name               Egress rule     Added by     
                      ---- -------------------------------- ----------- ---------------- 
                       10                MGMT                 Tagged           S         
                       20                LAN                  Tagged           S         
                       25               MEDIA                 Tagged           S         
                       30                WORK                 Tagged           S         
                       35               CAMERA                Tagged           S         
                       40                IOT                  Tagged           S         
                       50               GUEST                 Tagged           S         
                      
                       
                      Forbidden VLANS: 
                      Vlan               Name               
                      ---- -------------------------------- 
                      
                       
                      Classification rules: 
                      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                      Port : gi3
                      Port Mode: 
                      Gvrp Status: disabled
                      Ingress Filtering: true
                      Acceptable Frame Type: admitAll
                      Ingress UnTagged VLAN ( NATIVE ): 1
                       
                      Port is member in: 
                       
                      Vlan               Name               Egress rule     Added by     
                      ---- -------------------------------- ----------- ---------------- 
                       20                LAN                 Untagged          S         
                      
                       
                      Forbidden VLANS: 
                      Vlan               Name               
                      ---- -------------------------------- 
                      
                       
                      Classification rules: 
                      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                      Port : gi4
                      Port Mode: 
                      Gvrp Status: disabled
                      Ingress Filtering: true
                      Acceptable Frame Type: admitAll
                      Ingress UnTagged VLAN ( NATIVE ): 1
                       
                      Port is member in: 
                       
                      Vlan               Name               Egress rule     Added by     
                      ---- -------------------------------- ----------- ---------------- 
                       20                LAN                 Untagged          S         
                      
                       
                      Forbidden VLANS: 
                      Vlan               Name               
                      ---- -------------------------------- 
                      
                       
                      Classification rules: 
                      Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN
                      Port : gi5
                      Port Mode: 
                      Gvrp Status: disabled
                      Ingress Filtering: true
                      Acceptable Frame Type: admitAll
                      Ingress UnTagged VLAN ( NATIVE ): 1
                       
                      Port is member in: 
                       
                      Vlan               Name               Egress rule     Added by     
                      ---- -------------------------------- ----------- ---------------- 
                      2000             PortPark              Untagged          S         
                      
                       
                      Forbidden VLANS: 
                      Vlan               Name               
                      ---- -------------------------------- 
                      

                      Here's "sh int switchport" from CLI on some of the above ports

                      HOME-SW2#sh int switchport gi1
                      Name: gi1
                      Switchport: enable
                      Administrative Mode: trunk
                      Operational Mode: up
                      Access Mode VLAN: 1
                      Trunking Native Mode VLAN: 4000 (Inactive)
                      Trunking VLANs: 10,20,25,30,35,40,50
                      General PVID: 1
                      General VLANs: none
                      General Egress Tagged VLANs: none
                      General Forbidden VLANs: none
                      General Ingress Filtering: enabled
                      General Acceptable Frame Type: all
                      General GVRP status: disabled
                      Customer Mode VLAN: none
                      
                      Classification rules:
                      
                      
                      HOME-SW2#sh int switchport gi3
                      Name: gi3
                      Switchport: enable
                      Administrative Mode: access
                      Operational Mode: up
                      Access Mode VLAN: 20
                      Trunking Native Mode VLAN: 1
                      Trunking VLANs: 1
                      General PVID: 1
                      General VLANs: none
                      General Egress Tagged VLANs: none
                      General Forbidden VLANs: none
                      General Ingress Filtering: enabled
                      General Acceptable Frame Type: all
                      General GVRP status: disabled
                      Customer Mode VLAN: none
                      
                      Classification rules:
                      
                      
                      HOME-SW2#sh int switchport gi5
                      Name: gi5
                      Switchport: enable
                      Administrative Mode: access
                      Operational Mode: down
                      Access Mode VLAN: 2000
                      Trunking Native Mode VLAN: 1
                      Trunking VLANs: 1
                      General PVID: 1
                      General VLANs: none
                      General Egress Tagged VLANs: none
                      General Forbidden VLANs: none
                      General Ingress Filtering: enabled
                      General Acceptable Frame Type: all
                      General GVRP status: disabled
                      Customer Mode VLAN: none
                      
                      Classification rules:
                      
                      
                      HOME-SW2#
                      

                      pfSense Plus 24.11-RELEASE (amd64)
                      Dell Optiplex 7040 SFF
                      Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                      HPE 561T (X540-AT2), 2-port 10Gb RJ45
                      HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @mvikman
                        last edited by

                        @mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                        ngress UnTagged VLAN ( NATIVE ): 1

                        Port is member in:

                        Vlan Name Egress rule Added by


                        2000 PortPark Untagged S

                        Well yours is showing borked as well..

                        How is that suppose to work if untagged traffic comes into that port onto vlan 1

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        P M 2 Replies Last reply Reply Quote 0
                        • P
                          pete35 @johnpoz
                          last edited by

                          I would say this is pretty normal.

                          look at this sg350X :

                          trunk port with native vlan 2, works perfectly.

                          MUPSW02SG350X#sh int switchport gi1/0/1
                          S-VLAN Ethernet Type: 0x8100 (802.1q)
                          VLAN Mapping Tunnel L2 protocols Global CoS: 5
                          Name: gi1/0/1
                          Switchport: enable
                          Administrative Mode: trunk
                          Operational Mode: up
                          Access Mode VLAN: 1
                          Access Multicast TV VLAN: none
                          Trunking Native Mode VLAN: 2
                          Trunking VLANs: 1-2,10-11,14,21,111,113,120
                          3-9,12-13,15-20,22-110,112,114-119,121-4094 (Inactive)
                          General PVID: 1
                          General VLANs: none
                          General Egress Tagged VLANs: none
                          General Forbidden VLANs: none
                          General Ingress Filtering: enabled
                          General Acceptable Frame Type: all
                          General GVRP status: disabled

                          <a href="https://carsonlam.ca">bintang88</a>
                          <a href="https://carsonlam.ca">slot88</a>

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @pete35
                            last edited by

                            @pete35 not talking about trunk port

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • M
                              mvikman @johnpoz
                              last edited by

                              @johnpoz

                              Well, everything works even if it looks borked...

                              Hmm... looking at the CBS-series CLI guide, "switchport mode" has these parameters
                              • access—Specifies an untagged layer 2 VLAN port.
                              • trunk—Specifies a trunking layer 2 VLAN port.
                              • general—Specifies a full 802-1q-supported VLAN port.
                              • customer—Specifies that an edge port connected to customer equipment. Traffic received from this port
                              will be tunneled with the additional 802.1q VLAN tag (Q-in-Q VLAN tunneling).

                              Also seems that those Ingress VLAN and PVID values are only used when the port is in General mode

                              pfSense Plus 24.11-RELEASE (amd64)
                              Dell Optiplex 7040 SFF
                              Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                              HPE 561T (X540-AT2), 2-port 10Gb RJ45
                              HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                              P 1 Reply Last reply Reply Quote 0
                              • P
                                pete35 @mvikman
                                last edited by pete35

                                hmmm lets asume that the switch is working properly.

                                if we set the workstation manually to the desired ip address/mask and gateway, there
                                should be a ping answer from the gateway on the pfsense.
                                just an idea to check this out.

                                next : change the workstation port to lets say port 23 and try to set the vlan there

                                and maybe : reboot pfsense and change the cables

                                <a href="https://carsonlam.ca">bintang88</a>
                                <a href="https://carsonlam.ca">slot88</a>

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @pete35
                                  last edited by

                                  @pete35 all of that has already been done. Sniff on port going to pfsense no vlan tags - which has nothing to do with pfense

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  P 1 Reply Last reply Reply Quote 0
                                  • P
                                    pete35 @johnpoz
                                    last edited by

                                    @johnpoz
                                    we are using a lot of these switches and i never saw such problems. There are other problems with this switches but not within those basic vlan stuff. As these switches have a lifetime warranty from cisco, maybe a return and exchange will solve this issue. Otherwise im out of ideas what is wrong here.

                                    <a href="https://carsonlam.ca">bintang88</a>
                                    <a href="https://carsonlam.ca">slot88</a>

                                    C 1 Reply Last reply Reply Quote 0
                                    • C
                                      Cannondale @pete35
                                      last edited by

                                      I plugged in a Linux workstation into switch port 20, which was a normal lan port.
                                      Got an IP from pfSense as expected.
                                      Configured switch port 20 as a vlan using the cli. Note: port 20 was not previously configured as a vlan.

                                      Output below of:
                                      show vlan
                                      sho run int
                                      show interfaces switchport

                                      Note: Switch port 1 is the pfSense Trunk port.

                                      Roth-SG250-50P-1(config-if)#do show vlan
                                      Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN
                                      
                                      Vlan       Name           Tagged Ports      UnTagged Ports      Created by    
                                      ---- ----------------- ------------------ ------------------ ---------------- 
                                       1           1                            gi2-19,gi21-23,           DV        
                                                                                gi25-50,Po1-4                       
                                       10      testvl10             gi1                gi24               S         
                                       20      testvl20             gi1                gi20               S         
                                      
                                      
                                      Roth-SG250-50P-1#sho run int gi1
                                      interface GigabitEthernet1
                                       switchport mode trunk
                                       switchport access vlan 10
                                       switchport trunk allowed vlan 10,20
                                      !
                                      
                                      Roth-SG250-50P-1#sho run int gi20
                                      interface GigabitEthernet20
                                       switchport access vlan 20
                                      !
                                      
                                      
                                      Roth-SG250-50P-1(config-if)#do show interfaces switchport ge1
                                      Name: gi1
                                      Switchport: enable
                                      Administrative Mode: trunk
                                      Operational Mode: up
                                      Access Mode VLAN: 10
                                      Trunking Native Mode VLAN: 1 (Inactive)
                                      Trunking VLANs: 10,20
                                      General PVID: 1
                                      General VLANs: none
                                      General Egress Tagged VLANs: none
                                      General Forbidden VLANs: none
                                      General Ingress Filtering: enabled
                                      General Acceptable Frame Type: all
                                      General GVRP status: disabled
                                      Customer Mode VLAN: none
                                      
                                      
                                      Roth-SG250-50P-1(config-if)#do show interfaces switchport ge20
                                      Name: gi20
                                      Switchport: enable
                                      Administrative Mode: access
                                      Operational Mode: down
                                      Access Mode VLAN: 20
                                      Trunking Native Mode VLAN: 1
                                      Trunking VLANs: 1,10,20
                                                              2-9,11-19,21-4094 (Inactive)
                                      General PVID: 1
                                      General VLANs: none
                                      General Egress Tagged VLANs: none
                                      General Forbidden VLANs: none
                                      General Ingress Filtering: enabled
                                      General Acceptable Frame Type: all
                                      General GVRP status: disabled
                                      Customer Mode VLAN: none
                                      
                                      
                                      Roth-SG250-50P-1(config-if)#do show interfaces switchport ge24
                                      Name: gi24
                                      Switchport: enable
                                      Administrative Mode: access
                                      Operational Mode: up
                                      Access Mode VLAN: 10
                                      Trunking Native Mode VLAN: 1
                                      Trunking VLANs: 1,10,20
                                                              2-9,11-19,21-4094 (Inactive)
                                      General PVID: 1
                                      General VLANs: none
                                      General Egress Tagged VLANs: none
                                      General Forbidden VLANs: none
                                      General Ingress Filtering: enabled
                                      General Acceptable Frame Type: all
                                      General GVRP status: disabled
                                      Customer Mode VLAN: none
                                      
                                      

                                      I ran tcpdump -i igb1 -e on the pfSense server while plugging in the Linux workstation into port 20.
                                      Searched the sniffer output for "vlan" and did not find that string.

                                      P 1 Reply Last reply Reply Quote 0
                                      • P
                                        pete35 @Cannondale
                                        last edited by

                                        @cannondale

                                        Try to configure another port to vlan 10 from/with the GUI. Save the config and reboot the switch and test afterwards. I just checked one of my switches and it works straightforward.

                                        <a href="https://carsonlam.ca">bintang88</a>
                                        <a href="https://carsonlam.ca">slot88</a>

                                        C 1 Reply Last reply Reply Quote 0
                                        • C
                                          Cannondale @pete35
                                          last edited by

                                          @pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                          Try to configure another port to vlan 10 from/with the GUI. Save the config and reboot the switch and test afterwards.

                                          Thanks for the suggestion pete35!
                                          Configured switch port 23 to be a member of vlan 10 via GUI.
                                          copied running-config to startup-config

                                          Show output below.

                                          Roth-SG250-50P-1#show vlan
                                          Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN
                                          
                                          Vlan       Name           Tagged Ports      UnTagged Ports      Created by    
                                          ---- ----------------- ------------------ ------------------ ---------------- 
                                           1           1                            gi2-19,gi21-22,           DV        
                                                                                    gi25-50,Po1-4                       
                                           10      testvl10             gi1              gi23-24              S         
                                           20      testvl20             gi1                gi20               S         
                                          
                                          Roth-SG250-50P-1#sho run int gi1
                                          interface GigabitEthernet1
                                           switchport mode trunk
                                           switchport access vlan 10
                                           switchport trunk allowed vlan 10,20
                                          !
                                          Roth-SG250-50P-1#sho run int gi23
                                          interface GigabitEthernet23
                                           switchport access vlan 10
                                          

                                          Ran tcpdump -i igb1 -e on the pfSense box while plugging in the Linux workstation into port 23. Searched the sniffer output for "vlan" and did not find that string.

                                          Note: was not able to bounce the switch before the test as several users are using the system.
                                          Can try that later today if it would help.

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @Cannondale
                                            last edited by johnpoz

                                            @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                            was not able to bounce the switch before

                                            There is no reason you should have to bounce the switch, the only time you should ever have to reboot a switch is if you are updating its firmware.

                                            Well @mvikman shows his output as showing that vlan 1 as native for ingress and says its working.. Which isn't what the output would express if you ask me.

                                            But yours isn't

                                            My sg300 correctly shows that native ingress on whatever access vlan I put on a port.. See my example output where I change the port 28 to different vlan and then back, etc..

                                            Maybe the sg250 is just crap when it comes to what the cli shows - but then why isnt this working?

                                            For a last hope go to general mode and specifically set the native vlan and the vlan your on..

                                            But sorry if your not seeing tagged coming into pfsense where you have a vlan setup - its never going to work.. That is for sure..

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            C 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.