Setting up a VLAN part 2
-
N for no access is the same as E for Exclude i would imagine.
my HP uses T, U, E
-
Yes N==E. ;)
Just take it one step at a time. Varify that each step is doing what you think it should. Most config problems are caused by trying to implement a hundred functions at once and then, when it doesn't work, having no idea which one caused the trouble.
Steve
-
You're right it was a typo. And N just meaned that anyway there is no connection between, so it doesn't matter what is the language of your switch
-
ok, i set it up as posted but still not getting a 10.10.10.x ip on the spare/test laptop (plugged into port 2 on hp switch).
here is what the switch and pfsense look like
-
one thing to note, the 192 network is working with this setup.
when i did this last night, i couldnt get 192 or 10 to work, so i am getting somewhere with the tagging/untagging/excluding.
i should also note that both yesterday and today (prior to messing with this) the pfsense lan cable re2 plugged in directly to my netgear.
once i started setting this up, i made sure to unplug re2 from my netgear switch into port 1 of the hp switch (vlan switch) just in case someone thought that wasnt happening.
thanks
-
Hmm, that's not right. Set the participation as Metu69salemi suggetsed earlier.
Port 1 2 3 4 5 6 VLAN1 U E * * U U VLAN100 T U * * E E
If that doesn't work try:
Port 1 2 3 4 5 6 VLAN1 T E * * U U VLAN100 T U * * E E
Steve
-
Hmm, that's not right. Set the participation as Metu69salemi suggetsed earlier.
Port 1 2 3 4 5 6 VLAN1 U E * * U U VLAN100 T U * * E E
If that doesn't work try:
Port 1 2 3 4 5 6 VLAN1 T E * * U U VLAN100 T U * * E E
Steve
ok, the first config doesnt give my laptop an IP, but 192 network can go online
with the second config…i get no ip to my laptop and 192 network cant go online.
EDIT- if my pfsense settings look ok, then i can stop looking there. do you guys want pics of the DHCP server settings? i set it up the same as 192 DHCP settings, so anything plugged into port 2 of my vlan switch should get an IP address from 10.10.10.x from pfsense.
-
Ok stick with the first config then.
You may as well post your DHCP config, it might help.What exactly are you using ports 3 and 4 for?
Have you added firewall rules for the vlan interface? I assumed you had. DHCP should work anyway.
The confusing thing here, for me, is that a packet tagged with vlan ID 1 is not the same as an untagged packet.
It shouldn't be this difficult so something is obviously wrong somewhere!Steve
-
Ok stick with the first config then.
You may as well post your DHCP config, it might help.What exactly are you using ports 3 and 4 for?
Have you added firewall rules for the vlan interface? I assumed you had. DHCP should work anyway.
The confusing thing here, for me, is that a packet tagged with vlan ID 1 is not the same as an untagged packet.
It shouldn't be this difficult so something is obviously wrong somewhere!Steve
ports 3/4 are trunked/bonded to my NAS. just trying to get the most i can with two cat5 cables. the nas also has a 'bond' with the two nic ports.
here is the DHCP screen shot for 10.10.10.x and i have not written any firewall rules, i agree with you in that it should still assign it an IP address.
-
can you show your rules of wifi interface?
and still i'd like to use that
port: 1 2 3 4 5 6 7 8 vlan1: U E U U U U U U vlan100: T U E E E E E E
or then go the later solution(port 1 tagged in both vlans), but you'll have to setup management on other nic and networks in other nic
-
This could be the reason the tagged and untagged traffic should not be on the same interface. ::)
I have not experienced how problems would show up.Steve
Edit: Reading 'the definitive guide' for inspiration I see that this could be a problem related to the NIC not supporting the increased frame size required by the VLAN tag.
In particular it mentions that Realtek interfaces may not support it even if they report doing so. Though that is for rl(4) rather than re(4). -
can you show your rules of wifi interface?
and still i'd like to use that
port: 1 2 3 4 5 6 7 8 vlan1: U E U U U U U U vlan100: T U E E E E E E
or then go the later solution(port 1 tagged in both vlans), but you'll have to setup management on other nic and networks in other nic
ok, i will take a look at that setup and report back.
also, unless some default rules were put in place, i didnt create any rules, but i will post a screen of that and add in some common/default rules to see if that does it.
-
This could be the reason the tagged and untagged traffic should not be on the same interface. ::)
I have not experienced how problems would show up.Steve
Edit: Reading 'the definitive guide' for inspiration I see that this could be a problem related to the NIC not supporting the increased frame size required by the VLAN tag.
In particular it mentions that Realtek interfaces may not support it even if they report doing so. Though that is for rl(4) rather than re(4).if the above config doesnt work, i am going to stop trying to do it with 1 NIC and will bring in the second nic.
-
Here is what I would do:
Disable trunking/bonding for now, it's just adding a further complication and you can add it back once you figure out VLANs. (what VLANs did you set on the trunk in the switch?)Setup the second interface so that you have access to the webgui even if everything on the first interface gets locked out.
Unassign the first interface so that it's not sending untagged packets. Create a VLAN on it, VLAN100 say, and then try to configure the switch to work with it.
Add more VLANs once that's working.
Steve
-
Here is what I would do:
Disable trunking/bonding for now, it's just adding a further complication and you can add it back once you figure out VLANs. (what VLANs did you set on the trunk in the switch?)Setup the second interface so that you have access to the webgui even if everything on the first interface gets locked out.
Unassign the first interface so that it's not sending untagged packets. Create a VLAN on it, VLAN100 say, and then try to configure the switch to work with it.
Add more VLANs once that's working.
Steve
everything you mentioned is my problem (tagging/untagging).
since i get confused, i wont know if i am doing it right.
not sure how to setup management to be accessible from both vlans?
also, you can see how the trunk was configured in the pics above. i dont think there are issues with that, worst case scenario (if i set it up wrong) i wont be able to access my NAS, not critical.
-
I meant the second interface on the pfSense box so you don't get locked out of pfSense.
It looks like you're doing everything right. At this point you have not been able to see any VLAN activity in any way, at an time, yes?
It seems likely that your pfSense box is not sending VLAN frames for some reason. Could be a config issue, it could be that your NIC is interfering etc.Once you are able to access the pfSense gui via a different interface you can safely play with these settings and not get locked out.
Steve
-
I meant the second interface on the pfSense box so you don't get locked out of pfSense.
It looks like you're doing everything right. At this point you have not been able to see any VLAN activity in any way, at an time, yes?
It seems likely that your pfSense box is not sending VLAN frames for some reason. Could be a config issue, it could be that your NIC is interfering etc.Once you are able to access the pfSense gui via a different interface you can safely play with these settings and not get locked out.
Steve
gotcha…yeah, i might just give up on trying to do it with 1 nic/1 cable mainly because i forgot about the compatibility issue, even if it is setup right, i might be using a nic card that isnt compatible.
thanks for the help to all up to this point.
-
ok, i decided to not try it with 1 NIC….
i get the second nic setup and assign vlan100 to run on re1.
i know pfsense sees the NIC because i see it in the GUI.
my HP sees RE1 because the green LEDs come on and i see it highlight in the hp GUI.
however, i dont see the link activity LEDs on the NIC turn on. maybe i have a bad NIC? i'd have to see if i have another one somewhere.
anyway....
how should i be tagging/untagging/excluding ports?
i tried a few combindations and i still get 169.254 as the IP on my laptop.
keep in mind, i need to add an additional port to vlan100 on the hp switch because the only port i was using before, port 2 was for testing my laptop, is now being used to connect to the pfsense NIC.
i decided to use ports 7 and 8 as my vlan100 ports
ports that should be on vlan 1- 1,2,3/4,5,6 (3/4 is the trunk/bond, but i can easily assign that to a vlan1 via the tag/untagg screen.
ports that should be on vlan 100- 7,8
let me take a stab...
vlan1- UUUUUUTT
vlan100- EEEEEEUU -
yeah, something is wrong with the nic in the pfsense box (re1).
i bypassed the hp switch and went directly into my laptop and it goes on….off....on....off....on....off
however, we can still talk about tagging/untagging for when i do find a another NIC.
edit- found a good/compatible NIC card. plugged it in, plugged in m laptop and i have green LEDs, re1, back online.
now for the u/t/e portion.
-
or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface. might as well try that before bringing in the switch, right?
EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses. i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x). unchecked it, saved, new device instantly got an IP address (192.168.1.x).