VLANs and PFsense
-
"Dude. I just created 100 VLANs on pfSense 2.2 on a realtek with HW TAGGING through a cisco 3550 to a Cisco 2811 and a Cisco 2610 with 100 VLAN interfaces defined. I can't get it to fail."
Have you tried it with his switch? haha.
-
Netgears are utter shit. Maybe they get better up in the managed, stackable range, but I will never, ever buy another one. Ever.
-
You all are the ones with tunnel view. Pfsense is perfect.
Look at redmine. You will quickly see that is not the case.
Dude. I just created 100 VLANs on pfSense 2.2 on a realtek with HW TAGGING through a cisco 3550 to a Cisco 2811 and a Cisco 2610 with 100 VLAN interfaces defined. I can't get it to fail.
What, exactly, should I try that is failing for you?
Well, what should I try?
-
Here is what I would do:
Try different NICs.
Try different switch.
Try this on a fresh install, of course.
I really do understand that buying new hardware here and there is hard to do so I can understand it may be impractical.
For future builds, always go to the forum, find someone who is doing exactly what you want to do already.
Then find out what hardware he is using and as much as possible, buy exactly that.
Probably cheaper also because usually old used hardware is sold for dirt cheap.
What you are trying to do would probably cost me $60 and a bit of searching around on ebay.
-
I hope to get this Netgate 4 NIC motherboard soon.
I already planned to use 1 NIC for this 50 Mbit/s fibre connection and the other 3 for all these vlans.
This way I will have only 30-ish vlans per NIC.I am of course curious how it handles my current config.
Especially with vlan hardware tagging turned on.I didn't ask for this discussion and blame-gaming.
Someone just defined many vlans on pfsense and said that's working fine.
Hardly any proof. I'm able to define these vlans as well, but I also have interfaces on it that need to be connected to the Internet.
And even then… Is he using the same NICs?I gave up on getting help regarding this issue 3 years ago.
Just came back to this forum that it also was giving a performance issue.
I'm sure a solution will be found one day.Would have liked an option in the webif to turn off vlan hardware, so I didn't need to resort to this cronjob thing.
-
And again…
I have full 50 Mbit/s throughput when I use this Netgear switch tagging and untagging the vlan that's connected to fibre-switch.
I'm not giving this switch a hard job and probably these switches have issues, but it's proving it doesn't have an issue doing this basic job.I have ruled out pfsense in this situation and am getting full performance.
Why should I blame Netgear and not pfsense if turning on/off hardware tagging on the pfsense makes the difference?
-
Throwing new layer 3 gear at the problem when your real issue is at layer 2 is not going to help.
You have an attitude problem. We are perfectly willing to help you figure out where your issue is but YOU insist it's pfSense and vlanhwtag.
That tech is moving so many terabytes and so many millions, if not billions or trillions of dollars every day that it is probably not the case.
It sounds to me like you have a completely hosed switching layer. Perfectly happy to help you straighten it out, but that might involve you admitting to a design mistake or two. Sometimes that happens when a network grows. We've all been there.
I really don't think your problem is vlanhwtag on em(4) and igb(4) NICs.
-
Layer 2 is working as I expect it to.
When I first encountered this problem (3 years ago) I had this Atom board.
The first router suddenly broke down and I replaced it with scrap hardware. That was running like its previous one.I tried to use the working config of this scrap router and couldn't get it to work on this atom-board with 2 Intel NICs.
I did notice it loads the first interfaces quite fast, pauses and then loads the other interfaces at a slower pace.I made a small test setup around that Atom-board and started experimenting.
Turning off vlan hardware tagging turned out to be the key to get that working.I then replaced the scrap router (layer 3 and working) with this Atom based system which worked with that same config (as long as I turn off hw vlan tagging).
It's working for 3 years that way. Replaced the router another time and sold the 2 Atom systems (one was a spare one).
Both these Atom systems work fine, but they only have 4 or 5 vlans.Never got an answer how hardware assisted vlan tagging could make a difference on my layer 2 setup….
-
Perhaps your problem is being imported over and over with this config you keep re-using?
-
Perhaps your problem is being imported over and over with this config you keep re-using?
Yes….
If I receive this Netgate motherboard and it doesn't work out of the box (with the imported config.xml) I will try to make a new setup.
In this setup I can of course replace the Netgear switch with another brand. -
Wow there has been a lot of back and forth since I left the message to look at the switch. First I never meant to say or imply that Netgear switches are not a worthy switch. I just wanted to bring to light that all switches have limitations in both the number of static VLANs they can create and also the number of Tagged VLANs that can have per port. I just wanted to do that bit of home work. If we think back to the basics when you add a tagged vlan to a port you are extending the size of the packet I think 4 Bytes but someone please correct me if I'm wrong here. At some point your equipment will not like the size of the packet and reject it but there are work arounds like reducing the payload size to accommodate the larger header information. Seems to me that you are getting close because if you connect a computer to your switch on a untagged port (No Vlan info in the header) everything is all good. You could try to do a packet capture of the interface and see what's going on at layer 2. You might be at the point in your network size where a multi-layer switch fabric and possible a multi layer routing network would give you better performance. When I first commented last night (I'm in the blizzard of 2015) there were only a few replies but now we are on page three so I don't remember if there was a diagram of your network. Can you please provide a diagram. I would really like to get to the bottom of your issue. Remember that this issue you are having can help many people out if we all just work together to solve it. Just as a side not and performance issue, with that many vlans you may want to think about using a layer-3 switch, I think you said you were using atom grade hardware so your routing performance is not going to be as good as a switch with custom asics doing the same job (Hell a i7 isn't going to do as good a job a layer-3 switch). Also how many users do you have on your LAN? When you have HWtagging on at what point are you seeing a failure (how may vlans).
Again I would like us all the remain civil I know it can get frustrating when we want to help but we are not getting the information that we want. This seems like a interesting issue.
I'm going to go on the record and say Netgear is not shit, there are tools for a job and sometimes the job gets so big you need another tool. Ebay is a great place to get enterprise grade gear really cheap. I got 2 48 port PoE gigabit Broacade Layer-3 switches with a 10GBps Interface (Not included) for $250. I have had the switch for about 6 months now no issues what so ever. before that I got a few HP-Procure 24 port Gigabit switches with a 48Gbps back plane for $200 bucks and went good for me until some caps exploded due to the temp of my commroom 2.5 years later. I replaced them which cost me $.75 and the switch is going strong today.
-
Do my best to duplicate dude's setup with what gear I have on hand and all I get is, "that isn't good enough."
And still utter refusal to answer specific, pointed questions so I can duplicate his environment as closely as possible.
And, yes, the GS108 is shit. I have one. It's no longer on my network. And that's just my house.
-
Test the entire config in a virtual environment.
-
Has OP ever explained how he is tagging through 85 VLANs on a switch that
only supports 64? Looks like his does 128 and the GS724Tv4 does 256. The GS108T only does 64 through. But with careful application it should be doable as long as no more than 64 go out any "core" switchport.I finally got my stupid ProSafe utility running again. Had to spin up a new VM to do it. My GS108PE stops me from tagging VLANs on ports at 32. About to put it inline between pfSense and the 3550.
-
I was unable to attempt to debug this because all I have is good switches…. Layer 8 getting to you again?
-
I can't get it to fail with an re(4) even. Something in dude's environment must be wonky.
I'd examine /conf/config.xml to see if there's anything different about any of the VLANs or interface definitions.
pfSense (192.168.$vlan.3) <-> GS108PE <-> Cisco 3550 <-> 2 Cisco routers with 100 dot1q interfaces each. (192.168.$vlan.[12])
Seems to just work, with the expected limitation that I can only pass VLANs 2 - 32 through the netgear. 33-100 fail.
-
There was no refusal to give specific info.
While I was answering one question 3 others came in and toldWhy oh why are you all so busy putting the blame on my Netgear 724Tv3.
First one says it only supports 64 vlans, then the next tells him how good he so quickly proved I was in error.
I checked the specs and according to specs it does 128 vlans and to be more thorough I added so many vlans that I hit that ceiling of 128 vlans…
While I'm testing this another 3 messages come in telling me what I'm also probably doing wrong...I am not in an ideal situation here. I'm on a small peninsula with almost 100 places I have to provide with Internet.
Before I came the cables were already in place and there were some soho routers at certain places.
I've used that same infrastructure using daisy-chained GS108T netgear switches.
1 building has several 108T switches directly connected to the GS724T and the 2nd building has a GS108T as well with many GS108T's behind it.
This network could have been much cleaner, but given the real world I live in, the amount of money I can spend it's a good network.
Furthermore it's a network that's not built from scratch.I have no reason at all to think there's something wrong with my layer-2 network besides you saying so.
I had a moment with 2 pfsenses. 1 working and 1 not working. The config.xml on the running pfsense was the same as the config.xml of the other. I only did a search/replace to change the realtek card into an Intel card (em0 and em1). I couldn't get the new pfsense system to work until I turned off "hardware vlan tagging". The one with the realtek cards and scrap hardware was working without any problem.If my layer-2 network is so wrong how in earth could turning off vlan hardware tagging fix that. Why don't you give me an answer to that question instead of attacking me like wolves only because I'm asking if you also know of some problem with the Intel NICs I'm using?
-
If my layer-2 network is so wrong how in earth could turning off vlan hardware tagging fix that.
Because it cures an upstream problem of incorrect VLAN tag handling in the switch?
Don't worry, not only Netgear has its problems.
HP switches don't handle IGMPv2 properly in bigger IP-TV systems (approx. 1000 IP HD Cams). In a casino install there were HP switches for about $1M replaced by Cisco even after HP engineers had been on site and couldn't solve it. The system worked immediately with the Ciscos in place.Which version of GS108 switches do you use - there are quite some with very different capabilities!
-
I have GS108T switches after the GS724T switches…
I had only GS108E and don't use that anymore.
The GS108T have an IP and can be managed without a utility...I have both NICs connected to the Netgear GS724Tv3 switch.
I have created 6 VLANs on NIC igb1 (10~15) and about 80 on NIC igb0.On igb1 I have a 10.250.250.1/25 and on igb0 it's 10.250.250.129/25
I don't think it's the best way to do it, but I'm using the 10.250.250.0/25 network to reach all the GS108T's through pfsense.On 10.250.250.10 I have the GS724T configured.
I send VLAN1 to the next building with about 50 VLANs (mostly the LAN interfaces, but also vlan14 which is a NAT adsl router/modem with VoIP server)
That first GS108T will have all these VLANs configured and sends VLAN1 to 2 GS108T's. 1 GS108T has a few vlans, the 2nd GS108T has many vlans and sends these to the next GS108TFrom that GS108T there are several GS108T's in series until it hits 1 GS108T which splits it into 2direction. From this moment on I've already reached a new building...
I have no drawing of this network and I just described only a part of it.Each vlan has a 10.0.x.0/24 interface to it.
If the vlan is 150 then it will get a 10.0.150.0/24 network.I haven't done this now, but 3 years ago when I was faced with this problem for the first time I only used only 1 GS108T on which I only extracted vlan100
In that test situation I was unable to ping my pfsense if I turned off vlan hardware tagging......
It's too complex to describe really,,,
I think it's best to have another go with new hardware.
This new hardware (a Netgate) is something I need anyway. Not to solve this problem (as I already have a solution for it). -
I have GS108T switches…
There are at least GS108Tv1 and GS108Tv2 versions available.
Do you run the latest firmware on all GS108T switches?The interconnect ports are configured as Trunk or as General Port
After reading the manual it seems as if those switches can't be configured with Trunk ports at all. You can only stack tagged PVIDs on a port.
Why would anyone want to massively trunk and daisy-chain them then? :-\Those switches do have VLAN issues which makes it suspicious for others:```
Known issues: Port PVID (Switching > VLAN > Advanced > Port PVID Configuration) does not automatically changed back to 1 after its associated VLAN is deleted.
Workaround: Manually change the PVID back to 1.
Limitations: Combined MAC and IP ACL do not work with double VLAN tagged traffic.
