Single NIC…it works.
-
Here is a diagram of the phyical layout of my network, there are more then one computer per VLAN (just not in the diagram), with the exception of VLAN 1.
And here is how it's logically laid out.
-
Very nice diagram. Thanks. Okay, let me begin the stupid questions now:
1. This is port based vlans right?
2. Our there other switches hanging off the nortel or do you have lets say four ports in each vlan?
3. If there are no switches hanging off the nortel do the computers nics have to be vlan capable?
4. When you are routing out to the cable modem/dsl are you pointing the rules towards vlan 1?thanks,
Jim -
1. Yes, I have a 24 port switch, mine is setup like this.
Port 1 - trunk (VLAN 1, 2, 3, 4), connected to the pfsense
Port 2 - VLAN 1
Port 3-12 - VLAN 2
Port 13-18 - VLAN 3
Port 19-24 - VLAN 42. I only have one switch, but a few ports assigned per vlan as noted above.
3. The host NIC's don't need to be VLAN capable with the exception of the NIC in the pfSense box. Only the packets running out of port 1 on the switch are tagged with VLAN ID's, so pfSense can figure out which interface they're for.
4. I don't point rules toward "vlan 1". In pfSense each VLAN is assigned toward an interface, so VLAN one is actually the WAN interface. My rules are configured the same as if I had multiple NIC's.
-
Most helpful. Thank you very much. What kind of nic are you using in the pfsense box?
Jim
-
I forgot, one last question. Concerning port one on your switch you mention it is trunked. I understand trunking two switches together using two etc. ports. Can some switches trunk vlans together?
thanks,
Jim -
I'm using some plain desktop 3com 3c905 (xl0) adapter, I've also used a D-Link 530TX with no issues. Neither of which is a server quality NIC, but they're like $10 and get the job done.
What do you mean by trunking two switches together using two ports?
Pretty much any managed switch can handle VLAN's, you just configure the uplink between the switches with more then one 802.1q VLAN ID, or as a trunk, depending on the switch. If you set up more then one trunk between the same two switches, one of the trunks will be blocked by spanning tree (unless etherchannel is enabled, but I think that's a Cisco thing).
-
Let me explain myself better. The trunking I have done has been between two switches where I want more than one gig uplinks. I've trunked together two ports to another two port on the 2nd switch to allow for a total of 2 gigs of flow. I have not done trunking between a switch and a server with dual nics but know this is possible too. What I'm thinking you have done is trunk together the vlans on port one of your switch using the switch software. I did not know you could trunk vlans together. Is this what you did or am I way off? My questions should lead you to believe that I am new to vlans and I am just trying to figure a few things out. Once again you have been very helpful.
thanks,
Jim -
When you trunk two links between two switches, doesn't one link get blocked by spanning tree (to prevent switching loops)? Or are you using per-vlan STP and just setting the like VLAN 1, 3, 5 to one trunk and VLAN 2,4,6 to the second trunk?
I'm not sure how redunadant trunking between a server and the switch would work. I know we use this exact setup on a few of our servers at work though. Again, I'm not sure if the NIC's are bridged in the server, in which case one NIC would be blocked again thanks to STP, and each VLAN would have it's own server IP.
-
I was looking at our servers at work, they're dual gig NIC's. Because each link is going to a different redunandant switch, there is 2Gb transmit and 1Gb recieve, ARP will only return one MAC per given IP.
You can have 2Gb transmit and recieve if both gig links are going to the same switch (which they are in your case) using LACP (802.3ad).
-
Okay, I guess this line has me confused:
"Port 1 - trunk (VLAN 1, 2, 3, 4)"
Is port one just setup with vlan 1, 2, 3 and 4 or is there something special meant by "trunking" these vlans?
I have not trunked between switches for failover or redundancy. It has merely been for bandwidth.
thanks,
Jim -
Trunking is just a term used to describe a link with more then one VLAN, or camputer data and another source (telephone, video).
-
Ok need some help peeps. I have a nortel baystack 450-24t. what I am trying to do is vlan off my WAN so I can do loadbalanceing with the one NIC. I can get the untagged vlans to work great. but when I change the port to Tagged it wont pick anything up. the main reason I need it this way is because I am using a wireless bridge that has multiple ISP's on the other side.
so I have my AP plugged into a dumb switch that then has 2 cables going to the Nortel on port 3 and 5. port 3 is on vlan 10 while 5 is on 11. 10 has 3 untagged and 12 Tagged. 11 has 5 Untagged and 12 Tagged. 12 goes to the PF box that has a 802.1q vlan capable NIC ((LNKN006) Instant Gigabit Network Adapter I even picked this out of the supported hardware list :)) I have one gateway on 192.168.0.1 and the other on 192.168.5.1. I setup Vlan 10 and 11 on the PF box but it cant ping anything on the other side. I untag the Tagged port and put the AP right in port 3 and switch PF back to the interface and it works fine for one.
I might be confused on the setup of the switch. I upgraded the switch to the latest FW and SW. on the individual ports I can assign a Vlan but I want the Trunked to accses multible. do I have to make a Vlan specifically for that one or do I not need to worry about assigning it because it will goto whatever it is tagged with? I am also a little confused with the port based or protocol based Vlan. if I setup a protocol based I can not set a port to it… maybe I need to mess more with it :/ any help would be great :) sorry if I sound a little scattered but I really need to get this to work.
-
You have the identical switch that I have. Basically leave all ports untagged, with the exception of the trunk port(s). For the trunk port, tag that port with all the VLAN's you want included in that trunk.
What you have done sounds right, port 12 is your trunk with VLAN 10 and 11 going though it and that plugs into your pfsense.
I'd like a bit more info though. How many physical interfaces are on your pfsense? Just a WAN and the trunk? What are the rest of the ports doing on the switch?
-
ok…I Fiddled around with the Vlans and I got it working, well sort of.
when I plugged the AP directly to the switch the Vlan works fine, when I plug the ap into the switch then into the nortel, it work. when I plug in the other line from the switch into the Nortel it works fine, but (here is the big but :P) when I activate the opt1 interface on the PF box the switch freezes. it gets confused :(
so my question is this... is it posible to take one line from an AP and split it into 2 lines for Vlaning. or how would this be posible with one managed switch? its odd because it doesnt do a broadcast storm because the 2 ports cant talk but the switch just freezes.
any thoughts or other req'ed HW?
-
so my question is this… is it posible to take one line from an AP and split it into 2 lines for Vlaning. or how would this be posible with one managed switch?
No, unless your AP has two IP address and supports 802.1q tagging. You can only go from one VLAN to another via a router.
-
I think I figured it out ;D
I now know why the dumb switch was dieing… I had 2 ports that were going to the same MAC address so it froze. the way to work around that would be to spoof a Mac on the Opt1 interface so the switch thinks it is a different device and doesnt get all confused. both vlan 10 and 11 pointed to the PF box even though the 2 ports couldnt talk to eachother the switch saw 2 ports with the same MAC. Yippy it works :)
my AP is just being a transparent bridge. I can access both networks on the other side. the AP isnt even on the same network (the are in the 10.x network. thx alot peeps :)