Setting up a VLAN part 2

Metu69salemi

i've dropped out what happened, did you setup another nic which is handling two vlans? or did you setup interface only handling one vlan

stephenw10

@tomdlgns:

or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface. might as well try that before bringing in the switch, right?

Nope.
Your laptop will not see the vlan tagged packets at all, it's NIC will just discard them. You need the switch to read in the tagged packets, route them to the correct port and remove the tags so that you laptop see standard untagged packets.

@tomdlgns:

EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses. i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x). unchecked it, saved, new device instantly got an IP address (192.168.1.x).

No idea what's happening there, that is strange.

Steve

A Former User

@Metu69salemi:

i've dropped out what happened, did you setup another nic which is handling two vlans? or did you setup interface only handling one vlan

yes, i have a second NIC installed with vlan100 and dhcp server is enabled.

A Former User

@stephenw10:

@tomdlgns:

or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface. might as well try that before bringing in the switch, right?

Nope.
Your laptop will not see the vlan tagged packets at all, it's NIC will just discard them. You need the switch to read in the tagged packets, route them to the correct port and remove the tags so that you laptop see standard untagged packets.

@tomdlgns:

EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses. i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x). unchecked it, saved, new device instantly got an IP address (192.168.1.x).

No idea what's happening there, that is strange.

Steve

ok, makes sense.

since i was just plugged into my laptop that could be why it wasnt working, i understand that i need to bring the switch in. i just assumed since the laptop was connected directly to the second nic with vlan100 assigned to it in pfsense, that i would have no need for a switch. however, it makes perfect sense that i need the vlan switch.

with all that said, i'd like to get the vlan tagging correct now with two nics

vlan1 on the hp switch should be ports

1,2,3,4,5,6

vlan 100 on the hp switch should be ports

7,8

vlan1- U U U U U U T T
vlan100- E E E E E E U U

is that close?

edit-

ports 1-6 would be 192.168.1.x network

ports 7/8 would be 10.10.10.x network
port 7 is patch cable to vlan100 nic (second NIC) on pfsense box
port 8 is patch cable to a wifi router with DHCP disabled (pfsense will do that) or a direct laptop.

stephenw10

VLAN1 is probably going to stop working here because hopefully you will stop sending any untagged packets to the switch from pfSense.

Configure the switch:


port:        1 2 3 4 5 6 7 8 
vlan1:       U U U U U U E E
vlan100:     T E E E E E U U

Unassign re1 from LAN to stop is sending untagged packets. This will lock you out of the pfSense box if you haven't got access from re2.

Steve

A Former User

@stephenw10:

VLAN1 is probably going to stop working here because hopefully you will stop sending any untagged packets to the switch from pfSense.

Configure the switch:
port:        1 2 3 4 5 6 7 8 
vlan1:       U U U U U U E E
vlan100:     T E E E E E U U
Unassign re1 from LAN to stop is sending untagged packets. This will lock you out of the pfSense box if you haven't got access from re2.

Steve

vlan 1 is going to stop working? what does that mean? i would still like all 192. computers to work.

by tagging port 1 in vlan100 is that what 'unassing re1 from LAN to stop sending untagged packets' is?

i will wait for a reply before i set it up that way.

Metu69salemi

create a new vlan say 10 or something else than 1 or 100
Use only your current lan interface as management interface and both two vlan's to the same nic where you have vlan currently.
so your network would be
nic(lan): 192.168.1.1 /24 for management, you could also use something else subnet area
vlan10 (on another nic): this would be your current lan, so whatever you like to use, but notice, that this vlan and above management subnet wouldn't work if they have same subnets
vlan100 (on same nic as vlan10): this would be same as currently

then add current configs to switch
vlan10: T U U U U U E E
vlan100: T E E E E E U U
remember to connect port 1 to pfsense

A Former User

@Metu69salemi:

create a new vlan say 10 or something else than 1 or 100
Use only your current lan interface as management interface and both two vlan's to the same nic where you have vlan currently.
so your network would be
nic(lan): 192.168.1.1 /24 for management, you could also use something else subnet area
vlan10 (on another nic): this would be your current lan, so whatever you like to use, but notice, that this vlan and above management subnet wouldn't work if they have same subnets
vlan100 (on same nic as vlan10): this would be same as currently

then add current configs to switch
vlan10: T U U U U U E E
vlan100: T E E E E E U U
remember to connect port 1 to pfsense

ok, what does vlan1 look like in the hp switch?

i think you just confused me more.

Metu69salemi

in this topology it doesn't exist
It is only "console" access to the firewall

A Former User

@Metu69salemi:

in this topology it doesn't exist
It is only "console" access to the firewall

let me rephrase.

that is ok if it is there and i dont use it, but i will have it in my switch. after reading the post, it seems as if my switch needs to look like this

vlan1
vlan10
vlan100

maybe we should start with pfsense, do i have that configured properly?

re0- WAN
re1- vlan100 (10.10.10.1) dhcp enabled
re2- LAN (192.168.1.1) dhcp enabled

–------------------
pfsense LAN goes into HP port 1 (vlan?) 192.168.1.x

pfsense vlan100 goes into HP port 7 (vlan100 on hp switch) 10.10.10.x and port 8 needs to be on vlan100 as well.

EDIT-

does the pfsense NIC even need to be a VLAN? if i am using a seperate NIC, shouldnt i be able to assign it to 10.10.10.x and deal with VLANs in the HP switch to segregate 10 traffic vs 192 traffic?

A Former User

did you guys give up on me?

;D

stephenw10

Sorry I was out on an all night 120 mile cycle ride Saturday night. Yesterday was pretty much a write off! :)

I think we could easily loose sight of the big picture here.
The aim of this exercise is to learn about VLANs. The configuration we are hoping to end up with is:
pfSense using two interfaces, WAN on re0 and VLANs on re1.
The HP switch configured to split the VLANs between some it's ports. Such that some ports are pfSenses LAN interface and some are pfSenses other interface.

Although you have LAN setup on re2 at the moment that's only temporary while we configure VLANs on re1.

Setup another VLAN as Metu69salemi suggested.

You should only have one cable between pfSense (re1) and the trunk port on the switch (port1).

Steve

A Former User

@stephenw10:

Sorry I was out on an all night 120 mile cycle ride Saturday night. Yesterday was pretty much a write off! :)

I think we could easily loose sight of the big picture here.
The aim of this exercise is to learn about VLANs. The configuration we are hoping to end up with is:
pfSense using two interfaces, WAN on re0 and VLANs on re1.
The HP switch configured to split the VLANs between some it's ports. Such that some ports are pfSenses LAN interface and some are pfSenses other interface.

Although you have LAN setup on re2 at the moment that's only temporary while we configure VLANs on re1.

Setup another VLAN as Metu69salemi suggested.

You should only have one cable between pfSense (re1) and the trunk port on the switch (port1).

Steve

hmmm, now i am confused, it is official.

i thought that doing everything from one interface was part of the reason i wasnt able to verify if i had everythign configured properly?

wasnt the recommendation to use 3 NICS?

re0- WAN
re1- VLANs (originally not in play)
re2- LAN (for 192.168.1.x network)

that would mean two connections from pfsense to my switch

re1- for VLANs (or 10.10.10.x network)
re0- for the regular 192.168.1.x network

unless i missed something, that is how i thought it was going to end up.

thanks.

(btw, i dont blame you for taking the day off, the weekends are there to enjoy and relax, sounds like you did both) :)

A Former User

i have access to another switch i can use, but it isnt in the mix yet, just want some feedback…

it is an HP switch, but a little more advanced/better GUI than the one i am using.

in this switch, the vlan has 4 options:

no
tagged
untagged
forbid

i assume forbid= exclude

or is it

no=exclude

part of the confusion is that:

-i have never had to use vlans, but i want to learn
-every piece of device i have logged into with vlan capabilities has a different 'look' to it.

Metu69salemi

Please see attached file
you could also allow from the switch to use another management ip from another vlan or setup another management vlan

vlans.png_thumb

A Former User

@Metu69salemi:

Please see attached file
you could also allow from the switch to use another management ip from another vlan or setup another management vlan

what is console? 1 PC i have connected to pfsense just to login to it to make changes?

also, wiring it up isnt a problem.

if i wire it i need to be able to build out the vlans for it to function properly.

i need guidance on that portion. i guess i need to go to the HP forums and ask them what the proper way to tag/untag is? that is my issue here (i think pfsense is setup properly).

thanks.

Metu69salemi

Console means, that you sit next to that machine, but in this case it's only needed if you have locked you self out from another vlan

A Former User

@Metu69salemi:

Console means, that you sit next to that machine, but in this case it's only needed if you have locked you self out from another vlan

the HP switch has a management port section where i can dedicate 1 of the ports as a managed port.

i dont think that will be an issue unless i screw up the tagging/untagging/exclude, which is where i am stuck.

stephenw10

@tomdlgns:

hmmm, now i am confused, it is official.

i thought that doing everything from one interface was part of the reason i wasnt able to verify if i had everythign configured properly?

wasnt the recommendation to use 3 NICS?

re0- WAN
re1- VLANs (originally not in play)
re2- LAN (for 192.168.1.x network)

Originally you wanted to use just two interfaces on the pfSense machine so that is what we are attempting to achieve. We only recommended you setup re2 so that you didn't get locked out of pfSense if you configured VLANs incorrectly. You have assigned LAN to it but we didn't expect you to. It could be any OPT interface.

@tomdlgns:

that would mean two connections from pfsense to my switch

re1- for VLANs (or 10.10.10.x network)
re0- for the regular 192.168.1.x network

unless i missed something, that is how i thought it was going to end up.

Whilst you could have both interfaces connected to the switch it would be far more complex to setup and MUCH more likely to cause problems.

Technically you don't need use VLANs at all, you want two subnets and you have two interfaces.

Let me layout what I expect the final configuration to be.

WAN - re0
LAN - VLAN10 - re1 192.168.1.X
OPT1 - VLAN100 - re1 10.10.10.X
OPT2 - re2 192.168.2.X

I hope that makes some sort of sense!

Steve

A Former User

@stephenw10:

@tomdlgns:

hmmm, now i am confused, it is official.

i thought that doing everything from one interface was part of the reason i wasnt able to verify if i had everythign configured properly?

wasnt the recommendation to use 3 NICS?

re0- WAN
re1- VLANs (originally not in play)
re2- LAN (for 192.168.1.x network)

Originally you wanted to use just two interfaces on the pfSense machine so that is what we are attempting to achieve. We only recommended you setup re2 so that you didn't get locked out of pfSense if you configured VLANs incorrectly. You have assigned LAN to it but we didn't expect you to. It could be any OPT interface.

@tomdlgns:

that would mean two connections from pfsense to my switch

re1- for VLANs (or 10.10.10.x network)
re0- for the regular 192.168.1.x network

unless i missed something, that is how i thought it was going to end up.

Whilst you could have both interfaces connected to the switch it would be far more complex to setup and MUCH more likely to cause problems.

Technically you don't need use VLANs at all, you want two subnets and you have two interfaces.

Let me layout what I expect the final configuration to be.

WAN - re0
LAN - VLAN10 - re1 192.168.1.X
OPT1 - VLAN100 - re1 10.10.10.X
OPT2 - re2 192.168.2.X

I hope that makes some sort of sense!

Steve

this gets better and better

where is 192.168.2.x coming from? and now another NIC?

-i'd like to setup a VLAN so i can work/test with it
-i can easily setup a second NIC/subnet using another switch, but that wont incorporate a VLAN, so i dont want to go that route.

what i planned on was this:

re0-WAN
re1- VLAN100 10.10.10.x
re2- my regular lan 192.168.1.x

what i wanted to do was then use my hp switch to work with the pfsense box

ports 1-4 would run the 192.168.1.x network and ports 5-8 would be tagged ports on vlan 100. i assumed that doing it this way would allow anything plugged into ports 5-8 would work on the vlan100 network.

later on, if i introduced a second vlan, vlan200 i THOUGHT i would be able to untag ports 7.8 and tag those in vlan 200 to work on another subnet.

apparently i am wrong in how vlans work, but i thought that was the entire point of VLANS… separate networks on the same physical switch.

edit-

are you guys saying that i cant have anything on the default lan tagged with vlan 100 traffic?

do i need to do something like this

default vlan- EEEEEEEE (this would need a 'console PC' so i could login to pfsense on 192.168.1.1 and make changes)
vlan10- TTTTUUUU (ports 1-4 tagged for vlan10)
vlan100-UUUUTTTT (ports 5-8 tagged for vlan100)

or am i still way off?