Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No DHCP on pfSense VLAN with Cisco Smart Switch

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    147 Posts 7 Posters 99.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Jarhead @Cannondale
      last edited by

      @Cannondale I just skimmed this thread so I may have missed it but have you tried putting 2 ports in the same vlan and see if they can communicate?

      C 1 Reply Last reply Reply Quote 0
      • C
        Cannondale @Jarhead
        last edited by

        @Jarhead said in No DHCP on pfSense VLAN with Cisco Smart Switch:

        have you tried putting 2 ports in the same vlan and see if they can communicate?

        Thanks for chiming in Jarhead. Yes. Two untagged ports can communicate on a vlan. One connected to pfSense and the other connected to a Linux workstation.

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @Cannondale
          last edited by johnpoz

          @Cannondale Ok my sg250-08HP just got here.. clickly clicky running a vlan10..

          So either your switch is borked or you are doing something odd that we are missing... I didn't do anything to the switch other than boot it, give it an IP 192.168.200.9.. Plugged it into my igb4 interface that has 192.168.200.1/24

          Setup a vlan with 172.16.10.253/24 enabled dhcp..

          settingss.jpg

          switchf65809#term datadump                            
          switchf65809#sho run
          config-file-header
          switchf65809
          v2.5.8.15 / RCBS3.1_930_871_084
          CLI v1.0
          file SSD indicator encrypted
          @
          ssd-control-start
          ssd config
          ssd file passphrase control unrestricted
          no ssd file integrity control
          ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0
          !
          !
          unit-type-control-start
          unit-type unit 1 network gi uplink none
          unit-type-control-end
          !
          vlan database
          vlan 10
          exit
          voice vlan state auto-triggered
          voice vlan oui-table add 0001e3 Siemens_AG_phone
          voice vlan oui-table add 00036b Cisco_phone
          voice vlan oui-table add 00096e Avaya
          voice vlan oui-table add 000fe2 H3C_Aolynk
          voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
          voice vlan oui-table add 00d01e Pingtel_phone
          voice vlan oui-table add 00e075 Polycom/Veritel_phone
          voice vlan oui-table add 00e0bb 3Com_phone
          hostname switchf65809
          username user password encrypted $15$RNkCnVXJLcID4IKT$EDhJvPxPXJSsrsKvB8y0SMuwEaQn2SVckrVGzq6WfpOactj45CrUSHkc7nLpQAuAkdP72MS+2pTULQy7rIavcg== privilege 15
          ip ssh server
          sntp server 192.168.3.32 poll
          ip name-server  192.168.200.1
          !
          interface vlan 1
           ip address 192.168.200.9 255.255.255.0
           no ip address dhcp
          !
          interface GigabitEthernet1
           switchport mode trunk
           switchport trunk allowed vlan 1,10
          !
          interface GigabitEthernet8
           switchport access vlan 10
          !
          exit
          macro auto controlled
          ip default-gateway 192.168.200.1
          switchf65809#
          

          Now its currently running 2.5.8.15, plug into port 8 get an IP on the 172.16.10 network, plug into port 7 get an IP of vlan 1, 192.168.200..

          Going to update it to latest version - brb

          edit: ok back on 2.5.9.16, all working just fine..

          edit2: here is the dhcp from client I plugged into port 8 on the sg250, you can see it got an IP from my vlan 10 I setup on pfsense

          May 27 17:09:49 	dhcpd 	98873 	DHCPACK on 172.16.10.11 to d0:37:45:0e:8c:be via igb4.10
          May 27 17:09:49 	dhcpd 	98873 	DHCPREQUEST for 172.16.10.11 (172.16.10.253) from d0:37:45:0e:8c:be via igb4.10
          May 27 17:09:49 	dhcpd 	98873 	DHCPOFFER on 172.16.10.11 to d0:37:45:0e:8c:be via igb4.10
          May 27 17:09:48 	dhcpd 	98873 	DHCPDISCOVER from d0:37:45:0e:8c:be via igb4.10 
          

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          C 1 Reply Last reply Reply Quote 0
          • C
            Cannondale @johnpoz
            last edited by

            @johnpoz

            Sorry for the delay in responding. Just got back into town after traveling. Thanks for the additional information. Very helpful!
            I have an SG300 that arrived yesterday and still in a box. Will spark it up today to see what I find and report back.

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @Cannondale
              last edited by johnpoz

              @Cannondale one thing nice about the sg300 is shows pvid info ;)

              Both in the gui, and from cli

              That the gui lists P in the legend, but then doesn't show it, and the cli showing this confusing as hell

              Port : gi8
              Port Mode: 
              Gvrp Status: disabled
              Ingress Filtering: true
              Acceptable Frame Type: admitAll
              Ingress UnTagged VLAN ( NATIVE ): 1
               
              Port is member in: 
               
              Vlan               Name               Egress rule     Added by     
              ---- -------------------------------- ----------- ---------------- 
               10                 10                 Untagged          S         
              

              When I look at a interface with vlan on my sg300

              Port : gi1
              Port Mode: Access 
              Gvrp Status: disabled
              Ingress Filtering: true
              Acceptable Frame Type: admitAll
              Ingress UnTagged VLAN ( NATIVE ): 99
               
              Port is member in: 
               
              Vlan               Name               Egress rule     Added by     
              ---- -------------------------------- ----------- ---------------- 
               99                wan                 Untagged          S         
              
               
              Forbidden VLANS: 
              Vlan               Name               
              ---- -------------------------------- 
              
              

              That being said - I had no issues setting a interface to access in a vlan on the sg250, and it working as it should with the vlan tagged to pfsense via "trunk" port.. Even though the cli output is bonkers ;)

              There is clearly room for improvement in the info they show in the gui and the cli on the 250.. Why is showing the ingress untagged vlan as 1, when clearly that could not be the case if the interface is access in vlan 10..

              Notice on the 300, it shows the native same as the vlan used for egress as untagged.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              C M 2 Replies Last reply Reply Quote 0
              • C
                Cannondale @johnpoz
                last edited by

                @johnpoz Got the SG300 up and running. Firmware and boot code were quite old (fw 1.2.9.44 and bc 1.1.0.6).
                Upgraded both to the latest releases (fw 1.4.11.5 and bc 1.3.5.06), which was a feat in it self! Too bad Cisco hasn’t upgraded the firmware in the last three years!

                P in the legend, but then doesn't show it, and the cli showing this confusing as hell

                I definitely see what you mean!

                Created the following test vlans on the switch:
                Note: igb1 is the Main Lan in pfSense

                VLAN10 (Test1)
                Switch port 23, Trunk mode, Tagged, connected to pfSense VLAN10 (igb2)
                Switch port 24, Access mode, Untagged, connected to Linux workstation
                Wide open firewall rule for VLAN10

                Test results: DHCP works as expected and provides Linux workstation IP

                VLAN20 (Test2)
                Switch port 51, Trunk mode, Tagged, connected to pfSense igb1 (Main Lan)
                Switch port 46, Access mode, Untagged, connected to Linux workstation
                Wide open firewall rule for VLAN20

                Test results: No DHCPREQUEST in pfSense DHCP log, no IP provided to Linux workstation

                I must be missing something stupid simple?

                sw pvm vl20.png

                pfs int ass.png

                pfs int vl20.png

                pfs dhcp vl20.png

                pfs fw vl20.png

                M 1 Reply Last reply Reply Quote 0
                • M
                  mvikman @Cannondale
                  last edited by

                  @Cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                  Upgraded both to the latest releases (fw 1.4.11.5 and bc 1.3.5.06), which was a feat in it self! Too bad Cisco hasn’t upgraded the firmware in the last three years!

                  Well, It has been in End-of-Sale since October 2018, End of Software Maintenance was October 2019 and End of Support is October 2023.
                  https://www.cisco.com/c/en/us/products/collateral/switches/small-business-300-series-managed-switches/eos-eol-notice-c51-740542.html


                  So the Main LAN still works from the igb1, but just not the VLAN using that same igb1?

                  pfSense Plus 24.11-RELEASE (amd64)
                  Dell Optiplex 7040 SFF
                  Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                  HPE 561T (X540-AT2), 2-port 10Gb RJ45
                  HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                  C 1 Reply Last reply Reply Quote 0
                  • C
                    Cannondale @mvikman
                    last edited by

                    @mvikman

                    Well, It has been in End-of-Sale since October 2018, End of Software Maintenance was October 2019 and End of Support is October 2023.

                    Interestingly, the SG250 has roughly the same End Dates and had a firmware date of 4/2023.

                    So the Main LAN still works from the igb1, but just not the VLAN using that same igb1?

                    Yes that is correct.

                    M 2 Replies Last reply Reply Quote 0
                    • M
                      mvikman @Cannondale
                      last edited by

                      @Cannondale Hmm... Compared to mine, the pfSense config looks to be ok to me.

                      pfSense Plus 24.11-RELEASE (amd64)
                      Dell Optiplex 7040 SFF
                      Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                      HPE 561T (X540-AT2), 2-port 10Gb RJ45
                      HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                      1 Reply Last reply Reply Quote 0
                      • M
                        mvikman @johnpoz
                        last edited by mvikman

                        @johnpoz Looks like that the CBS-series (and probably also the SG250) only uses/shows the pvid when the port is set to General Mode...
                        I set GE5 into General Mode and it now shows 1P
                        b2690716-561f-4dd3-b503-df38c458e004-image.png

                        pfSense Plus 24.11-RELEASE (amd64)
                        Dell Optiplex 7040 SFF
                        Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                        HPE 561T (X540-AT2), 2-port 10Gb RJ45
                        HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                        C 1 Reply Last reply Reply Quote 0
                        • C
                          Cannondale @mvikman
                          last edited by

                          @mvikman

                          Looks like that the CBS-series (and probably also the SG250) only uses/shows the pvid when the port is set to General Mode...
                          I set GE5 into General Mode and it now shows 1P

                          I saw the same thing with theSG250.

                          1 Reply Last reply Reply Quote 0
                          • M
                            mvikman @Cannondale
                            last edited by mvikman

                            @Cannondale

                            If you put both VLAN10 and VLAN20 on the igb2, can you get both to work through the switches untagged ports?

                            pfSense Plus 24.11-RELEASE (amd64)
                            Dell Optiplex 7040 SFF
                            Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                            HPE 561T (X540-AT2), 2-port 10Gb RJ45
                            HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                            C 1 Reply Last reply Reply Quote 0
                            • C
                              Cannondale @mvikman
                              last edited by

                              @mvikman

                              If you put both VLAN10 and VLAN20 on the igb2, can you get both to work through the switches untagged ports?

                              Yes. This works as expected.

                              pfs int ass2.png

                              sw p23 24 46.png

                              1 Reply Last reply Reply Quote 0
                              • M
                                mvikman
                                last edited by

                                Ok, so something gets messed up when there is both tagged and untagged traffic to the port.

                                I have all my LAN networks in pfSense as VLANS, so everything is tagged. I believe this is also the recommended method.

                                pfSense Plus 24.11-RELEASE (amd64)
                                Dell Optiplex 7040 SFF
                                Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                                HPE 561T (X540-AT2), 2-port 10Gb RJ45
                                HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                                C 1 Reply Last reply Reply Quote 0
                                • C
                                  Cannondale @mvikman
                                  last edited by

                                  @mvikman Thanks for the additional information.

                                  I have all my LAN networks in pfSense as VLANS, so everything is tagged.

                                  To clarify, you have all of your vlans on switch port gi1, which is connected to your pfSense lan port?

                                  If yes, I should be able to disable my vlan10 (on igb2), which would leave only vlan20 on my igb1 (pfSense lan) and would match your config. Correct?
                                  Would be an easy test.

                                  M 1 Reply Last reply Reply Quote 0
                                  • M
                                    mvikman @Cannondale
                                    last edited by

                                    @Cannondale Yes GE1 port is a trunk to pfSense

                                    My pfSense interfaces
                                    b45d9b5e-9b96-49c6-8a55-77c012c46fec-image.png

                                    pfSense Plus 24.11-RELEASE (amd64)
                                    Dell Optiplex 7040 SFF
                                    Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                                    HPE 561T (X540-AT2), 2-port 10Gb RJ45
                                    HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                                    C 1 Reply Last reply Reply Quote 0
                                    • C
                                      Cannondale @mvikman
                                      last edited by

                                      @mvikman Thanks for the confirmation.
                                      As a test, I disabled the pfSense VLAN10 interface on igb2.
                                      I also removed VLAN10 from port 23 on the switch.
                                      This left only VLAN20 on my igb1 (pfSense lan) interface.
                                      Unfortunately, the test failed. It didn't make a difference in getting an IP on VLAN20 from DHCP.

                                      P 1 Reply Last reply Reply Quote 0
                                      • P
                                        pete35 @Cannondale
                                        last edited by pete35

                                        @Cannondale
                                        Somehow your switch configs are a miracle. Can you post your the routing table / standard gateway of that switch? Is routing disabled/enabled?

                                        Pls show all the firewall rules, not in edit mode.... also the floating rules just to see how the rules are in the rows.

                                        <a href="https://carsonlam.ca">bintang88</a>
                                        <a href="https://carsonlam.ca">slot88</a>

                                        C 1 Reply Last reply Reply Quote 0
                                        • C
                                          Cannondale @pete35
                                          last edited by

                                          @pete35

                                          Can you post your the routing table

                                          #show ip route
                                          Maximum Parallel Paths: 1 (1 after reset)
                                          IP Forwarding: disabled
                                          Codes: > - best, C - connected, S - static
                                          
                                          D   0.0.0.0/0 [1/2] via 192.168.0.201, 47:42:32, vlan 1                    
                                          C   192.168.0.0/24 is directly connected, vlan 1
                                          

                                          Is routing disabled/enabled?
                                          What is the cli command to confirm?

                                          Pls show all the firewall rules, not in edit mode.... also the floating rules just to see how the rules are in the rows.

                                          vl20 rules.png

                                          floating rules.png

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @Cannondale
                                            last edited by johnpoz

                                            @Cannondale the rules have zero to do with dhcp.. Once you enable dhcp the hidden rules would allow it..

                                            So your saying is when you have tagged 10 and 20 on igb2 with no native untagged nework on this interface both 10 and 20 work.

                                            But if you put 10 and 20 tagged on igb1 that has a native network on it - the tagged vlans don't work?

                                            Post the output of your ifconfig on pfsense..

                                            example here is mine..

                                            igb2: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                                                    description: WLAN
                                                    options=4e120bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_MAGIC,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6,NOMAP>
                                                    ether 00:08:a2:0c:e6:20
                                                    inet6 fe80::208:a2ff:fe0c:e620%igb2 prefixlen 64 scopeid 0x3
                                                    inet 192.168.2.253 netmask 0xffffff00 broadcast 192.168.2.255
                                                    media: Ethernet autoselect (1000baseT <full-duplex>)
                                                    status: active
                                                    nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                            
                                            igb2.4: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                                                    description: W_PSK
                                                    options=4600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6,NOMAP>
                                                    ether 00:08:a2:0c:e6:20
                                                    inet6 fe80::208:a2ff:fe0c:e620%igb2.4 prefixlen 64 scopeid 0xb
                                                    inet 192.168.4.253 netmask 0xffffff00 broadcast 192.168.4.255
                                                    groups: vlan
                                                    vlan: 4 vlanproto: 802.1q vlanpcp: 0 parent interface: igb2
                                                    media: Ethernet autoselect (1000baseT <full-duplex>)
                                                    status: active
                                                    nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                            igb2.6: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                                                    description: W_Guest
                                                    options=4600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6,NOMAP>
                                                    ether 00:08:a2:0c:e6:20
                                                    inet6 fe80::208:a2ff:fe0c:e620%igb2.6 prefixlen 64 scopeid 0xc
                                                    inet 192.168.6.253 netmask 0xffffff00 broadcast 192.168.6.255
                                                    groups: vlan
                                                    vlan: 6 vlanproto: 802.1q vlanpcp: 0 parent interface: igb2
                                                    media: Ethernet autoselect (1000baseT <full-duplex>)
                                                    status: active
                                                    nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                            

                                            I am curious to the options you have set on the parent interface mostly.

                                            if you do a pcap with tcpdump on ig2 do you see the tags with the -e flag, but when you do that on igb1 you dont?

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            C 2 Replies Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.