Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Installing pfSense with a layer 3 switch

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    69 Posts 6 Posters 27.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Neither the Cisco SG nor pfSense has any problems with a /30 netmask. Guaran-effing-teed. You did something wrong.

      And it doesn't matter one bit what netmask you use. All that matters is that there are no hosts on the transit network that you expect to route properly unless you maintain a proper routing table on that host.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • C
        coxhaus
        last edited by

        The net mask does make a difference.  It works with a /24 mask and does not work with /30 mask.  I do not run any clients in my router VLAN.  The idea of the router VLAN is to isolate from the broadcast domain, default VLAN, Windows chatter, etc. I do not want the router waiting for any local traffic not destined for the internet.

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Dude. You did something wrong. No way the Cisco or pfSense has a problem with /30. If it was /31 maybe. /30 no way. Look at your config again.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • C
            coxhaus
            last edited by

            When I have another free evening.  I spent about 5 hours going over everything.  I even reinstalled pfsense.

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              Chasing ghosts. And that was after changing the netmask on both ends from /29 to /30 - no reboots just change and apply.

              ![Screen Shot 2016-01-31 at 4.25.48 PM.png](/public/imported_attachments/1/Screen Shot 2016-01-31 at 4.25.48 PM.png)
              ![Screen Shot 2016-01-31 at 4.25.48 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-01-31 at 4.25.48 PM.png_thumb)
              ![Screen Shot 2016-01-31 at 4.25.38 PM.png](/public/imported_attachments/1/Screen Shot 2016-01-31 at 4.25.38 PM.png)
              ![Screen Shot 2016-01-31 at 4.25.38 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-01-31 at 4.25.38 PM.png_thumb)
              ![Screen Shot 2016-01-31 at 4.27.39 PM.png](/public/imported_attachments/1/Screen Shot 2016-01-31 at 4.27.39 PM.png)
              ![Screen Shot 2016-01-31 at 4.27.39 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-01-31 at 4.27.39 PM.png_thumb)

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • C
                coxhaus
                last edited by

                You need to be changing the LAN side em1 not em0.  This means all your local networks are routed on the LAN side. And you need static routes for all local traffic. I guess it could be an alias.

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  em0 is my LAN side. Neither device has a problem with /30, regardless.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • C
                    coxhaus
                    last edited by

                    Sounds good.  I don't know why they will not link up with /30 mask for me.  It works with a /24 mask so there is not a rush.

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      You can use whatever mask you want for the transit - the point is there can be no clients on the transit or you will end up with problems unless you create host routes on them for the networks in 2 different directions.

                      The fact that you think a /30 is a problem for these devices is beyond nonsense.. As derelict said you did something wrong..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • C
                        coxhaus
                        last edited by

                        @johnpoz:

                        You can use whatever mask you want for the transit - the point is there can be no clients on the transit or you will end up with problems unless you create host routes on them for the networks in 2 different directions.

                        The fact that you think a /30 is a problem for these devices is beyond nonsense.. As derelict said you did something wrong..

                        The /24 mask is more convenient so if you need to change the gateway to the static routes you can plug in a machine and make the change.  With a /30 mask there basically is no access to pfsense if something happens to your routing other than console from what I see.

                        The question about the /30 mask can be answered by you since you have one of these SG300 switches.  Just set it up.  Please post the config on the SG300 and I will compare it to mine.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          Pertinent parts.

                          vlan database
                          vlan 1000,2000

                          ip dhcp server
                          ip dhcp pool network TEST_LAYER3
                          address low 172.28.1.65 high 172.28.1.254 255.255.255.0
                          default-router 172.28.1.1
                          dns-server 192.168.223.1
                          exit

                          interface vlan 1000
                          name TRANSIT
                          ip address 192.168.230.2 255.255.255.252
                          !

                          interface vlan 2000
                          name TEST_LAYER3
                          ip address 172.28.1.1 255.255.255.0
                          !

                          interface gigabitethernet46
                          description ROUTER_LAN
                          switchport mode general
                          switchport general allowed vlan add 1000 tagged
                          switchport general acceptable-frame-type tagged-only
                          !

                          Not a lot to it. On pfSense I just created interface TRANSIT on vlan1000 as 192.168.230.1/30, a gateway for 192.168.230.2, and a static route for 172.28.0.0/16 to the gateway.

                          Then I passed ICMP any source any dest TRANSIT address on the TRANSIT interface. Could ping across in both directions and from a host on vlan 2000.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            @coxhaus:

                            The /24 mask is more convenient so if you need to change the gateway to the static routes you can plug in a machine and make the change.  With a /30 mask there basically is no access to pfsense if something happens to your routing other than console from what I see.

                            That's what management VLANs are for.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • C
                              coxhaus
                              last edited by

                              @Derelict:

                              Pertinent parts.

                              vlan database
                              vlan 1000,2000

                              ip dhcp server
                              ip dhcp pool network TEST_LAYER3
                              address low 172.28.1.65 high 172.28.1.254 255.255.255.0
                              default-router 172.28.1.1
                              dns-server 192.168.223.1
                              exit

                              interface vlan 1000
                              name TRANSIT
                              ip address 192.168.230.2 255.255.255.252
                              !

                              interface vlan 2000
                              name TEST_LAYER3
                              ip address 172.28.1.1 255.255.255.0
                              !

                              interface gigabitethernet46
                              description ROUTER_LAN
                              switchport mode general
                              switchport general allowed vlan add 1000 tagged
                              switchport general acceptable-frame-type tagged-only
                              !

                              Not a lot to it. On pfSense I just created interface TRANSIT on vlan1000 as 192.168.230.1/30, a gateway for 192.168.230.2, and a static route for 172.28.0.0/16 to the gateway.

                              Then I passed ICMP any source any dest TRANSIT address on the TRANSIT interface. Could ping across in both directions and from a host on vlan 2000.

                              I think I have found at least one difference my switch port is defined as an access port. The idea was to keep all the routing on the L3 switch.  The port adds the tags as data comes in and strips tags as data flows out.

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                If you're only doing one VLAN between pfSense and the switch an access port is fine but you can't define the VLANs on pfSense - it has to just be emX, not vlan X on emX.

                                When talking to a managed switch I always tag it even if it's only one so you can add a vlan without screwing up what's already working.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • O
                                  oletuv
                                  last edited by

                                  @Derelict:

                                  Pertinent parts.

                                  vlan database
                                  vlan 1000,2000

                                  ip dhcp server
                                  ip dhcp pool network TEST_LAYER3
                                  address low 172.28.1.65 high 172.28.1.254 255.255.255.0
                                  default-router 172.28.1.1
                                  dns-server 192.168.223.1
                                  exit

                                  interface vlan 1000
                                  name TRANSIT
                                  ip address 192.168.230.2 255.255.255.252
                                  !

                                  interface vlan 2000
                                  name TEST_LAYER3
                                  ip address 172.28.1.1 255.255.255.0
                                  !

                                  interface gigabitethernet46
                                  description ROUTER_LAN
                                  switchport mode general
                                  switchport general allowed vlan add 1000 tagged
                                  switchport general acceptable-frame-type tagged-only
                                  !

                                  Not a lot to it. On pfSense I just created interface TRANSIT on vlan1000 as 192.168.230.1/30, a gateway for 192.168.230.2, and a static route for 172.28.0.0/16 to the gateway.

                                  Then I passed ICMP any source any dest TRANSIT address on the TRANSIT interface. Could ping across in both directions and from a host on vlan 2000.

                                  I´ve followed this discussion with great interest since I have a similar SG300 layer 3 setup as Coxhaus and have just started to look into replacing my Linksys LRT224 router with a pfSense firewall.

                                  When using a transit network for the routing between the switch and the firewall as in your nice example, I guess there must be a separate management interface/IP address used for logging into the pfSense Web GUI?

                                  1 Reply Last reply Reply Quote 0
                                  • O
                                    oletuv
                                    last edited by

                                    @Derelict:

                                    @coxhaus:

                                    The /24 mask is more convenient so if you need to change the gateway to the static routes you can plug in a machine and make the change.  With a /30 mask there basically is no access to pfsense if something happens to your routing other than console from what I see.

                                    That's what management VLANs are for.

                                    I´m totally new to pfSense and am collecting information on how to set it up and administer it. Is the default management VLAN in pfSense VLAN 1 and is the IP address configured for the LAN interface the address of the management VLAN?

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      All interfaces in pfSense are untagged by default, with WAN configured to obtain an address via DHCP and LAN as 192.168.1.1 with an active DHCP server starting at .100. You should really start another thread with a specific question. Doesn't sound like this has much to do with this one.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • O
                                        oletuv
                                        last edited by

                                        @Derelict:

                                        Pertinent parts.

                                        vlan database
                                        vlan 1000,2000

                                        ip dhcp server
                                        ip dhcp pool network TEST_LAYER3
                                        address low 172.28.1.65 high 172.28.1.254 255.255.255.0
                                        default-router 172.28.1.1
                                        dns-server 192.168.223.1
                                        exit

                                        interface vlan 1000
                                        name TRANSIT
                                        ip address 192.168.230.2 255.255.255.252
                                        !

                                        interface vlan 2000
                                        name TEST_LAYER3
                                        ip address 172.28.1.1 255.255.255.0
                                        !

                                        interface gigabitethernet46
                                        description ROUTER_LAN
                                        switchport mode general
                                        switchport general allowed vlan add 1000 tagged
                                        switchport general acceptable-frame-type tagged-only
                                        !

                                        Not a lot to it. On pfSense I just created interface TRANSIT on vlan1000 as 192.168.230.1/30, a gateway for 192.168.230.2, and a static route for 172.28.0.0/16 to the gateway.

                                        Then I passed ICMP any source any dest TRANSIT address on the TRANSIT interface. Could ping across in both directions and from a host on vlan 2000.

                                        Did you define a default route on the L3 switch pointing to 192.168.230.1, or isn´t this necessary?

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          Yes if you want all traffic without a better route to go to 192.168.230.1.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • O
                                            oletuv
                                            last edited by

                                            @Derelict:

                                            All interfaces in pfSense are untagged by default, with WAN configured to obtain an address via DHCP and LAN as 192.168.1.1 with an active DHCP server starting at .100. You should really start another thread with a specific question. Doesn't sound like this has much to do with this one.

                                            Well, Coxhaus asked the same question, how to access/manage the pfSense other than the console when setup with a /30 address and you said "That's what management VLANs are for.".

                                            I take your point and will start a new thread with specific questions when I start setting up pfSense with my SG300 L3 switch.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.