Routing Traffic Between Two vLANS

Derelict

This would be:

em1_vlan100 LAN
em1_vlan200 WAN
em1_vlan300 GUEST, DMZ, etc.

VLAN-pfSense.png_thumb

eliteassassin07

your not getting it are you??

you only need tagged on the port going to pfsense.. All of the vlans would be tagged here other than the native vlan, ie your physical interface. be this 1 or 100, or 200 whatever.

All your other ports would be in the 1 vlan you want on that port as untagged.

"VLAN 300,
For this VLAN I “tagged” ports 1 and 9…"

if port 1 is connected then that is fine.. But why do you have it tagged on port 9?? Is that an uplink to another switch?

How is vlan 200 getting to pfsense if its not tagged on port 1??

I feel like something is getting lost in translation here…

For VLAN 300 I tagged port 1 which is the uplink port on the switch and tagged port 9 which is connected to my ESXi host. Port 1 has to be tagged so that pfSenese VLAN Interface can see the traffic correctly. Then on the ESXi host I have configured the virtual switch to VLAN 300 as well... So yes in a since port 9 is connected to another switch.. Probably should not have left that information out.. Sorry

As far s VLAN 200 goes... That VLAN does not need to communicate with pfSense (really I dont want it to communicate with pfSense). The only thing on that VLAN is iSCSI traffic from a FreeNAS Server to an ESXi Host, both of which are connected to the same switch and use statically assigned IPs.

johnpoz

"which is connected to my ESXi host"

Where did this esxi host come from?? Is pfsense running on your esxi host? There was no mention of any esxi host in your first post or 2nd or 3rd..

tagged ports are only used for uplink ports.. Like another switch, a router wth vlans on that interface, an AP that will have vlans on different SSIDs, sure an esxi host that will have vms that will use different tags connect to that same vswitch that physical nic is on..

You only need to tag on ports that are going to carry more than 1 vlan. Because those tags will be used on the device that is uplink to determine where that traffic should flow.

Derelict

Tag ports to devices that need to see the tag. It's that simple. That would be pfSense and ESXi.

If you put an untagged port on VLAN 100 (LAN) and connect a device to it and it gets DHCP, can query DNS, etc your VLAN and switch and pfSense are configured fine and you can concentrate on your ESXi setup.

eliteassassin07

pfSense is running on its own hardware…

"Port 9" is connected to my ESXi Host...

So I think that what you are saying is finally settling in... been ridding the struggle bus here...

I now have it configured as follows...

VLAN 100,
Untagged Ports >> 1-7, 10-11, 13-16 (PVID for these ports set to 100)
Tagged Ports >> NONE

VLAN 200,
Untagged Ports >> 8 and 12 (PVID for these ports set to 200)
Tagged Ports >> NONE, Remember though I dont want this VLAN to connect to pfSense

VLAN 300,
Untagged Port >> 9 (PVID for this port set to 300)
Tagged Port >> 1

So with this set up the only thing that is tagged is Port 1 which is the uplink port.

I believe that this is now correct...

eliteassassin07

@Derelict:

Tag ports to devices that need to see the tag. It's that simple. That would be pfSense and ESXi.

If you put an untagged port on VLAN 100 (LAN) and connect a device to it and it gets DHCP, can query DNS, etc your VLAN and switch and pfSense are configured fine and you can concentrate on your ESXi setup.

Thanks…

Yes... currently anything that I connect to ports 1-7, 10-11, and 13-16 on the switch is receiving DHCP as it should from pfSense.. iSCSI traffic on ports 8 and 12 is working as it should... And the servers connected to port 9 on ESXi are also working.

I made some changes to the way the virtual switch was configured in ESXi so that port tagging was no longer needed except for on the up link port on the switch.

johnpoz

esxi only needs tag if your going to use vms on different vlans, they your going to need multiple tags on that port.. If all your vms are going to be on the same vlan then you don't need tags.. Where is your vmkern is that he same physical nic.

Keep in mind if you want to use vlans on your vms you have to set the vswitch to 4095 so it will pass the tags on to your vms on that vswitch.

eliteassassin07

All of the VMs will be on the same VLAN. :)

VMKern/Management is on its own NIC

Thank you for all of your help…. I am sure this has been as frustrating for you as it has been for me... lol

whosmatt

Hey, off topic i know, but does that 16 port TP-LINK switch have fans?

eliteassassin07

@whosmatt:

Hey, off topic i know, but does that 16 port TP-LINK switch have fans?

No, it is fan-less.

Although it really does not appear to get all of that hot and I am using almost all of the 16 ports on there.

jahonix

@eliteassassin07:

I am sure this has been as frustrating for you as it has been for me…

Is it working now?

eliteassassin07

Yes, it is now working.

Thanks everyone!