No DHCP on pfSense VLAN with Cisco Smart Switch
-
Just for fun, as a comparison, here's the config from my CBS250 switch, looks almost identical in format/command wise as Cannondale's SG250
Everything is working as it should, pfSense interface has only VLANS configured.pfSense Plus 24.11-RELEASE (amd64)
Dell Optiplex 7040 SFF
Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
HPE 561T (X540-AT2), 2-port 10Gb RJ45
HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+ -
@mvikman Hey could you post the output of your show tech so we can see what it says the pvid is..
say ports 4 and 5 that have vlan 20 and 2000 on them.
Where his was showing..
Ingress UnTagged VLAN ( NATIVE ): 1
When the lan was suppose to be 10.
-
Fresh run of show text attached.
-
@mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:
Just for fun, as a comparison, here's the config from my CBS250 switch
Thanks mvikman!
-
@johnpoz I'll just put some of the relevant ports from the tech output
gi1: trunk port to pfSense
gi2: trunk port to Wifi Ap
gi3: access port to main pc
gi4: access port homeserver
gi5: empty port (in "port park" vlan)------------------ show interfaces switchport ------------------ Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi1 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 10 MGMT Tagged S 20 LAN Tagged S 25 MEDIA Tagged S 30 WORK Tagged S 35 CAMERA Tagged S 40 IOT Tagged S 50 GUEST Tagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi2 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 10 MGMT Tagged S 20 LAN Tagged S 25 MEDIA Tagged S 30 WORK Tagged S 35 CAMERA Tagged S 40 IOT Tagged S 50 GUEST Tagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi3 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 20 LAN Untagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi4 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 20 LAN Untagged S Forbidden VLANS: Vlan Name ---- -------------------------------- Classification rules: Added by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, T-Guest VLAN, V-Voice VLAN Port : gi5 Port Mode: Gvrp Status: disabled Ingress Filtering: true Acceptable Frame Type: admitAll Ingress UnTagged VLAN ( NATIVE ): 1 Port is member in: Vlan Name Egress rule Added by ---- -------------------------------- ----------- ---------------- 2000 PortPark Untagged S Forbidden VLANS: Vlan Name ---- --------------------------------Here's "sh int switchport" from CLI on some of the above ports
HOME-SW2#sh int switchport gi1 Name: gi1 Switchport: enable Administrative Mode: trunk Operational Mode: up Access Mode VLAN: 1 Trunking Native Mode VLAN: 4000 (Inactive) Trunking VLANs: 10,20,25,30,35,40,50 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Classification rules: HOME-SW2#sh int switchport gi3 Name: gi3 Switchport: enable Administrative Mode: access Operational Mode: up Access Mode VLAN: 20 Trunking Native Mode VLAN: 1 Trunking VLANs: 1 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Classification rules: HOME-SW2#sh int switchport gi5 Name: gi5 Switchport: enable Administrative Mode: access Operational Mode: down Access Mode VLAN: 2000 Trunking Native Mode VLAN: 1 Trunking VLANs: 1 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Classification rules: HOME-SW2# -
@mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:
ngress UnTagged VLAN ( NATIVE ): 1
Port is member in:
Vlan Name Egress rule Added by
2000 PortPark Untagged S
Well yours is showing borked as well..
How is that suppose to work if untagged traffic comes into that port onto vlan 1
-
I would say this is pretty normal.
look at this sg350X :
trunk port with native vlan 2, works perfectly.
MUPSW02SG350X#sh int switchport gi1/0/1
S-VLAN Ethernet Type: 0x8100 (802.1q)
VLAN Mapping Tunnel L2 protocols Global CoS: 5
Name: gi1/0/1
Switchport: enable
Administrative Mode: trunk
Operational Mode: up
Access Mode VLAN: 1
Access Multicast TV VLAN: none
Trunking Native Mode VLAN: 2
Trunking VLANs: 1-2,10-11,14,21,111,113,120
3-9,12-13,15-20,22-110,112,114-119,121-4094 (Inactive)
General PVID: 1
General VLANs: none
General Egress Tagged VLANs: none
General Forbidden VLANs: none
General Ingress Filtering: enabled
General Acceptable Frame Type: all
General GVRP status: disabled -
@pete35 not talking about trunk port
-
Well, everything works even if it looks borked...
Hmm... looking at the CBS-series CLI guide, "switchport mode" has these parameters
• access—Specifies an untagged layer 2 VLAN port.
• trunk—Specifies a trunking layer 2 VLAN port.
• general—Specifies a full 802-1q-supported VLAN port.
• customer—Specifies that an edge port connected to customer equipment. Traffic received from this port
will be tunneled with the additional 802.1q VLAN tag (Q-in-Q VLAN tunneling).Also seems that those Ingress VLAN and PVID values are only used when the port is in General mode
-
hmmm lets asume that the switch is working properly.
if we set the workstation manually to the desired ip address/mask and gateway, there
should be a ping answer from the gateway on the pfsense.
just an idea to check this out.next : change the workstation port to lets say port 23 and try to set the vlan there
and maybe : reboot pfsense and change the cables
-
@pete35 all of that has already been done. Sniff on port going to pfsense no vlan tags - which has nothing to do with pfense
-
@johnpoz
we are using a lot of these switches and i never saw such problems. There are other problems with this switches but not within those basic vlan stuff. As these switches have a lifetime warranty from cisco, maybe a return and exchange will solve this issue. Otherwise im out of ideas what is wrong here. -
I plugged in a Linux workstation into switch port 20, which was a normal lan port.
Got an IP from pfSense as expected.
Configured switch port 20 as a vlan using the cli. Note: port 20 was not previously configured as a vlan.Output below of:
show vlan
sho run int
show interfaces switchportNote: Switch port 1 is the pfSense Trunk port.
Roth-SG250-50P-1(config-if)#do show vlan Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN Vlan Name Tagged Ports UnTagged Ports Created by ---- ----------------- ------------------ ------------------ ---------------- 1 1 gi2-19,gi21-23, DV gi25-50,Po1-4 10 testvl10 gi1 gi24 S 20 testvl20 gi1 gi20 S Roth-SG250-50P-1#sho run int gi1 interface GigabitEthernet1 switchport mode trunk switchport access vlan 10 switchport trunk allowed vlan 10,20 ! Roth-SG250-50P-1#sho run int gi20 interface GigabitEthernet20 switchport access vlan 20 ! Roth-SG250-50P-1(config-if)#do show interfaces switchport ge1 Name: gi1 Switchport: enable Administrative Mode: trunk Operational Mode: up Access Mode VLAN: 10 Trunking Native Mode VLAN: 1 (Inactive) Trunking VLANs: 10,20 General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Roth-SG250-50P-1(config-if)#do show interfaces switchport ge20 Name: gi20 Switchport: enable Administrative Mode: access Operational Mode: down Access Mode VLAN: 20 Trunking Native Mode VLAN: 1 Trunking VLANs: 1,10,20 2-9,11-19,21-4094 (Inactive) General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: none Roth-SG250-50P-1(config-if)#do show interfaces switchport ge24 Name: gi24 Switchport: enable Administrative Mode: access Operational Mode: up Access Mode VLAN: 10 Trunking Native Mode VLAN: 1 Trunking VLANs: 1,10,20 2-9,11-19,21-4094 (Inactive) General PVID: 1 General VLANs: none General Egress Tagged VLANs: none General Forbidden VLANs: none General Ingress Filtering: enabled General Acceptable Frame Type: all General GVRP status: disabled Customer Mode VLAN: noneI ran tcpdump -i igb1 -e on the pfSense server while plugging in the Linux workstation into port 20.
Searched the sniffer output for "vlan" and did not find that string. -
Try to configure another port to vlan 10 from/with the GUI. Save the config and reboot the switch and test afterwards. I just checked one of my switches and it works straightforward.
-
@pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:
Try to configure another port to vlan 10 from/with the GUI. Save the config and reboot the switch and test afterwards.
Thanks for the suggestion pete35!
Configured switch port 23 to be a member of vlan 10 via GUI.
copied running-config to startup-configShow output below.
Roth-SG250-50P-1#show vlan Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN Vlan Name Tagged Ports UnTagged Ports Created by ---- ----------------- ------------------ ------------------ ---------------- 1 1 gi2-19,gi21-22, DV gi25-50,Po1-4 10 testvl10 gi1 gi23-24 S 20 testvl20 gi1 gi20 S Roth-SG250-50P-1#sho run int gi1 interface GigabitEthernet1 switchport mode trunk switchport access vlan 10 switchport trunk allowed vlan 10,20 ! Roth-SG250-50P-1#sho run int gi23 interface GigabitEthernet23 switchport access vlan 10Ran tcpdump -i igb1 -e on the pfSense box while plugging in the Linux workstation into port 23. Searched the sniffer output for "vlan" and did not find that string.
Note: was not able to bounce the switch before the test as several users are using the system.
Can try that later today if it would help. -
@cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:
was not able to bounce the switch before
There is no reason you should have to bounce the switch, the only time you should ever have to reboot a switch is if you are updating its firmware.
Well @mvikman shows his output as showing that vlan 1 as native for ingress and says its working.. Which isn't what the output would express if you ask me.
But yours isn't
My sg300 correctly shows that native ingress on whatever access vlan I put on a port.. See my example output where I change the port 28 to different vlan and then back, etc..
Maybe the sg250 is just crap when it comes to what the cli shows - but then why isnt this working?
For a last hope go to general mode and specifically set the native vlan and the vlan your on..
But sorry if your not seeing tagged coming into pfsense where you have a vlan setup - its never going to work.. That is for sure..
-
johnpoz, thanks for continuing to hang in there!
The Interface Settings page in the GUI only shows two options for a port. Access and Trunk.
But the Port VLAN Membership page in the GUI shows Access, Trunk, General and Customer.
My question is can I change the port access mode to General in the cli if the General option in not available in the GUI? If so would it appear as General on the Port VLAN Membership page?
-
Update:
Tried configuring port 20 (VLAN20) via cli to general mode.
Roth-SG250-50P-1(config)#do sho run int ge20 interface GigabitEthernet20 switchport mode general switchport general allowed vlan add 20 untagged switchport access vlan 20 switchport general pvid 20 ! Roth-SG250-50P-1(config-if)#do sho run int ge1 interface GigabitEthernet1 switchport mode trunk switchport trunk allowed vlan 10,20 !Looked at the GUI Port VLAN Membership page, which looked ok to me.
Couldn't upload the screenshot here do to error:parse-error.
Here is the text version:F - Forbidden member T - Tagged member U - Untagged member I - Inactive VLAN P - PVID Interface Mode Administrative VLANs Operational VLANs GE1 Trunk 1UI, 10T, 20T 10T, 20T GE20 General 20U, 20P 20URan tcpdump -i igb1 -e on the pfSense box while plugging in the Linux workstation into port 20. Searched the sniffer output for "vlan" and did not find that string.
OMG!
-
Just a thought... the CBS-series GUI has a dropdown menu on the top right that switches between Basic and Advanced views, the Basic hides some stuff on the menus. Does the SG250 have that?
-
@Cannondale I did a quick configuration on a local CBS350 Switch with a tagged port from a pfsense to that switch similar the configuration you have. Requesting a DHCP address from a workstation on an acces port and dumping the traffic with tcpdump on the pfsense. Tcpdump doesn't show up any VLAN Information with tcpdump -i ix0 -e - but opening the dumpfile with wireshark shows DHCP Request and DHCP Ack to that port and to an Access port on that switch which works without any issues. Maybe you should search for DHCP in your dumpfile and not for vlan ?
Doing a PacketCapture on the pfsense also doesn't show up (with Wireshark) any VLAN information, but the DHCP Request and Ack Sequence.
It is not common to see Vlan tags on packet capture or tcpdump files, you need to configure the adapter for that. It looks like pfsense is not configured to show vlan tags on the interfaces for capturing.
Im assuming that your switch doing its job correctly.
TESTSWITCH#sh vlan
Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN
Vlan Name Tagged Ports UnTagged Ports Created by
1 1 gi1/0/5, D
101 TEST1 gi1/0/5 gi1/0/6 STESTSWITCH#sh run interface gi 1/0/5
interface GigabitEthernet1/0/5
switchport mode trunk
switchport trunk allowed vlan 1,101
!
TESTSWITCH#sh run interface gi 1/0/6
interface GigabitEthernet1/0/6
switchport access vlan 101<a href="https://carsonlam.ca">bintang88</a>
<a href="https://carsonlam.ca">slot88</a>
