DHCP Server Setup with a Layer 3 Switch
-
I don't think pfsense can be a dhcp server for a segment it does not have an interface in.. While yes if your moving lots and lots of data between those networks it makes sense to do it that the the switch vs pfsense. But you loose the pfsense great firewall when you have your L3 switch do it.. While some switches have the ability for ACLs etc.. sure not as robust as pfsense.
If you want that sort of setup you need a different dhcp server.
-
I'll do a lot of routing between the two VLAN's.
My pfSense is running on an APU Board. Throughput is approx. 300Mbit, that's why I want to use a my Layer 3 Switch.
Do I get One Gigabit throughput with a SG-2440?
-
So are you running acls on the switch, how many clients - why don't you just put them on 1 segment?
Again if you want to do it that way - pfsense dhcp can not hand out IPs for a scope it does not have a interface in. You will have to use dhcp off your switch or some other dhcp server on one of your segments and then a helper on the switch.
-
Sorry, I'm doing way too few L3 setups to be sure … but I think it could/should work this way:
pfSense1 10.0.10.1/24
switch_1 10.0.10.254/24 gw 10.0.10.1
clients_1 10.0.10.xy/24 gw 10.0.10.254pfSense2 10.0.20.1/24
switch_2 10.0.20.254/24 gw 10.0.20.1
clients_2 10.0.20.xy/24 gw 10.0.20.254Basically, clients get an IP from DHCP req via pfSense since it listens in this broadcast domain.
Clients' gateway is the switches IP which routes internally to other subnet(s) or its own gateway for other destinations.Links to pfSense can be physical or virtual on a trunk and shouldn't matter.
-
That means the switch has to route traffic for the same subnet out the same interface it was received on. Completely unsound. And you'd be gaining nothing. Just set the default gateway to pfSense and turn off Layer 3 in the switch.
Use a DHCP server that can properly handle helper addresses in the switch and answer from the correct scope. ISC is perfectly capable of doing so but not with the config options provided by the pfSense GUI. Windows Server 03/08/12 can do it too.
It's OK if pfSense is not the right tool for some tasks.
-
ISC is perfectly capable of doing so but not with the config options provided by the pfSense GUI.
But if I configure ISC DHCP Server on pfSense over console it should be possible? I'll give it a try :)
-
No. That's not at all what I said. Your config will be clobbered every time you touch DHCP in the webgui , upgrade, etc.
Use a different server for DHCP. pfSense is not the right tool for this job.
-
If you need to route lots of traffic between your 2 vlans - why are you using vlans if your not using acls?
Just put them in 1 network. And if your going to use the switch as L3 then the switch needs the gateways for those segments - with a route pointing towards your pfsense IP in the transit network you had setup. I would either do dhcp off the switch or off dhcp server. Pfsense not meant to be used in this fashion - its not built for it as of yet.
-
Use a DHCP server that can properly handle helper addresses in the switch and answer from the correct scope. ISC is perfectly capable of doing so but not with the config options provided by the pfSense GUI. Windows Server 03/08/12 can do it too.
It's OK if pfSense is not the right tool for some tasks.
The code to provide this has been available and requested to be merged, hmmm… some 18 months ago at least.
https://github.com/pfsense/pfsense/pull/816
https://forum.pfsense.org/index.php?topic=65736.0 -
That means the switch has to route traffic for the same subnet out the same interface it was received on.
Don't think so, no.
-
Yes. When talking about the "same interface" we are talking about the switch's layer 3 interface, not the switch ports themselves..
pfSense1 10.0.10.1/24
switch_1 10.0.10.254/24 gw 10.0.10.1
clients_1 10.0.10.xy/24 gw 10.0.10.254switch receives traffic from 10.0.10.100 on 10.0.10.254/24
switch "routes" traffic from 10.0.10.254 to 10.0.10.1/24 - same subnet, out the same interface it arrived on.client 10.0.10.100 could just as easily have 10.0.10.1 as its default gateway and eliminate the extra in/out hop to/from 10.0.10.254 and all the associated problems (ICMP redirects, etc).
-
… talking about the switch's layer 3 interface, not the switch ports themselves...
absolutely, yes!
Give me two or 3 days, I have to look it up. There was a way to make it possible.
Quite some time ago I called a CCIE friend to solve a routing problem in an install. He came up with a solution quite close to this thread.
I'll be back! ;-) -
For what reason? Just set the hosts' gateways to pfSense.
I'm not saying it's impossible. I'm just saying it's unecessary. Why add the hop and jump though the hoops?
-
Huh, the OP clearly stated he has a transit network.. where would the switch be doing any hair pinning
This is how it wold normally be done - see attached. While its nice that there has been some code for pfsense to be dhcp server for other than its own locally attached networks - that is currently not the case.
-
For what reason?
For the reason that OP needs line speed routing between VLANs and the ALIX surely isn't capable of doing so.
Otherwise it would be easy, wouldn't it? ;-)Huh, the OP clearly stated he has a transit network..
Which I interpreted as his/her way of solving the problem. It's defined with a /30 netmask.
-
You would always use a transit network if your going to have a downstream router.
Solving what problem exactly? There is no problem with using downstream routers.. The problem is pfsense doesn't support dhcp when it doesn't have an interface in that network.
-
I know OP doesn't have any hairpinning. I'm discouraging the suggestion of hairpinning.
I know pfSense's DHCP doesn't support the config, which is why I suggested another DHCP server.
Everyone seems so hell-bent on getting pfSense to do it (including OP with his outside-GUI config of ISC dhcpd) when it's clearly not the right tool for this job (And that's OK. Really.).
-
OK, looked it up. It works the way I described it above. I have this running at one site (without pfSense but that's another story).
You could, of course, setup the network with two segments and a trunk port (or two physical connections if enough interfaces available) to pfSense as done regularly and add a route to the other segment in the host's routing table pointing to this L3 switches gateway. Intra-VLAN routing will be done by the switch, the rest is handled by pfSense in a common way.
Or did I miss anything? -
And why put host routes on all your boxes?? When all you have to do is use a transit network to connect your downstream router to your edge router and your done..
-
Intention was to have pfSense handle DHCP etc to VLAN1 and VLAN2 as well. Cannot be done with one transit network, right?
