PFSense, VLANs, and an HP Switch
-
Welp, I'm having no luck whatsoever.
Here's the config for the switch.
interface 3 name "ROKU" exit interface 5 name "Broom_1" exit interface 6 name "Broom_2" exit interface 10 name "FRoom_1" exit interface 12 name "MBedroom" exit interface 17 name "WAP" exit interface 18 name "Firewall" exit ip default-gateway 192.168.1.1 sntp server 192.168.1.1 timesync sntp sntp unicast snmp-server community "public" Unrestricted vlan 1 name "DEFAULT_VLAN" untagged 1-48 ip address 192.168.1.2 255.255.255.224 exit vlan 2 name "Internal" ip address 192.168.1.34 255.255.255.224 tagged 18 exit vlan 3 name "No_Inet" ip address 192.168.1.66 255.255.255.224 tagged 18 exit password managerI've tried it with all access ports untagged, and with all 3 vlans set to tag the ports on the pfsense uplink. But once I change the LAN interface from the NIC itself (fxp0) to be vlan0, I lose connectivity to the pfsense box. From my research, HP uses the term "trunk" to mean an aggregate of physical ports. Like pagp or lacp.
The way it is now, the pfsense box is routing the vlans correctly, but it looks like I'm mixing tagged and untagged traffic.
Hepl! ;)
-
Well your config for vlan2 and vlan3 seems correct, assuming you don't have any clients attached to those networks right now (and port 18 is where you attach pfSense). You shouldn't really use vlan1 for anything though, some hardware specifically reserves that VLAN id and won't let you use it for tagged traffic, and it may just cause problems. I'd try changing that number. You'll also need to add a tagged port (probably 18) while leaving the rest of the ports untagged.
That should work for you, but obviously you will need to configure pfSense to put the LAN on the VLAN instead.
-
I've since moved all ports out of VLAN1, and reassigned its IP address to something else so that I can keep my current rules, aliases, & dhcp reservation for the old scope (192.168.1.0/27). So VLAN2 is now what VLAN1 was, address-wise. I moved VLAN3 down to VLAN2's old address.
Everything is now working, but, only when VLAN2 is untagged on the uplink (18). As soon as I change the interface assignment for LAN from fxp0 to VLAN2, I lose connectivity.
A side note, before resetting the interfaces, I tried to ping the switch at 192.168.1.2 but got an error about "ping: sendto: operation not permitted". Is that a hint?
-
Post your new switch config.
-
Oops, sorry. Here it is.
interface 3 name "ROKU" exit interface 5 name "MBRoom_1" exit interface 6 name "MBRoom_2" exit interface 10 name "FRoom_1" exit interface 12 name "MBedroom" exit interface 17 name "WAP" exit interface 18 name "Firewall" exit ip default-gateway 192.168.1.1 sntp server 192.168.1.1 timesync sntp sntp unicast snmp-server community "public" Unrestricted vlan 1 name "DEFAULT_VLAN" ip address 192.168.2.2 255.255.255.224 tagged 18 no untagged 1-17,19-48 exit vlan 2 name "Internal" untagged 1-48 ip address 192.168.1.2 255.255.255.224 exit vlan 3 name "No_Inet" ip address 192.168.1.34 255.255.255.224 tagged 18 exit -
Your switch doesn't really need an IP on every VLAN anyway, you're not doing routing with it are you, not that it's a problem.
So what you're saying is when you issue "vlan 2 tagged 18" and create a new pfSense VLAN interface on VLAN id 2, and assign this interface to be your LAN, you can't connect? If that's what you're doing, your configuration seems correct.
-
No, I'm not routing on the switch, that's just out of habit and so I could still manage the switch while I was sorting out the pfsense part.
But yes, once I change the lan interface to be vlan2, and tag vlan 2 on 18, I lose connectivity. The odd part is, the pfsense box still responds to dhcp requests and is assigning addresses properly according to reservations. ???
I'm running 1.2.3 RC1, but the same thing was going on with 1.2.2
The NIC is a dual interface intel 10/100. Might that be the issue? I thought the intel cards supported the .1q tags.
Is there a list of what interfaces support the tagging?
-
Yah the fxp cards work well with VLANs, I have lots of these dual cards.
It sounds like you're doing everything correctly… do the other VLANs work okay?
Edit: Maybe we can find some problems if you post your switch config and pfSense vlan assignment/interfaces configurations with the config that's having trouble.
-
They did when I was testing earlier, but now, VLAN3 is down. Not sure why. Do I need traffic to be generated for it to come up? It is enabled and has a "pass-any-any" rule applied to it.
-
Finally!! I got it!!
I ended up re-assigning the VLANs a couple of times with no luck, then finally removed them all, rebooted, re-created them, rebooted, assigned them, rebooted, and while it was rebooting, I set the switch to tag all vlans on the uplink port (18), and when it came back up, it was responding properly.
I'm not sure if I had originally mis-assigned the VLANs or what since I was using VLAN1 and might not have removed it correctly. Clearing out them altogether might have ensured I started with a clean slate.
Thanks for all your help ktims!
-
On a similar note, I too am using a VLAN capable HP switch, a 2510. I am having a hard time getting a straight answer to this googling about, but when a packet is untagged, with regards to a VLAN aware switch doesn't it automatically become a member of VLAN1? I thought I read that on a Cisco site so it may not even apply here, but I was trying to use pfSense as a captive portal only with a single interface and assigned VLAN1 to LAN and VLAN2 to WAN on the fxp0 interface and when I set up my PC on the same subnet as VLAN1, I couldn't connect. When I changed VLAN1 to fxp0, it worked. I have not set up my switch to do anything with VLANs at the moment, but I'm wondering–am I misunderstanding how VLAN1 works, or is this a unique issue with HP switches?
Hope this isn't a breach of etiquette, but I thought it'd be better to ask here rather than open a new thread for what is probably a dumb question.
Thanks!
-
Well, from what ktims said here, don't use VLAN1. That's set for the primary VLAN by default on HP switches, and is apparently treated differently by some devices. I started using that, but ended up with my first VLAN being "2". It can be changed on the switch, but it's probably best to just avoid it.
As for the untagged part, a port can be set for any untagged vlan, but only one at a time. So if you're set for VLAN1 untagged, any other vlan membership will have to be tagged. (The HP switches also have "no" and "forbid" settings, but I haven't started playing with those yet.)
As for how you'd configure the switch, all VLANs to be sent to the pfsense box would be tagged on that port (probably VLAN2 & VLAN3 if you skip #1).
I ended up with all my ports except 18 (the firewall uplink) untagged on vlan2. Port 18 is tagging vlans 2 & 3 and any more I might create. For access ports, I'd change the port to be untagged on whatever vlan I wanted. So If I create vlan4, and want to send people in VLAN 4 to the 'net, port 20 (or whatever) would be untagged for vlan4, and I'd tag vlan4 on port 18 (to present it to the pfsense box).
-
If you fancy a read this is a good thread about my HP Vlan implementation, may have some useful pointers.
http://forum.pfsense.org/index.php/topic,11913.0.html
http://wan2.cheesyboofs.co.uk/home.htm
As you will see nearer the end I was having a mare until I stopped using VLAN 1, the web interface for pfsense was unusable and the network ground to a halt.
Cheers
-
Excellent, thank you both for the replies. My main confusion was just that I thought VLAN1 and untagged were synonymous after they entered the switch. Thanks for pointing me in the right direction, and I'll definately check out those links you posted, cheesyboofs.
Thanks again!
-
VICTORY! OK, after pulling my hair out, I just want to contribute something that I hope will help. I don't know if this will be useful for painless8139 on the way forward, and this might not be the right place to post this, but here goes:
I was having a hell of a time getting my pfsense test box to play nice with a ProCurve 1800-24G with respect to VLANs.
To keep the explanation simple, I won't go into all the VLANs I was trying to provision, but vlan5 (or, vlan tag 5, anyway) was intended as the LAN.
I would start with my LAN on, say, BGE0, and be plugged straight into it from the computer I was on. When i would use the WEB-GUI to create vlan5 (parent bge0) and move the LAN interface over to it, I'd then get kicked off. This is the expected behavior because now I should be accessing the LAN from a port on the ProCurve that has vlan5 as the PVID.
Here was my ProCurve config
I had ports 1-18 setup as non-"VLAN aware", with PVID 5. So anything I plugged into those ports should automatically be on vlan5.
Port 22 was set up as my uplink port, with VLANs 5, 10, and 15 setup as members. Obviously port 22 was plugged into the pfsense box on physical port bge0.
So, as I said, after moving the LAN interface from bge0 physical to vlan5, I'd get dropped from the Web-configurator. Again, this is what should happen.
The problem was that when I would then plug into, say, port 3 (PVID=5, non-VLAN aware (meaning it will only accept untagged packets and send them through vlan5), I'd get nothing. No DHCP lease, no WEB-GUI.
After restoring default config and rebuilding VLANs on the pfsense box several times (as per what drogo did) to no avail, I finally double-checked my switch config. Everything looked right, except I still had port 22 allowing untagged packets - (with a PVID of 5 - don't remember doing that) in addition to the tagged packets for vlans 5, 10, and 15. I thought I had disabled untagged packets on this port, but I guess not.
Long story short, I set port 22 to allow tagged packets only, and I removed the PVID altogether, and VOILA, it worked.
The moral of the story (which has been said on this forum before), is to never mix tagged and untagged traffic. There was some other moral but I forgot what it was. ::)
painless8319, VLAN1 and untagged are synonymous in the default switch configuration, because all ports have their PVID set to vlan1 (by default). But what this means for traffic passing through the switch (in its default configuration) is that it's not a member of any vlan. It goes in untagged, and comes out untagged. The "member of vlan1" part is only relevant to the switch itself (for the purpose of accessing the management console), and really only once you start configuring additional vlans.
One thing I'd like to get ktims' opinion on is whether using vlan1 is a no-no because it's vlan1, or because it's usually the default management vlan.
What I've done in order to not have to dedicate a port to switch management is to change the management vlan to vlan5 (my LAN vlan). That way I can manage it normally and still avoid using vlan1 for anything.
-
Mostly because VLAN 1 is treated differently by a lot of switches. I've seen some that won't tag VLAN 1 traffic no matter what you set in the GUI, and some other strange & incorrect behaviour. It's easier to just avoid using it altogether. Also because it's the default VLAN, it's pretty easy to inadvertently end up with untagged traffic all over the place that you weren't expecting, or ports that can get on networks they shouldn't, ARP broadcasts crossing VLAN boundaries etc.
