XG-7100 & Unify console troubles: ix0, ix1, dhcp-kea & now sore head

pfS_noob_cust

in. addition, here are the interface vlan & assignments pages...
interface.vlans.jpg interface.assignments.jpg

now, nothing plugged into the 7100 switch works.
I did a reboot just I sent this, but after I "repaired" the Switch VLANs.

I'll now do a full power off & restart to ascertain the results.

patient0

@pfS_noob_cust said in XG-7100 & Unify console troubles: ix0, ix1, dhcp-kea & now sore head:

Here's the latter...

You can format that kind of output with by adding a line before and after that contains only three "`" (Markdown syntax)

etherswitchcfg
etherswitch0: VLAN mode: DOT1Q
port1:
pvid: 4090
state=8<FORWARDING>
flags=0<>
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
...

As for the VLANs, now they are numbered different, are you trying to confuse me ;)

In "Interfaces / Switch / VLANs", all the VLANs you define on "Interfaces / VLANs" do have to exist too.

For example, the VLAN 622/ngp4_storage is now VLAN 60 on the Switch / VLAN page but still VLAN 622 on the Interfaces / VLAN page.

Do you mind me asking, how well do you understand VLANs, tagged and untagged, access ports?

stephenw10

Yeah you haven't set the PVID on the switch. All the ports are still set to 4091 so no inbound untagged traffic will work. Except on LAN where it's still using 4091.

You need to go to Interfaces > Switch > Ports and set the correct PVID for each port.

https://docs.netgate.com/pfsense/en/latest/solutions/xg-7100-1u/configuring-the-switch-ports.html#ports

stephenw10

Ah also the VLAN tags on the switch no longer match the VLANs you have added on lagg0. Previously they did. You'll need to set those back to match.

pfS_noob_cust

@patient0 sorry for being so confusing - not intentional.
Stephenw10 pointed out that I my Switch VLANS and Assignment VLANS were out of sync. So "I repaired" that. I believe there remains some mismatches in this area.

To answer your last question on "my understanding" - pitiful little, apparently.

What I THINK (hoping?) I know is:
port 4 (allow all) devices should get 172.16.22.0/24
port 5 (allow known) devices should get 172.16.32.0/24
port 6 (allow all) devices should get 172.16.62.0/24

static mapped "annabelle" as 172.16.62.5 via the port6 dhcp server page.

when the 7100 LAN (port 2) has its members identified as:

2,9t,10t : dhcp leases reports statically mapped annabelle is up on both the LAN & port 6. But annabelle reports a self assigned IP address. The port 4 device reports not being not connected.
2,3t,4t,5t,6t,7t,8t,9t,10t :
dhcp leases reports statically mapped annabelle is up on both the LAN & port 6. But annabelle reports a self assigned IP address.
The device on port 4 reports a port 5 address, and not one in the pool.

Sure seems like the VLANid assignments did not get re-implemented without leaving some conflicting garbage.

patient0

@pfS_noob_cust I'm sorry but I don't know what to do with these information.

I don't think taking about DHCP is necessary right now, first we have to establish if the VLANs are setup correctly.

Screenshots of "Interfaces / VLANs", "Interfaces / Switch / VLANs" and "Interfaces / Switch / Ports" please.

And then pick one LAN or VLAN to look at. Don't change any VLANs after you posted the screenshots.

pfS_noob_cust

@stephenw10 thanks!
I failed there too! Didn't understand the switch ports page. fixed that so they match now.
switch.vlans.jpg switch.ports.jpg

pfS_noob_cust

@patient0 I think it's fixed now.

stephenw10

Yup looks good.

Just for reference the PVID on port 7 doesn't matter because the VLAN there is passed tagged. It usually doesn't hurt to set it there though.

pfS_noob_cust

@stephenw10 thank you.
Your statement is based on the fact that ~~port 7 is assigned with that VLANid on interface ix0, right? OOPS, Not true.~~
Switch VLANs Group 7 members are are all tagged (7t,9t,10t), right?

stephenw10

Yes exactly. Since all members of that VLAN are tagged it should never see untagged traffic so the PVID isn't used.

However worth baring in mind is that if the downstream device (a switch I assume) incorrectly sends untagged traffic to port 7 it will be tagged onto VLAN 1221. Now normally that's not a problem since the traffic could only ever be one way. Nothing on VLAN 1221 could ever respond. But if such rogue traffic turned out to be a broadcast flood for example that might start to affect something.

pfS_noob_cust

@stephenw10

Thank you. I'll try to absorb what you just said.

@patient0,stephenw10,

I do want to express my gratidude for kindly pointing out my failures of execution in utilizing the GUI properly. I fully appreciate the difficulties of writing words that describe the intent of a GUI.
Again, Thanks.