Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No DHCP on pfSense VLAN with Cisco Smart Switch

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    147 Posts 7 Posters 91.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      Cannondale @pete35
      last edited by

      @pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

      can you post the whole page of the vlan 10 interface configuration on the firewall ?

      vlan10 is configured for access mode on ge24
      vlan20 is configured for general mode on ge20

      Screenshot from 2023-05-24 08-33-22.png

      Screenshot from 2023-05-24 08-33-55.png

      P 1 Reply Last reply Reply Quote 0
      • P
        pete35 @Derelict
        last edited by

        @Derelict
        thank you. i already found it. Wireshark shows the vlan tag under each packet. yo need to open a packet to see the vlan 802.1q information.

        <a href="https://carsonlam.ca">bintang88</a>
        <a href="https://carsonlam.ca">slot88</a>

        C 1 Reply Last reply Reply Quote 0
        • P
          pete35 @Cannondale
          last edited by

          @Cannondale

          Maybe we can do another configuration:

          if you have a free port on your Pfsense, just configure it as LAN port with the IP address of your VLAN 10, first clear that VLAN 10 interface including that DHCP Server. Then configure two ports on the switch as access port in vlan 10. Connect one port directly to the second/new LAN port of pfsense, the other one to your workstation. You need to configure the DHCP Server at the new LAN port.

          Your workstation should be able to get an IP DHCP address from Pfsense in this VLAN 10.

          So no tagging is needed, if that is an issue with that switch.

          <a href="https://carsonlam.ca">bintang88</a>
          <a href="https://carsonlam.ca">slot88</a>

          C 2 Replies Last reply Reply Quote 0
          • C
            Cannondale @pete35
            last edited by

            @pete35
            wireshark doesn't seem to be noob friendly. I'm in a "packets must be specified" loop!

            P 1 Reply Last reply Reply Quote 0
            • C
              Cannondale @pete35
              last edited by

              @pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

              Maybe we can do another configuration

              Working on it now

              1 Reply Last reply Reply Quote 0
              • C
                Cannondale @pete35
                last edited by

                @pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                Your workstation should be able to get an IP DHCP address from Pfsense in this VLAN 10

                Got a vlan10 IP on the workstation. Didn't need to reconfigure the switch for vlan10 as port 23 and 24 were already configured for vlan10.

                sw vlan.png

                P 1 Reply Last reply Reply Quote 0
                • P
                  pete35 @Cannondale
                  last edited by

                  @Cannondale
                  That sounds good. Add more vlan 10 access ports to connect your servers and so on.
                  Until you find another solution with that tagging issue, this is as good as a trunked port and seperates the traffic.
                  Dont forget to add some firewall rules to limit the access to vlan 10 if you need this. Pfsense will route between Vlans.

                  <a href="https://carsonlam.ca">bintang88</a>
                  <a href="https://carsonlam.ca">slot88</a>

                  1 Reply Last reply Reply Quote 0
                  • P
                    pete35 @Cannondale
                    last edited by

                    @Cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                    wireshark doesn't seem to be noob friendly. I'm in a "packets must be specified" loop!

                    @Cannondale
                    this sounds interesting. if you startup wireshark on your interface of a workstation, it should work out of the box. So maybe there is something crazy on your network at all. Did you select the correct running interface?

                    if you generate a tcpdump file with "tcpdump -i interface -e -w dumpfile.pcap" you can open it with wireshark and you can save captured wireshark packets into a file for later analysis.

                    <a href="https://carsonlam.ca">bintang88</a>
                    <a href="https://carsonlam.ca">slot88</a>

                    C 2 Replies Last reply Reply Quote 0
                    • C
                      Cannondale @pete35
                      last edited by

                      @pete35
                      Plugged the test Linux workstation into switch port 20 (vlan20).
                      I was able to create a dumpfile.pcap file on pfSense and open it on another machine in Wireshark. As a non-Network Engineer, what should I look for?

                      P 1 Reply Last reply Reply Quote 0
                      • C
                        Cannondale @pete35
                        last edited by

                        @pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                        if you startup wireshark on your interface of a workstation, it should work out of the box.

                        This is what I was seeing after entering some host information:

                        wireshark.png

                        P 1 Reply Last reply Reply Quote 0
                        • P
                          pete35 @Cannondale
                          last edited by

                          @Cannondale

                          looks like it needs some more parameters on startup or needs some more priviledges (root?)
                          check the "-c" parameter and maybe check all this here:
                          https://adamtheautomator.com/wireshark-linux/

                          <a href="https://carsonlam.ca">bintang88</a>
                          <a href="https://carsonlam.ca">slot88</a>

                          C 1 Reply Last reply Reply Quote 0
                          • P
                            pete35 @Cannondale
                            last edited by pete35

                            @Cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                            Plugged the test Linux workstation into switch port 20 (vlan20).

                            Do you need another vlan ? Or is this just for investigation?
                            You can configure another vlan with the same trick, if you have more interfaces on the pfsense.

                            If you can, you may wipe out the whole configuration on the switch and reset it to an initial state. Configure it then only on the GUI. There are a lot of configuration options, maybe not shown on the cli. So if something is hidden, it may influence this crazy vlan issue.

                            https://www.cisco.com/c/dam/en/us/td/docs/switches/lan/csbss/sf_sg250/quick_start/guide/en_US/78-100762-01A0.pdf

                            <a href="https://carsonlam.ca">bintang88</a>
                            <a href="https://carsonlam.ca">slot88</a>

                            C 1 Reply Last reply Reply Quote 0
                            • C
                              Cannondale @pete35
                              last edited by

                              @pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                              Do you need another vlan ? Or is this just for investigation?

                              Both. Ultimately need to confirm whether the switch is having an issue with tags. If not a config issue, I will replace it.

                              @pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                              You can configure another vlan with the same trick, if you have more interfaces on the pfsense.

                              Understood. I'm not a network expert but I recall that this is called segmentation. My quad port card in the pfSence server is full now. It appears that using additional NIC ports to segregate the LAN is a hardware approach as opposed to the vlan approach. My preference would be to use vlans unless a particular use case suggests that segmentation would work better.

                              1 Reply Last reply Reply Quote 0
                              • C
                                Cannondale @pete35
                                last edited by

                                @pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                looks like it needs some more parameters on startup or needs some more priviledges (root?)
                                check the "-c" parameter and maybe check all this here:
                                https://adamtheautomator.com/wireshark-linux/

                                Thanks for the link! I'll check it out.

                                J 1 Reply Last reply Reply Quote 0
                                • J
                                  Jarhead @Cannondale
                                  last edited by

                                  @Cannondale I just skimmed this thread so I may have missed it but have you tried putting 2 ports in the same vlan and see if they can communicate?

                                  C 1 Reply Last reply Reply Quote 0
                                  • C
                                    Cannondale @Jarhead
                                    last edited by

                                    @Jarhead said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                    have you tried putting 2 ports in the same vlan and see if they can communicate?

                                    Thanks for chiming in Jarhead. Yes. Two untagged ports can communicate on a vlan. One connected to pfSense and the other connected to a Linux workstation.

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @Cannondale
                                      last edited by johnpoz

                                      @Cannondale Ok my sg250-08HP just got here.. clickly clicky running a vlan10..

                                      So either your switch is borked or you are doing something odd that we are missing... I didn't do anything to the switch other than boot it, give it an IP 192.168.200.9.. Plugged it into my igb4 interface that has 192.168.200.1/24

                                      Setup a vlan with 172.16.10.253/24 enabled dhcp..

                                      settingss.jpg

                                      switchf65809#term datadump                            
                                      switchf65809#sho run
                                      config-file-header
                                      switchf65809
                                      v2.5.8.15 / RCBS3.1_930_871_084
                                      CLI v1.0
                                      file SSD indicator encrypted
                                      @
                                      ssd-control-start
                                      ssd config
                                      ssd file passphrase control unrestricted
                                      no ssd file integrity control
                                      ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0
                                      !
                                      !
                                      unit-type-control-start
                                      unit-type unit 1 network gi uplink none
                                      unit-type-control-end
                                      !
                                      vlan database
                                      vlan 10
                                      exit
                                      voice vlan state auto-triggered
                                      voice vlan oui-table add 0001e3 Siemens_AG_phone
                                      voice vlan oui-table add 00036b Cisco_phone
                                      voice vlan oui-table add 00096e Avaya
                                      voice vlan oui-table add 000fe2 H3C_Aolynk
                                      voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
                                      voice vlan oui-table add 00d01e Pingtel_phone
                                      voice vlan oui-table add 00e075 Polycom/Veritel_phone
                                      voice vlan oui-table add 00e0bb 3Com_phone
                                      hostname switchf65809
                                      username user password encrypted $15$RNkCnVXJLcID4IKT$EDhJvPxPXJSsrsKvB8y0SMuwEaQn2SVckrVGzq6WfpOactj45CrUSHkc7nLpQAuAkdP72MS+2pTULQy7rIavcg== privilege 15
                                      ip ssh server
                                      sntp server 192.168.3.32 poll
                                      ip name-server  192.168.200.1
                                      !
                                      interface vlan 1
                                       ip address 192.168.200.9 255.255.255.0
                                       no ip address dhcp
                                      !
                                      interface GigabitEthernet1
                                       switchport mode trunk
                                       switchport trunk allowed vlan 1,10
                                      !
                                      interface GigabitEthernet8
                                       switchport access vlan 10
                                      !
                                      exit
                                      macro auto controlled
                                      ip default-gateway 192.168.200.1
                                      switchf65809#
                                      

                                      Now its currently running 2.5.8.15, plug into port 8 get an IP on the 172.16.10 network, plug into port 7 get an IP of vlan 1, 192.168.200..

                                      Going to update it to latest version - brb

                                      edit: ok back on 2.5.9.16, all working just fine..

                                      edit2: here is the dhcp from client I plugged into port 8 on the sg250, you can see it got an IP from my vlan 10 I setup on pfsense

                                      May 27 17:09:49 	dhcpd 	98873 	DHCPACK on 172.16.10.11 to d0:37:45:0e:8c:be via igb4.10
                                      May 27 17:09:49 	dhcpd 	98873 	DHCPREQUEST for 172.16.10.11 (172.16.10.253) from d0:37:45:0e:8c:be via igb4.10
                                      May 27 17:09:49 	dhcpd 	98873 	DHCPOFFER on 172.16.10.11 to d0:37:45:0e:8c:be via igb4.10
                                      May 27 17:09:48 	dhcpd 	98873 	DHCPDISCOVER from d0:37:45:0e:8c:be via igb4.10 
                                      

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      C 1 Reply Last reply Reply Quote 0
                                      • C
                                        Cannondale @johnpoz
                                        last edited by

                                        @johnpoz

                                        Sorry for the delay in responding. Just got back into town after traveling. Thanks for the additional information. Very helpful!
                                        I have an SG300 that arrived yesterday and still in a box. Will spark it up today to see what I find and report back.

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @Cannondale
                                          last edited by johnpoz

                                          @Cannondale one thing nice about the sg300 is shows pvid info ;)

                                          Both in the gui, and from cli

                                          That the gui lists P in the legend, but then doesn't show it, and the cli showing this confusing as hell

                                          Port : gi8
                                          Port Mode: 
                                          Gvrp Status: disabled
                                          Ingress Filtering: true
                                          Acceptable Frame Type: admitAll
                                          Ingress UnTagged VLAN ( NATIVE ): 1
                                           
                                          Port is member in: 
                                           
                                          Vlan               Name               Egress rule     Added by     
                                          ---- -------------------------------- ----------- ---------------- 
                                           10                 10                 Untagged          S         
                                          

                                          When I look at a interface with vlan on my sg300

                                          Port : gi1
                                          Port Mode: Access 
                                          Gvrp Status: disabled
                                          Ingress Filtering: true
                                          Acceptable Frame Type: admitAll
                                          Ingress UnTagged VLAN ( NATIVE ): 99
                                           
                                          Port is member in: 
                                           
                                          Vlan               Name               Egress rule     Added by     
                                          ---- -------------------------------- ----------- ---------------- 
                                           99                wan                 Untagged          S         
                                          
                                           
                                          Forbidden VLANS: 
                                          Vlan               Name               
                                          ---- -------------------------------- 
                                          
                                          

                                          That being said - I had no issues setting a interface to access in a vlan on the sg250, and it working as it should with the vlan tagged to pfsense via "trunk" port.. Even though the cli output is bonkers ;)

                                          There is clearly room for improvement in the info they show in the gui and the cli on the 250.. Why is showing the ingress untagged vlan as 1, when clearly that could not be the case if the interface is access in vlan 10..

                                          Notice on the 300, it shows the native same as the vlan used for egress as untagged.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          C M 2 Replies Last reply Reply Quote 0
                                          • C
                                            Cannondale @johnpoz
                                            last edited by

                                            @johnpoz Got the SG300 up and running. Firmware and boot code were quite old (fw 1.2.9.44 and bc 1.1.0.6).
                                            Upgraded both to the latest releases (fw 1.4.11.5 and bc 1.3.5.06), which was a feat in it self! Too bad Cisco hasn’t upgraded the firmware in the last three years!

                                            P in the legend, but then doesn't show it, and the cli showing this confusing as hell

                                            I definitely see what you mean!

                                            Created the following test vlans on the switch:
                                            Note: igb1 is the Main Lan in pfSense

                                            VLAN10 (Test1)
                                            Switch port 23, Trunk mode, Tagged, connected to pfSense VLAN10 (igb2)
                                            Switch port 24, Access mode, Untagged, connected to Linux workstation
                                            Wide open firewall rule for VLAN10

                                            Test results: DHCP works as expected and provides Linux workstation IP

                                            VLAN20 (Test2)
                                            Switch port 51, Trunk mode, Tagged, connected to pfSense igb1 (Main Lan)
                                            Switch port 46, Access mode, Untagged, connected to Linux workstation
                                            Wide open firewall rule for VLAN20

                                            Test results: No DHCPREQUEST in pfSense DHCP log, no IP provided to Linux workstation

                                            I must be missing something stupid simple?

                                            sw pvm vl20.png

                                            pfs int ass.png

                                            pfs int vl20.png

                                            pfs dhcp vl20.png

                                            pfs fw vl20.png

                                            M 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.