Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Setting up a VLAN part 2

    Scheduled Pinned Locked Moved General pfSense Questions
    110 Posts 3 Posters 38.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ?
      A Former User
      last edited by

      ok, i decided to not try it with 1 NIC….

      i get the second nic setup and assign vlan100 to run on re1.

      i know pfsense sees the NIC because i see it in the GUI.

      my HP sees RE1 because the green LEDs come on and i see it highlight in the hp GUI.

      however, i dont see the link activity LEDs on the NIC turn on.  maybe i have a bad NIC?  i'd have to see if i have another one somewhere.

      anyway....

      how should i be tagging/untagging/excluding ports?

      i tried a few combindations and i still get 169.254 as the IP on my laptop.

      keep in mind, i need to add an additional port to vlan100 on the hp switch because the only port i was using before, port 2 was for testing my laptop, is now being used to connect to the pfsense NIC.

      i decided to use ports 7 and 8 as my vlan100 ports

      ports that should be on vlan 1- 1,2,3/4,5,6 (3/4 is the trunk/bond, but i can easily assign that to a vlan1 via the tag/untagg screen.

      ports that should be on vlan 100- 7,8

      let me take a stab...

      vlan1-    UUUUUUTT
      vlan100- EEEEEEUU

      1 Reply Last reply Reply Quote 0
      • ?
        A Former User
        last edited by

        yeah, something is wrong with the nic in the pfsense box (re1).

        i bypassed the hp switch and went directly into my laptop and it goes on….off....on....off....on....off

        however, we can still talk about tagging/untagging for when i do find a another NIC.

        edit- found a good/compatible NIC card.  plugged it in, plugged in m laptop and i have green LEDs, re1, back online.

        now for the u/t/e portion.

        1 Reply Last reply Reply Quote 0
        • ?
          A Former User
          last edited by

          or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface.  might as well try that before bringing in the switch, right?

          EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses.  i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x).  unchecked it, saved, new device instantly got an IP address (192.168.1.x).

          1 Reply Last reply Reply Quote 0
          • M
            Metu69salemi
            last edited by

            i've dropped out what happened, did you setup another nic which is handling two vlans? or did you setup interface only handling one vlan

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              @tomdlgns:

              or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface.  might as well try that before bringing in the switch, right?

              Nope.
              Your laptop will not see the vlan tagged packets at all, it's NIC will just discard them. You need the switch to read in the tagged packets, route them to the correct port and remove the tags so that you laptop see standard untagged packets.

              @tomdlgns:

              EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses.  i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x).  unchecked it, saved, new device instantly got an IP address (192.168.1.x).

              No idea what's happening there, that is strange.

              Steve

              1 Reply Last reply Reply Quote 0
              • ?
                A Former User
                last edited by

                @Metu69salemi:

                i've dropped out what happened, did you setup another nic which is handling two vlans? or did you setup interface only handling one vlan

                yes, i have a second NIC installed with vlan100 and dhcp server is enabled.

                1 Reply Last reply Reply Quote 0
                • ?
                  A Former User
                  last edited by

                  @stephenw10:

                  @tomdlgns:

                  or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface.  might as well try that before bringing in the switch, right?

                  Nope.
                  Your laptop will not see the vlan tagged packets at all, it's NIC will just discard them. You need the switch to read in the tagged packets, route them to the correct port and remove the tags so that you laptop see standard untagged packets.

                  @tomdlgns:

                  EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses.  i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x).  unchecked it, saved, new device instantly got an IP address (192.168.1.x).

                  No idea what's happening there, that is strange.

                  Steve

                  ok, makes sense.

                  since i was just plugged into my laptop that could be why it wasnt working, i understand that i need to bring the switch in.  i just assumed since the laptop was connected directly to the second nic with vlan100 assigned to it in pfsense, that i would have no need for a switch.  however, it makes perfect sense that i need the vlan switch.

                  with all that said, i'd like to get the vlan tagging correct now with two nics

                  vlan1 on the hp switch should be ports

                  1,2,3,4,5,6

                  vlan 100 on the hp switch should be ports

                  7,8

                  vlan1-    U U U U U U T T
                  vlan100- E E E E E E U U

                  is that close?

                  edit-

                  ports 1-6 would be 192.168.1.x network

                  ports 7/8 would be 10.10.10.x network
                  port 7 is patch cable to vlan100 nic (second NIC) on pfsense box
                  port 8 is patch cable to a wifi router with DHCP disabled (pfsense will do that) or a direct laptop.

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    VLAN1 is probably going to stop working here because hopefully you will stop sending any untagged packets to the switch from pfSense.

                    Configure the switch:

                    
                    port:        1 2 3 4 5 6 7 8 
                    vlan1:       U U U U U U E E
                    vlan100:     T E E E E E U U
                    
                    

                    Unassign re1 from LAN to stop is sending untagged packets. This will lock you out of the pfSense box if you haven't got access from re2.

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • ?
                      A Former User
                      last edited by

                      @stephenw10:

                      VLAN1 is probably going to stop working here because hopefully you will stop sending any untagged packets to the switch from pfSense.

                      Configure the switch:

                      
                      port:        1 2 3 4 5 6 7 8 
                      vlan1:       U U U U U U E E
                      vlan100:     T E E E E E U U
                      
                      

                      Unassign re1 from LAN to stop is sending untagged packets. This will lock you out of the pfSense box if you haven't got access from re2.

                      Steve

                      vlan 1 is going to stop working?  what does that mean?  i would still like all 192. computers to work.

                      by tagging port 1 in vlan100 is that what 'unassing re1 from LAN to stop sending untagged packets' is?

                      i will wait for a reply before i set it up that way.

                      1 Reply Last reply Reply Quote 0
                      • M
                        Metu69salemi
                        last edited by

                        create a new vlan say 10 or something else than 1 or 100
                        Use only your current lan interface as management interface and both two vlan's to the same nic where you have vlan currently.
                        so your network would be
                        nic(lan): 192.168.1.1 /24 for management, you could also use something else subnet area
                        vlan10 (on another nic): this would be your current lan, so whatever you like to use, but notice, that this vlan and above management subnet wouldn't work if they have same subnets
                        vlan100 (on same nic as vlan10): this would be same as currently

                        then add current configs to switch
                        vlan10:  T U U U U U E E
                        vlan100: T E E E E E U U
                        remember to connect port 1 to pfsense

                        1 Reply Last reply Reply Quote 0
                        • ?
                          A Former User
                          last edited by

                          @Metu69salemi:

                          create a new vlan say 10 or something else than 1 or 100
                          Use only your current lan interface as management interface and both two vlan's to the same nic where you have vlan currently.
                          so your network would be
                          nic(lan): 192.168.1.1 /24 for management, you could also use something else subnet area
                          vlan10 (on another nic): this would be your current lan, so whatever you like to use, but notice, that this vlan and above management subnet wouldn't work if they have same subnets
                          vlan100 (on same nic as vlan10): this would be same as currently

                          then add current configs to switch
                          vlan10:   T U U U U U E E
                          vlan100: T E E E E E U U
                          remember to connect port 1 to pfsense

                          ok, what does vlan1 look like in the hp switch?

                          i think you just confused me more.

                          1 Reply Last reply Reply Quote 0
                          • M
                            Metu69salemi
                            last edited by

                            in this topology it doesn't exist
                            It is only "console" access to the firewall

                            1 Reply Last reply Reply Quote 0
                            • ?
                              A Former User
                              last edited by

                              @Metu69salemi:

                              in this topology it doesn't exist
                              It is only "console" access to the firewall

                              let me rephrase.

                              that is ok if it is there and i dont use it, but i will have it in my switch.  after reading the post, it seems as if my switch needs to look like this

                              vlan1
                              vlan10
                              vlan100

                              maybe we should start with pfsense, do i have that configured properly?

                              re0- WAN
                              re1- vlan100 (10.10.10.1) dhcp enabled
                              re2- LAN (192.168.1.1) dhcp enabled

                              –------------------
                              pfsense LAN goes into HP port 1 (vlan?) 192.168.1.x


                              pfsense vlan100 goes into HP port 7 (vlan100 on hp switch) 10.10.10.x and port 8 needs to be on vlan100 as well.

                              EDIT-

                              does the pfsense NIC even need to be a VLAN?  if i am using a seperate NIC, shouldnt i be able to assign it to 10.10.10.x and deal with VLANs in the HP switch to segregate 10 traffic vs 192 traffic?

                              1 Reply Last reply Reply Quote 0
                              • ?
                                A Former User
                                last edited by

                                did you guys give up on me?

                                ;D

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Sorry I was out on an all night 120 mile cycle ride Saturday night. Yesterday was pretty much a write off!  :)

                                  I think we could easily loose sight of the big picture here.
                                  The aim of this exercise is to learn about VLANs. The configuration we are hoping to end up with is:
                                  pfSense using two interfaces, WAN on re0 and VLANs on re1.
                                  The HP switch configured to split the VLANs between some it's ports. Such that some ports are pfSenses LAN interface and some are pfSenses other interface.

                                  Although you have LAN setup on re2 at the moment that's only temporary while we configure VLANs on re1.

                                  Setup another VLAN as  Metu69salemi suggested.

                                  You should only have one cable between pfSense (re1) and the trunk port on the switch (port1).

                                  Steve

                                  1 Reply Last reply Reply Quote 0
                                  • ?
                                    A Former User
                                    last edited by

                                    @stephenw10:

                                    Sorry I was out on an all night 120 mile cycle ride Saturday night. Yesterday was pretty much a write off!  :)

                                    I think we could easily loose sight of the big picture here.
                                    The aim of this exercise is to learn about VLANs. The configuration we are hoping to end up with is:
                                    pfSense using two interfaces, WAN on re0 and VLANs on re1.
                                    The HP switch configured to split the VLANs between some it's ports. Such that some ports are pfSenses LAN interface and some are pfSenses other interface.

                                    Although you have LAN setup on re2 at the moment that's only temporary while we configure VLANs on re1.

                                    Setup another VLAN as  Metu69salemi suggested.

                                    You should only have one cable between pfSense (re1) and the trunk port on the switch (port1).

                                    Steve

                                    hmmm, now i am confused, it is official.

                                    i thought that doing everything from one interface was part of the reason i wasnt able to verify if i had everythign configured properly?

                                    wasnt the recommendation to use 3 NICS?

                                    re0- WAN
                                    re1- VLANs (originally not in play)
                                    re2- LAN (for 192.168.1.x network)

                                    that would mean two connections from pfsense to my switch

                                    re1- for VLANs (or 10.10.10.x network)
                                    re0- for the regular 192.168.1.x network

                                    unless i missed something, that is how i thought it was going to end up.

                                    thanks.

                                    (btw, i dont blame you for taking the day off, the weekends are there to enjoy and relax, sounds like you did both)  :)

                                    1 Reply Last reply Reply Quote 0
                                    • ?
                                      A Former User
                                      last edited by

                                      i have access to another switch i can use, but it isnt in the mix yet, just want some feedback…

                                      it is an HP switch, but a little more advanced/better GUI than the one i am using.

                                      in this switch, the vlan has 4 options:

                                      no
                                      tagged
                                      untagged
                                      forbid

                                      i assume forbid= exclude

                                      or is it

                                      no=exclude

                                      part of the confusion is that:

                                      -i have never had to use vlans, but i want to learn
                                      -every piece of device i have logged into with vlan capabilities has a different 'look' to it.

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        Metu69salemi
                                        last edited by

                                        Please see attached file
                                        you could also allow from the switch to use another management ip from another vlan or setup another management vlan

                                        vlans.png
                                        vlans.png_thumb

                                        1 Reply Last reply Reply Quote 0
                                        • ?
                                          A Former User
                                          last edited by

                                          @Metu69salemi:

                                          Please see attached file
                                          you could also allow from the switch to use another management ip from another vlan or setup another management vlan

                                          what is console? 1 PC i have connected to pfsense just to login to it to make changes?

                                          also, wiring it up isnt a problem.

                                          if i wire it i need to be able to build out the vlans for it to function properly.

                                          i need guidance on that portion.  i guess i need to go to the HP forums and ask them what the proper way to tag/untag is?  that is my issue here (i think pfsense is setup properly).

                                          thanks.

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            Metu69salemi
                                            last edited by

                                            Console means, that you sit next to that machine, but in this case it's only needed if you have locked you self out from another vlan

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.