No DHCP on pfSense VLAN with Cisco Smart Switch

[Cannondale]

johnpoz, thanks for continuing to hang in there!
The Interface Settings page in the GUI only shows two options for a port. Access and Trunk.

But the Port VLAN Membership page in the GUI shows Access, Trunk, General and Customer.

My question is can I change the port access mode to General in the cli if the General option in not available in the GUI? If so would it appear as General on the Port VLAN Membership page?

[Cannondale]

Update:

Tried configuring port 20 (VLAN20) via cli to general mode.

Roth-SG250-50P-1(config)#do sho run int ge20
interface GigabitEthernet20
 switchport mode general
 switchport general allowed vlan add 20 untagged
 switchport access vlan 20
 switchport general pvid 20
!

Roth-SG250-50P-1(config-if)#do sho run int ge1
interface GigabitEthernet1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
!

Looked at the GUI Port VLAN Membership page, which looked ok to me.
Couldn't upload the screenshot here do to error:parse-error.
Here is the text version:

F - Forbidden member	T - Tagged member	U - Untagged member	I - Inactive VLAN	P - PVID
Interface	Mode	Administrative VLANs	Operational VLANs
GE1	        Trunk	1UI, 10T, 20T	                10T, 20T	
GE20	        General	20U, 20P	                20U

Ran tcpdump -i igb1 -e on the pfSense box while plugging in the Linux workstation into port 20. Searched the sniffer output for "vlan" and did not find that string.

OMG!

[mvikman]

Just a thought... the CBS-series GUI has a dropdown menu on the top right that switches between Basic and Advanced views, the Basic hides some stuff on the menus. Does the SG250 have that?

[pete35]

@Cannondale I did a quick configuration on a local CBS350 Switch with a tagged port from a pfsense to that switch similar the configuration you have. Requesting a DHCP address from a workstation on an acces port and dumping the traffic with tcpdump on the pfsense. Tcpdump doesn't show up any VLAN Information with tcpdump -i ix0 -e - but opening the dumpfile with wireshark shows DHCP Request and DHCP Ack to that port and to an Access port on that switch which works without any issues. Maybe you should search for DHCP in your dumpfile and not for vlan ?

Doing a PacketCapture on the pfsense also doesn't show up (with Wireshark) any VLAN information, but the DHCP Request and Ack Sequence.

It is not common to see Vlan tags on packet capture or tcpdump files, you need to configure the adapter for that. It looks like pfsense is not configured to show vlan tags on the interfaces for capturing.

Im assuming that your switch doing its job correctly.

TESTSWITCH#sh vlan
Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN
Vlan Name Tagged Ports UnTagged Ports Created by

---

1 1 gi1/0/5, D
101 TEST1 gi1/0/5 gi1/0/6 S

TESTSWITCH#sh run interface gi 1/0/5
interface GigabitEthernet1/0/5
switchport mode trunk
switchport trunk allowed vlan 1,101
!
TESTSWITCH#sh run interface gi 1/0/6
interface GigabitEthernet1/0/6
switchport access vlan 101

[johnpoz]

@pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

Tcpdump doesn't show up any VLAN Information with tcpdump -i ix0 -e

And how is that - if your traffic is not tagged.. ?

It is not common to see Vlan tags on packet capture or tcpdump files

It is when you use -e

-e
    Print the link-level header on each dump line. This can be used, for example, to print MAC layer addresses for protocols such as Ethernet and IEEE 802.11.

[pete35]

@johnpoz

Showing up VLAN tags may depend on the pfsense type/version/device driver and the nic. At least within my configuration it doesnt show up any VLAN Tags. Lets check cannondales dump file again.

[johnpoz]

@pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

type/version/device driver and the nic

Possible.. But if it was working and sending the tags, why is his dhcp server not seeing the discover?

For it to work, the tags have to be there - so why wouldn't basic function of tcpdump not show them?

He is using igb interfaces - same as me. Maybe there is something with your ix interfaces, but have been using tcpdump for years.. I have never seen such an issue on all kinds of different hardware and OSes - and it for sure has worked on freebsd and pfsense going back as far as I can remember.

edit: Just ordered a sg250-08HP off ebay.. Going to play with one of these myself.. This can not be this difficult ;) Says should be here

Estimated delivery:
Sat, May 27 - Tue, May 30

Hoping for the 27th ;)

[Cannondale]

@mvikman
This is what my menu looks like:

[pete35]

@johnpoz
i cant imaging how this switch shouldnt do vlan tagging correctly. If its defect it wouldnt do anything. There are thousand of SGXXX switches out there, googleing for vlan tagging problems doesnt give any problems at all.

for the tcpdump vlan story: you see the vlan tags if running tcpdump with "-v". With "-w" it goes to a file which can be open with wireshark, vlan tags are not shown there by default.

[johnpoz]

@pete35 its quite possible he is looking at his output from tcpdump wrong? But I was quite clear on how to do it and showed examples.. Its a simple std output to the screen.

I am with you - there are 1000's or even 10s or 100s of thousands of these out there - if there was some issue with vlans you would think it would be easy enough to find people complaining.

I will have one to play with here in a few days ;) As long as it works - it will allow me to get rid of an injector using for my flex HD unifi AP have sitting on my floor in my computer room..

Its an open box off ebay - so you never know. But says fully operational just missing couple of the rubber feet on the bottom ;)

[pete35]

@johnpoz

I would really like to know the issue here. CBS350 or Catalyst 1000 is the better modern choice for this switches. SG250 is really old in terms of Cisco switches. Most of the models arent supported anymore by new firmware versions. Vlans are are working for pfsense and also for this Cisco switch. So there must be a issue between them or on layer 8 maybe.

[Cannondale]

Thanks for your efforts pete35! Very interesting information.
Not familiar with wireshark. Will install it and see what I can find.

I did check the pfSense DHCP log for DHCPREQUEST on the vlan20 IP but don't see anything. Just the entry for "Listening on BPF/igb1"

[pete35]

@johnpoz @Cannondale

pls reboot that switch:

[johnpoz]

@pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

anymore by new firmware versions

The sg250 seems to have gotten a firmware release quite recent.

My own sg300 hasn't had one since 18-Jun-2020

Pretty sure he has rebooted - since I know he changed firmwares at one point, etc.

[mvikman]

He originally had the latest firmware installed

Roth-SG250-50P-1
v2.5.9.16 / RCBS3.1_930_871_10

Also his latest "show tech" shows that firmware 2.5.9.16 is active

------------------ show version ------------------
Active-image: flash://system/images/image_tesla250_hybrid_2.5.9.16_release_cisco_signed.bin
  Version: 2.5.9.16
  MD5 Digest: c1f283dd662260f1532ef8cb26158014
  Date: 27-Feb-2023
  Time: 16:57:47
Inactive-image: flash://system/images/SG250-50P-Firmware_Backup_v2.4.0.94-image1-20230428.bin
  Version: 2.4.0.94
  MD5 Digest: 6f5be217100f34929986f2e93dd2d5e9
  Date: 31-May-2018
  Time: 02:39:58

[Cannondale]

@mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

He originally had the latest firmware installed

Confirmed the latest fw is active.

[johnpoz]

@mvikman yeah he has gone to older firmware at one point

[Cannondale]

@johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

Just ordered a sg250-08HP off ebay

You're a stand up guy for going the extra mile johnpoz!
No need to spend your money to help solve my problem!
PM me and let me know how much it was so that I can reimburse you.

[pete35]

@Cannondale
i tought the same. Johnpoz is great.

can you post the whole page of the vlan 10 interface configuration on the firewall ?

[Derelict]

If you pcap on the parent interface you will see all the VLAN tags there along with all traffic on all VLANs. If you pcap on the VLAN interface you will not see the tags.

I sometimes create unnumbered pfSense interfaces on the parent (IPv4 and IPv6 set to None) just so I can pcap there.