No DHCP on pfSense VLAN with Cisco Smart Switch
-
If you put both VLAN10 and VLAN20 on the igb2, can you get both to work through the switches untagged ports?
-
If you put both VLAN10 and VLAN20 on the igb2, can you get both to work through the switches untagged ports?
Yes. This works as expected.
-
Ok, so something gets messed up when there is both tagged and untagged traffic to the port.
I have all my LAN networks in pfSense as VLANS, so everything is tagged. I believe this is also the recommended method.
-
@mvikman Thanks for the additional information.
I have all my LAN networks in pfSense as VLANS, so everything is tagged.
To clarify, you have all of your vlans on switch port gi1, which is connected to your pfSense lan port?
If yes, I should be able to disable my vlan10 (on igb2), which would leave only vlan20 on my igb1 (pfSense lan) and would match your config. Correct?
Would be an easy test. -
@Cannondale Yes GE1 port is a trunk to pfSense
My pfSense interfaces
-
@mvikman Thanks for the confirmation.
As a test, I disabled the pfSense VLAN10 interface on igb2.
I also removed VLAN10 from port 23 on the switch.
This left only VLAN20 on my igb1 (pfSense lan) interface.
Unfortunately, the test failed. It didn't make a difference in getting an IP on VLAN20 from DHCP. -
@Cannondale
Somehow your switch configs are a miracle. Can you post your the routing table / standard gateway of that switch? Is routing disabled/enabled?Pls show all the firewall rules, not in edit mode.... also the floating rules just to see how the rules are in the rows.
-
Can you post your the routing table
#show ip route Maximum Parallel Paths: 1 (1 after reset) IP Forwarding: disabled Codes: > - best, C - connected, S - static D 0.0.0.0/0 [1/2] via 192.168.0.201, 47:42:32, vlan 1 C 192.168.0.0/24 is directly connected, vlan 1Is routing disabled/enabled?
What is the cli command to confirm?Pls show all the firewall rules, not in edit mode.... also the floating rules just to see how the rules are in the rows.
-
@Cannondale the rules have zero to do with dhcp.. Once you enable dhcp the hidden rules would allow it..
So your saying is when you have tagged 10 and 20 on igb2 with no native untagged nework on this interface both 10 and 20 work.
But if you put 10 and 20 tagged on igb1 that has a native network on it - the tagged vlans don't work?
Post the output of your ifconfig on pfsense..
example here is mine..
igb2: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: WLAN options=4e120bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_MAGIC,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6,NOMAP> ether 00:08:a2:0c:e6:20 inet6 fe80::208:a2ff:fe0c:e620%igb2 prefixlen 64 scopeid 0x3 inet 192.168.2.253 netmask 0xffffff00 broadcast 192.168.2.255 media: Ethernet autoselect (1000baseT <full-duplex>) status: active nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> igb2.4: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: W_PSK options=4600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6,NOMAP> ether 00:08:a2:0c:e6:20 inet6 fe80::208:a2ff:fe0c:e620%igb2.4 prefixlen 64 scopeid 0xb inet 192.168.4.253 netmask 0xffffff00 broadcast 192.168.4.255 groups: vlan vlan: 4 vlanproto: 802.1q vlanpcp: 0 parent interface: igb2 media: Ethernet autoselect (1000baseT <full-duplex>) status: active nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> igb2.6: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: W_Guest options=4600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6,NOMAP> ether 00:08:a2:0c:e6:20 inet6 fe80::208:a2ff:fe0c:e620%igb2.6 prefixlen 64 scopeid 0xc inet 192.168.6.253 netmask 0xffffff00 broadcast 192.168.6.255 groups: vlan vlan: 6 vlanproto: 802.1q vlanpcp: 0 parent interface: igb2 media: Ethernet autoselect (1000baseT <full-duplex>) status: active nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>I am curious to the options you have set on the parent interface mostly.
if you do a pcap with tcpdump on ig2 do you see the tags with the -e flag, but when you do that on igb1 you dont?
-
So your saying is when you have tagged 10 and 20 on igb2 with no native untagged nework on this interface both 10 and 20 work.
Correct
But if you put 10 and 20 tagged on igb1 that has a native network on it - the tagged vlans don't work?
Actually, what I tried first was vlan10 on igb2 and vlan20 on ibg1, In this config, only vlan10 works.
Second test was vlan10 and vlan20 on igb2. Both work.
Third test was disable vlan10 and put vlan20 on igb1. This does not work. Similar to first test.
How do I display the pfSense ifconfig? Don't see it in the menu.
-
Post the output of your ifconfig on pfsense
Found it.
igb0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: WAN options=e100bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6> ether 00:1b:21:b7:50:30 inet6 fe80::21b:21ff:feb7:5030%igb0 prefixlen 64 scopeid 0x1 inet 71.46.127.170 netmask 0xfffff000 broadcast 255.255.255.255 media: Ethernet autoselect (1000baseT <full-duplex>) status: active nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> igb1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: Lan1 options=e100bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6> ether 00:1b:21:b7:50:31 inet6 fe80::21b:21ff:feb7:5031%igb1 prefixlen 64 scopeid 0x2 inet 192.168.0.201 netmask 0xffffff00 broadcast 192.168.0.255 media: Ethernet autoselect (1000baseT <full-duplex>) status: active nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> igb2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: WiFiUAP options=e100bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6> ether 00:1b:21:b7:50:34 inet6 fe80::21b:21ff:feb7:5034%igb2 prefixlen 64 scopeid 0x3 media: Ethernet autoselect (1000baseT <full-duplex>) status: active nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>igb2.10: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: VLAN10 options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6> ether 00:1b:21:b7:50:34 inet6 fe80::21b:21ff:feb7:5034%igb2.10 prefixlen 64 scopeid 0xf inet 192.168.10.1 netmask 0xffffff00 broadcast 192.168.10.255 groups: vlan vlan: 10 vlanpcp: 0 parent interface: igb2 media: Ethernet autoselect (1000baseT <full-duplex>) status: active nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> igb1.20: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: VLAN20 options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6> ether 00:1b:21:b7:50:31 inet6 fe80::21b:21ff:feb7:5031%igb1.20 prefixlen 64 scopeid 0x10 inet 192.168.20.1 netmask 0xffffff00 broadcast 192.168.20.255 groups: vlan vlan: 20 vlanpcp: 0 parent interface: igb1 media: Ethernet autoselect (1000baseT <full-duplex>) status: active nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> -
@Cannondale your not testing this with AP are you.. Your putting actual devices on the ports that are in access mode.. I see a description of wifiUAP..
-
-
@Cannondale so this lan1, you don't have it in a bridge or something do you?
This makes zero sense really.. There should be nothing in the switch that should care if there a native untagged network on the port..
the only thing that jumps out at me as different from your options is mine has NOMAP - but not exactly sure what that option is, can not seem to find any info on it in quick google.
edit:
Why do you not have?vlan: 6 vlanproto: 802.1q vlanpcp: 0 parent interface: igb2
See where mine shows 802.1q??
-
so this lan1, you don't have it in a bridge or something do you?
No bridge unless it is a factory default. I reset the switch before configuring anything.
I did notice differences in the following ifconfig output lines:
vlan: 20 vlanpcp: 0 parent interface: igb1 vlan: 4 vlanproto: 802.1q vlanpcp: 0 parent interface: igb2 -
@Cannondale I just sent a message to Steve.. @stephenw10 maybe he can see something I am missing..
But it sure shouldn't matter if pfsense is using a native untagged on the interface along with tags..
What version of pfsense are you running - what nic specific do you have? I mean its igb should be the same..
I have been running vlans on pfsense since really pfsense came out, have never seen a issue with them on any hardware or any switches..
-
@johnpoz
"vlan: 20 vlanproto: 802.1q vlanpcp: 0 parent interface: ixl0"
I also have that vlanproto in ifconfig output, so I'd say that there has to be something we are missing in Cannondale's pfSense config. -
@mvikman but what? And that would matter if there was a native vlan or not.. The native is what wouldn't use any tagging..
@stephenw10 answered me back - so hoping he is reading over this long thread now and will chime in and make us all feel stupid ;)
-
I just sent a message to Steve.. @stephenw10 maybe he can see something I am missing
Great!
What version of pfsense are you running
v2.6
@johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:
what nic specific do you have
Currently, the NIC in the pfSense box is a Dell / Intel HM9JY.
I have also tested with NIC Dell / Intel YT674.
The server board is a Supermicro X10SLH-F, which also has two Intel NICs.
I have tested with the second onboad NIC with the same results on the SG250. -
Looks like both HM9JY and YT674 are Intel Pro 1000VT Quad Port Nics that use Intel 82575GB chip.
Supermicro board has Intel I210-AT chip.
