What is best way to run 300 VLAN on network using PFSense.
-
i have yet to an AP controller that handles 300vlans without issues ;)
-
300 SSIDs might be an issue but I don't see a problem with 300 VLANs with dynamic VLAN assignment.
-
If what your looking to do is isolate the wifi users from each other, pretty much any soho wifi does ap/client isolation.. Cisco calls it what Public Secure Packet forwarding or peer-to-peer blocking mode, etc..
So what exactly is the requirement here.. You have 300+ wifi users? Is wired in use as well? what are you using to dynamically assign the vlans? What AP are in play?
If pfsense sense has issue with 300 some vlans in the gui, there are always plenty of ways to skin the cat - but have to know the breed of cat to best skin it ;)
-
Hi everyone,
Some great replies. I must have not ticked the box about getting notification when someone replies. I will try to answer some of the questions below.
"Have you tried it? If not I would."
We did try something previously, however I think it was for 600 VLANs which made load up times immense and GUI unresponsive - and if you used Console to look at interfaces…wow that was difficult...we scrapped that config. I want to get some ideas here first and we will try and see what works."Could you not configure some form of wireless isolation on the APs to prevent users accessing each other rather than trying to do it with VLANs?"
Yep, been there, done that. However, this is beyond that - We now want to create small groups (via VLAN) for multiple devices in a group (account)."I have yet to see APs that understand private VLANs"
There are many on the market that recognise VLAN's, we have one network using 5 VLANs so definitely can say our APs can (and using PFSense)."i have yet to an AP controller that handles 300vlans without issues"
Good Point. I don't think this will be an issue as it is not the AP Controller handling the VLAN's (dynamically assigned by our servers ==> AP controller ==> AP). The AP is told which VLAN to place traffic and Switch and PFsense look after the rest. Problem is we have never been able to get to this part of testing due to failing at the first hurdle (PFSense), Not sure this is an issue though. I will let you know if we ever manage to get there."If what your looking to do is isolate the wifi users from each other"
No, we want to isolate groups from each other (One Account with multiple devices in each Account)
Why? because we have to for security and data protection. It also helps us to manage the network better."300 SSIDs might be an issue but I don't see a problem with 300 VLANs with dynamic VLAN assignment."
You are correct about the Dynamic VLAN. Only two SSID's, traffic over separated VLAN's"your looking to do is isolate the WiFi users from each other"
No. Definitely 300 'Groups'. Groups are to be isolated from each other, hence the VLANs"So what exactly is the requirement here.. You have 300+ wifi users? Is wired in use as well? what are you using to dynamically assign the vlans? What AP are in play?"
We need to create +300 VLANS to containerise (is there such a word?) traffic of +300 groups (accounts). And the groups MUST be separated. We have tried , and still use isolation, but isolation at AP no longer fits our customers (many customers) requirements. AP's can Dynamic VLAN no issue there and our servers allocate the Dynamic VLAN (not the AP controllers). PFSense would be used to filter and route traffic out + assign IP's within VLANs."If pfsense sense has issue with 300 some vlans in the gui, there are always plenty of ways to skin the cat"
Keen to learn more my friend!I hope I got everything.
To highlight the key points - isolation not an option (plus we already use this). VLANs a definite requirement moving forward. No it is not 300 devices, but groups. Yes, each groups data needs to be separated from each group, but not WITHIN each group.
If we contributed to its development, could GUI be 'fixed', is it fixable, it might not be? What other way could we configure/manage the PFSense to get around this issue?
Thanks
Roofus
-
"I have yet to see APs that understand private VLANs"
There are many on the market that recognise VLAN's, we have one network using 5 VLANs so definitely can say our APs can (and using PFSense).Private VLANs are different. Google isolated community promiscuous private vlan
"300 SSIDs might be an issue but I don't see a problem with 300 VLANs with dynamic VLAN assignment."
You are correct about the Dynamic VLAN. Only two SSID's, traffic over separated VLAN'sYeah that's not a problem. I have never used it. Do the APs intelligently broadcast traffic among users of the same dynamic VLAN and isolate from others? I would guess they do or it would be useless but I've never tested it. What are you using? Ruckus, Aruba, Cisco or ?
-
Hi.
Not private VLAN, although that would have been interesting.
We have networks with different AP hardware. However, the Ruckus will probably be our test bed.
Roofus
-
If I had a layer 3 switch available (and it sound like you do), I'd use it to handle the VLANs. Put the pfsense inside interface on its own VLAN/subnet and let the layer 3 switch route between the VLANs and pfsens. Use ACLs on the switch to keep the various subnets from talking to each other.
-
Gomez
That is certainly an option to consider and with some appeal - It would help simplify the firewall rules etc. Currently we are using Layer 2 switches that support POE + VLAN, so this would be an addition of around £1,000. Cheaper if we could get PFSense to do it :)I do like the idea that a small Layer 3 switch feed multiple Layer 2 switches that span to the different AP units.
Where would the DHCP come from in this instance as I assume PFSense would not be able to fulfill this role in this case?
Roofus
-
You should be able to put helper IP addresses (cisco terminology) on the VLAN interfaces in the layer 3 switch that forward DHCP requests to the pfsense box. I assume pfsense could be configured with a scope for each subnet. I've never tried that with pfsense, though.
-
Since you have virtualization available, you might also consider using a virtual router to take the place of the layer 3 switch. I've never used anything other than Cisco routers, so I can't offer specific details, but I'd think it wouldn't be too difficult to create a virtual linux instance, trunk all 300 VLANs to it, set up routing in linux and use iptables for the ACLs.
I seem to recall that someone has a linux distribution specifically created to be a router.
-
You should be able to put helper IP addresses (cisco terminology) on the VLAN interfaces in the layer 3 switch that forward DHCP requests to the pfsense box. I assume pfsense could be configured with a scope for each subnet. I've never tried that with pfsense, though.
Multiple scopes are not supported.
-
Most L3 switches would support DHCP, you can also set a separate small Linux box to run dhcpd and then "ip helper" each VLAN to that IP.
-
If pfsense DHCP won't do multiple scopes, then you need something that will. It sounds like you need either a layer 3 switch that does DHCP, or a virtual router to do your layer 3 routing and hand out IP addresses.
Even if pfsense could be fixed to handle 300 VLANs, you still need something to run DHCP with a scope for each VLAN/subnet.
-
pfSense will do multiple scopes just fine. It just can't be configured to accept helper requests from multiple subnets on one interface.
-
pfSense will do multiple scopes just fine. It just can't be configured to accept helper requests from multiple subnets on one interface.
Well that's just silly.
