Pfsense new install topology
-
You only want to tag ports where you plan on trunking.
For the most part you are going to want untagged ports.
For example, if you plan on setting up the vlans in pfsense for intervlan routing ect… then you would tag the port connecting pfSense.
Or if your APs supports VLANs (and are using that functionality) you would want to tag the port connecting to your AP.
if you are connecting a computer or printer to the port you would want to set that as untagged.
I am planning on trunking (as per original topology digram) in order to connect 3 x switches and pfsense SG-1000 together. I will also probably be planning on "some" intervlan routing although I can live without it for now. The APs are Unifi UAP-LR which "do support" VLAN's but the more I read into them it would appear you're supposed to leave them untagged and just use the VLAN option on their controller software to set the VLAN tagging up (I guess they tag themselves rather than relying on a switch to do so?)
Excuse my ignorance but why wouldn't you want to tag a computer (a printer I understand), especially if I'm planning on being able to access other VLANs from there?
thanks for you help :)
-
"The APs are Unifi UAP-LR which "do support" VLAN's but the more I read into them it would appear you're supposed to leave them untagged and just use the VLAN option on their controller software to set the VLAN tagging up"
You would assign different vlans to your different SSID either via the controller directly or via dynamically assigned vlans and radius, etc.
End devices normally do not need to be tagged, think your confused about how a device in 1 vlan accesses devices in another vlan. To access another vlan from a device in vlan A, the device would go through the router/firewall to access this other network.
Only time you would need to tag vlans to an end device like a printer or a pc would be if you were going to send it traffic from multiple vlans at the same time and it had to sort out what vlan the traffic was in based up on the tag. You do this on a switch, AP, router etc.. Where traffic from multiple vlans is entering the device via an "uplink"..
The management IP on a unifi AP has to be untagged, it can be in any vlan you want but it is untagged. It can place traffic from its different wireless networks (ssid) to different vlans via tagging yes. But its management interface would be on an untagged vlan.
-
thanks johnpoz. Im a little clearer now (I was panicking that i'd have to use VLAN 1 for my AP's which kind of went against what I'm aiming at here!). Just so I'm clear does my topology diagram look ok to you? (albeit removing the vast majority of the "T" tags)
cheers
-
The Ubiquiti devices really like to be managed on the untagged VLAN on the port they are connected to. In fact I'm pretty sure Ubiquitis do not support anything but the untagged VLAN as the management VLAN. Seems like I remember trying it before and the APs kept reverting to untagged. I think the capability to even try to set a management VLAN there has been removed.
That untagged VLAN does NOT have to be VLAN 1, however. It can be whatever you want. Just needs to be untagged (The PVID) on the switch port(s) going to the AP(s). So your management VLAN SSID should be untagged (if you have one) and other SSIDs should be tagged with a VLAN.
ETA: (basically just repeating what johnpoz already said but I'll leave it. derp.)
-
Thanks for all the help so far. I'm aware that I dont want to turn this thread into a Networking 101 session but I promise this is all leading to a good understanding of pfSense and how best to implement it in my network (!)
Ive done another diagram (or 3) attached which shows what I THINK should be the case for tagging and PVIDs on my Netgear switches. I've trunked all of them together on ports 23/24 and 28 (all GBit ports on these) and have tagged ALL VLANs on those ports with NO PVID.
I've then defaulted to using UNTAGGED on the relevant VLAN for each port that has a device on it and also set the PVID to the relevant VLAN for each of these. This may be way off but please be gentle as this is all new to me today!
One question I do have is should I delete the PVID for all the unused ports (they're currently all set to 1 which I dont want)
screenshots attached - if you fancy correcting me, the Google sheets copy is here…https://docs.google.com/spreadsheets/d/1-W4Mb7t5SEu1RDRopeu9z6CAIpEUnBB6azhGiZyO2qg/edit?usp=sharing
-
Your last picture where you have untagged multiple vlans 20, 50 and 60.. that is borked.. You don't run multiple vlans same connection untagged. So device connected to port 1 for example. He would see untagged traffic all three of those vlans..
-
Your last picture where you have untagged multiple vlans 20, 50 and 60.. that is borked.. You don't run multiple vlans same connection untagged. So device connected to port 1 for example. He would see untagged traffic all three of those vlans..
Those ports are used to connect my unifi APs so in theory I need them to access vlans 20 50 and 60? Unless you mean I just leave them on 20 only as 50 and 60 will be managed by the APs themselves?
-
On a switch port that goes to a Unifi AP, you would make the VLAN that you want to use to mange the AP be untagged - those packets will then be sent as ordinary ethernet frames to the AP. Other VLANs that you want to use for carrying the traffic for each WiFi SSID you make tagged. Then the switch sends a tagged ethernet frame for packets in that VLAN. So the Unifi AP can listen for (and send) packets to/from each WiFi SSID from/to the corresponding VLAN.
This was the first thing that came up in my search, and shows what to do:
https://help.ubnt.com/hc/en-us/articles/219654087-UniFi-Using-VLANs-with-UniFi-Wireless-Routing-Switching-Hardware -
^ exactly…
So what "vlan" is the management IP of your AP it, is it 20? Then 20 would be untagged.. And normally that would be the PVID of that port.. Then 50 and 60 would be tagged..
I can never think of any sort of setup where you would run more than 1 vlan untagged on the same port.. Other than maybe a span port that you were sniffing traffic on?
-
^ exactly…
So what "vlan" is the management IP of your AP it, is it 20? Then 20 would be untagged.. And normally that would be the PVID of that port.. Then 50 and 60 would be tagged..
I can never think of any sort of setup where you would run more than 1 vlan untagged on the same port.. Other than maybe a span port that you were sniffing traffic on?
Thanks both,
Yes APs will be managed from vlan20 and there will be SSIds setup on each for access to 30 50 and 60. I've made the necessary changes to the Google spreadsheet (link above) if you wouldn't mind checking? (sorry for asking all this!) -
what did you change - I still see multiple untagged vlans.. on switch 3 on the same port.
-
what did you change - I still see multiple untagged vlans.. on switch 3 on the same port.
not sure why (maybe google drive didnt update?! Anyway, ive attached screens…
-
Netgear switches are complete and utter piles of crap. See those ports (01-06) with both untagged and tagged VLANs on 10.0.10.12? Are those your Ubiquitis?
Try also manually setting the PVID to 20 on those ports. Not having the PVID shown there makes me think that might be your issue.
-
Netgear switches are complete and utter piles of crap.
I would concur!
See those ports (01-06) with both untagged and tagged VLANs on 10.0.10.12? Are those your Ubiquitis?
Try also manually setting the PVID to 20 on those ports. Not having the PVID shown there makes me think that might be your issue.
thanks, will give that a go..
