• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

No DHCP on pfSense VLAN with Cisco Smart Switch

Scheduled Pinned Locked Moved L2/Switching/VLANs
147 Posts 7 Posters 92.5k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    mvikman @Cannondale
    last edited by May 31, 2023, 4:05 PM

    @Cannondale Hmm... Compared to mine, the pfSense config looks to be ok to me.

    pfSense Plus 24.11-RELEASE (amd64)
    Dell Optiplex 7040 SFF
    Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
    HPE 561T (X540-AT2), 2-port 10Gb RJ45
    HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

    1 Reply Last reply Reply Quote 0
    • M
      mvikman @johnpoz
      last edited by mvikman May 31, 2023, 4:15 PM May 31, 2023, 4:13 PM

      @johnpoz Looks like that the CBS-series (and probably also the SG250) only uses/shows the pvid when the port is set to General Mode...
      I set GE5 into General Mode and it now shows 1P
      b2690716-561f-4dd3-b503-df38c458e004-image.png

      pfSense Plus 24.11-RELEASE (amd64)
      Dell Optiplex 7040 SFF
      Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
      HPE 561T (X540-AT2), 2-port 10Gb RJ45
      HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

      C 1 Reply Last reply May 31, 2023, 4:21 PM Reply Quote 0
      • C
        Cannondale @mvikman
        last edited by May 31, 2023, 4:21 PM

        @mvikman

        Looks like that the CBS-series (and probably also the SG250) only uses/shows the pvid when the port is set to General Mode...
        I set GE5 into General Mode and it now shows 1P

        I saw the same thing with theSG250.

        1 Reply Last reply Reply Quote 0
        • M
          mvikman @Cannondale
          last edited by mvikman May 31, 2023, 4:23 PM May 31, 2023, 4:22 PM

          @Cannondale

          If you put both VLAN10 and VLAN20 on the igb2, can you get both to work through the switches untagged ports?

          pfSense Plus 24.11-RELEASE (amd64)
          Dell Optiplex 7040 SFF
          Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
          HPE 561T (X540-AT2), 2-port 10Gb RJ45
          HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

          C 1 Reply Last reply May 31, 2023, 4:43 PM Reply Quote 0
          • C
            Cannondale @mvikman
            last edited by May 31, 2023, 4:43 PM

            @mvikman

            If you put both VLAN10 and VLAN20 on the igb2, can you get both to work through the switches untagged ports?

            Yes. This works as expected.

            pfs int ass2.png

            sw p23 24 46.png

            1 Reply Last reply Reply Quote 0
            • M
              mvikman
              last edited by May 31, 2023, 5:18 PM

              Ok, so something gets messed up when there is both tagged and untagged traffic to the port.

              I have all my LAN networks in pfSense as VLANS, so everything is tagged. I believe this is also the recommended method.

              pfSense Plus 24.11-RELEASE (amd64)
              Dell Optiplex 7040 SFF
              Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
              HPE 561T (X540-AT2), 2-port 10Gb RJ45
              HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

              C 1 Reply Last reply May 31, 2023, 5:49 PM Reply Quote 0
              • C
                Cannondale @mvikman
                last edited by May 31, 2023, 5:49 PM

                @mvikman Thanks for the additional information.

                I have all my LAN networks in pfSense as VLANS, so everything is tagged.

                To clarify, you have all of your vlans on switch port gi1, which is connected to your pfSense lan port?

                If yes, I should be able to disable my vlan10 (on igb2), which would leave only vlan20 on my igb1 (pfSense lan) and would match your config. Correct?
                Would be an easy test.

                M 1 Reply Last reply May 31, 2023, 7:00 PM Reply Quote 0
                • M
                  mvikman @Cannondale
                  last edited by May 31, 2023, 7:00 PM

                  @Cannondale Yes GE1 port is a trunk to pfSense

                  My pfSense interfaces
                  b45d9b5e-9b96-49c6-8a55-77c012c46fec-image.png

                  pfSense Plus 24.11-RELEASE (amd64)
                  Dell Optiplex 7040 SFF
                  Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                  HPE 561T (X540-AT2), 2-port 10Gb RJ45
                  HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                  C 1 Reply Last reply May 31, 2023, 7:25 PM Reply Quote 0
                  • C
                    Cannondale @mvikman
                    last edited by May 31, 2023, 7:25 PM

                    @mvikman Thanks for the confirmation.
                    As a test, I disabled the pfSense VLAN10 interface on igb2.
                    I also removed VLAN10 from port 23 on the switch.
                    This left only VLAN20 on my igb1 (pfSense lan) interface.
                    Unfortunately, the test failed. It didn't make a difference in getting an IP on VLAN20 from DHCP.

                    P 1 Reply Last reply May 31, 2023, 7:39 PM Reply Quote 0
                    • P
                      pete35 @Cannondale
                      last edited by pete35 May 31, 2023, 7:45 PM May 31, 2023, 7:39 PM

                      @Cannondale
                      Somehow your switch configs are a miracle. Can you post your the routing table / standard gateway of that switch? Is routing disabled/enabled?

                      Pls show all the firewall rules, not in edit mode.... also the floating rules just to see how the rules are in the rows.

                      <a href="https://carsonlam.ca">bintang88</a>
                      <a href="https://carsonlam.ca">slot88</a>

                      C 1 Reply Last reply May 31, 2023, 8:07 PM Reply Quote 0
                      • C
                        Cannondale @pete35
                        last edited by May 31, 2023, 8:07 PM

                        @pete35

                        Can you post your the routing table

                        #show ip route
                        Maximum Parallel Paths: 1 (1 after reset)
                        IP Forwarding: disabled
                        Codes: > - best, C - connected, S - static
                        
                        D   0.0.0.0/0 [1/2] via 192.168.0.201, 47:42:32, vlan 1                    
                        C   192.168.0.0/24 is directly connected, vlan 1
                        

                        Is routing disabled/enabled?
                        What is the cli command to confirm?

                        Pls show all the firewall rules, not in edit mode.... also the floating rules just to see how the rules are in the rows.

                        vl20 rules.png

                        floating rules.png

                        J 1 Reply Last reply May 31, 2023, 8:51 PM Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator @Cannondale
                          last edited by johnpoz May 31, 2023, 8:53 PM May 31, 2023, 8:51 PM

                          @Cannondale the rules have zero to do with dhcp.. Once you enable dhcp the hidden rules would allow it..

                          So your saying is when you have tagged 10 and 20 on igb2 with no native untagged nework on this interface both 10 and 20 work.

                          But if you put 10 and 20 tagged on igb1 that has a native network on it - the tagged vlans don't work?

                          Post the output of your ifconfig on pfsense..

                          example here is mine..

                          igb2: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                                  description: WLAN
                                  options=4e120bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_MAGIC,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6,NOMAP>
                                  ether 00:08:a2:0c:e6:20
                                  inet6 fe80::208:a2ff:fe0c:e620%igb2 prefixlen 64 scopeid 0x3
                                  inet 192.168.2.253 netmask 0xffffff00 broadcast 192.168.2.255
                                  media: Ethernet autoselect (1000baseT <full-duplex>)
                                  status: active
                                  nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                          
                          igb2.4: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                                  description: W_PSK
                                  options=4600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6,NOMAP>
                                  ether 00:08:a2:0c:e6:20
                                  inet6 fe80::208:a2ff:fe0c:e620%igb2.4 prefixlen 64 scopeid 0xb
                                  inet 192.168.4.253 netmask 0xffffff00 broadcast 192.168.4.255
                                  groups: vlan
                                  vlan: 4 vlanproto: 802.1q vlanpcp: 0 parent interface: igb2
                                  media: Ethernet autoselect (1000baseT <full-duplex>)
                                  status: active
                                  nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                          igb2.6: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                                  description: W_Guest
                                  options=4600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6,NOMAP>
                                  ether 00:08:a2:0c:e6:20
                                  inet6 fe80::208:a2ff:fe0c:e620%igb2.6 prefixlen 64 scopeid 0xc
                                  inet 192.168.6.253 netmask 0xffffff00 broadcast 192.168.6.255
                                  groups: vlan
                                  vlan: 6 vlanproto: 802.1q vlanpcp: 0 parent interface: igb2
                                  media: Ethernet autoselect (1000baseT <full-duplex>)
                                  status: active
                                  nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                          

                          I am curious to the options you have set on the parent interface mostly.

                          if you do a pcap with tcpdump on ig2 do you see the tags with the -e flag, but when you do that on igb1 you dont?

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          C 2 Replies Last reply May 31, 2023, 9:04 PM Reply Quote 0
                          • C
                            Cannondale @johnpoz
                            last edited by May 31, 2023, 9:04 PM

                            @johnpoz

                            So your saying is when you have tagged 10 and 20 on igb2 with no native untagged nework on this interface both 10 and 20 work.

                            Correct

                            But if you put 10 and 20 tagged on igb1 that has a native network on it - the tagged vlans don't work?

                            Actually, what I tried first was vlan10 on igb2 and vlan20 on ibg1, In this config, only vlan10 works.

                            Second test was vlan10 and vlan20 on igb2. Both work.

                            Third test was disable vlan10 and put vlan20 on igb1. This does not work. Similar to first test.

                            How do I display the pfSense ifconfig? Don't see it in the menu.

                            1 Reply Last reply Reply Quote 0
                            • C
                              Cannondale @johnpoz
                              last edited by Cannondale May 31, 2023, 9:15 PM May 31, 2023, 9:14 PM

                              @johnpoz

                              Post the output of your ifconfig on pfsense

                              Found it.

                              igb0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
                              	description: WAN
                              	options=e100bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6>
                              	ether 00:1b:21:b7:50:30
                              	inet6 fe80::21b:21ff:feb7:5030%igb0 prefixlen 64 scopeid 0x1
                              	inet 71.46.127.170 netmask 0xfffff000 broadcast 255.255.255.255
                              	media: Ethernet autoselect (1000baseT <full-duplex>)
                              	status: active
                              	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                              igb1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
                              	description: Lan1
                              	options=e100bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6>
                              	ether 00:1b:21:b7:50:31
                              	inet6 fe80::21b:21ff:feb7:5031%igb1 prefixlen 64 scopeid 0x2
                              	inet 192.168.0.201 netmask 0xffffff00 broadcast 192.168.0.255
                              	media: Ethernet autoselect (1000baseT <full-duplex>)
                              	status: active
                              	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                              igb2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
                              	description: WiFiUAP
                              	options=e100bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6>
                              	ether 00:1b:21:b7:50:34
                              	inet6 fe80::21b:21ff:feb7:5034%igb2 prefixlen 64 scopeid 0x3
                              	media: Ethernet autoselect (1000baseT <full-duplex>)
                              	status: active
                              	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                              
                              igb2.10: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
                              	description: VLAN10
                              	options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
                              	ether 00:1b:21:b7:50:34
                              	inet6 fe80::21b:21ff:feb7:5034%igb2.10 prefixlen 64 scopeid 0xf
                              	inet 192.168.10.1 netmask 0xffffff00 broadcast 192.168.10.255
                              	groups: vlan
                              	vlan: 10 vlanpcp: 0 parent interface: igb2
                              	media: Ethernet autoselect (1000baseT <full-duplex>)
                              	status: active
                              	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                              igb1.20: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                              	description: VLAN20
                              	options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
                              	ether 00:1b:21:b7:50:31
                              	inet6 fe80::21b:21ff:feb7:5031%igb1.20 prefixlen 64 scopeid 0x10
                              	inet 192.168.20.1 netmask 0xffffff00 broadcast 192.168.20.255
                              	groups: vlan
                              	vlan: 20 vlanpcp: 0 parent interface: igb1
                              	media: Ethernet autoselect (1000baseT <full-duplex>)
                              	status: active
                              	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                              
                              
                              J 1 Reply Last reply May 31, 2023, 9:18 PM Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator @Cannondale
                                last edited by May 31, 2023, 9:18 PM

                                @Cannondale your not testing this with AP are you.. Your putting actual devices on the ports that are in access mode.. I see a description of wifiUAP..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                C 1 Reply Last reply May 31, 2023, 9:21 PM Reply Quote 0
                                • C
                                  Cannondale @johnpoz
                                  last edited by May 31, 2023, 9:21 PM

                                  @johnpoz

                                  your not testing this with AP are you.

                                  No. I'm plugging in a Linux workstation to vlan20.

                                  J 1 Reply Last reply May 31, 2023, 9:27 PM Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator @Cannondale
                                    last edited by johnpoz May 31, 2023, 9:31 PM May 31, 2023, 9:27 PM

                                    @Cannondale so this lan1, you don't have it in a bridge or something do you?

                                    This makes zero sense really.. There should be nothing in the switch that should care if there a native untagged network on the port..

                                    the only thing that jumps out at me as different from your options is mine has NOMAP - but not exactly sure what that option is, can not seem to find any info on it in quick google.

                                    edit:
                                    Why do you not have?

                                    vlan: 6 vlanproto: 802.1q vlanpcp: 0 parent interface: igb2

                                    See where mine shows 802.1q??

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    C 1 Reply Last reply May 31, 2023, 9:33 PM Reply Quote 0
                                    • C
                                      Cannondale @johnpoz
                                      last edited by May 31, 2023, 9:33 PM

                                      @johnpoz

                                      so this lan1, you don't have it in a bridge or something do you?

                                      No bridge unless it is a factory default. I reset the switch before configuring anything.

                                      I did notice differences in the following ifconfig output lines:

                                      vlan: 20 vlanpcp: 0 parent interface: igb1
                                      vlan: 4 vlanproto: 802.1q vlanpcp: 0 parent interface: igb2
                                      
                                      J 1 Reply Last reply May 31, 2023, 9:46 PM Reply Quote 0
                                      • J
                                        johnpoz LAYER 8 Global Moderator @Cannondale
                                        last edited by May 31, 2023, 9:46 PM

                                        @Cannondale I just sent a message to Steve.. @stephenw10 maybe he can see something I am missing..

                                        But it sure shouldn't matter if pfsense is using a native untagged on the interface along with tags..

                                        What version of pfsense are you running - what nic specific do you have? I mean its igb should be the same..

                                        I have been running vlans on pfsense since really pfsense came out, have never seen a issue with them on any hardware or any switches..

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        M C 2 Replies Last reply May 31, 2023, 9:55 PM Reply Quote 0
                                        • M
                                          mvikman @johnpoz
                                          last edited by May 31, 2023, 9:55 PM

                                          @johnpoz
                                          "vlan: 20 vlanproto: 802.1q vlanpcp: 0 parent interface: ixl0"
                                          I also have that vlanproto in ifconfig output, so I'd say that there has to be something we are missing in Cannondale's pfSense config.

                                          pfSense Plus 24.11-RELEASE (amd64)
                                          Dell Optiplex 7040 SFF
                                          Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                                          HPE 561T (X540-AT2), 2-port 10Gb RJ45
                                          HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                                          J 1 Reply Last reply May 31, 2023, 10:07 PM Reply Quote 0
                                          142 out of 147
                                          • First post
                                            142/147
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received