Pfsense new install topology
-
Thanks for all the help so far. I'm aware that I dont want to turn this thread into a Networking 101 session but I promise this is all leading to a good understanding of pfSense and how best to implement it in my network (!)
Ive done another diagram (or 3) attached which shows what I THINK should be the case for tagging and PVIDs on my Netgear switches. I've trunked all of them together on ports 23/24 and 28 (all GBit ports on these) and have tagged ALL VLANs on those ports with NO PVID.
I've then defaulted to using UNTAGGED on the relevant VLAN for each port that has a device on it and also set the PVID to the relevant VLAN for each of these. This may be way off but please be gentle as this is all new to me today!
One question I do have is should I delete the PVID for all the unused ports (they're currently all set to 1 which I dont want)
screenshots attached - if you fancy correcting me, the Google sheets copy is here…https://docs.google.com/spreadsheets/d/1-W4Mb7t5SEu1RDRopeu9z6CAIpEUnBB6azhGiZyO2qg/edit?usp=sharing
-
Your last picture where you have untagged multiple vlans 20, 50 and 60.. that is borked.. You don't run multiple vlans same connection untagged. So device connected to port 1 for example. He would see untagged traffic all three of those vlans..
-
Your last picture where you have untagged multiple vlans 20, 50 and 60.. that is borked.. You don't run multiple vlans same connection untagged. So device connected to port 1 for example. He would see untagged traffic all three of those vlans..
Those ports are used to connect my unifi APs so in theory I need them to access vlans 20 50 and 60? Unless you mean I just leave them on 20 only as 50 and 60 will be managed by the APs themselves?
-
On a switch port that goes to a Unifi AP, you would make the VLAN that you want to use to mange the AP be untagged - those packets will then be sent as ordinary ethernet frames to the AP. Other VLANs that you want to use for carrying the traffic for each WiFi SSID you make tagged. Then the switch sends a tagged ethernet frame for packets in that VLAN. So the Unifi AP can listen for (and send) packets to/from each WiFi SSID from/to the corresponding VLAN.
This was the first thing that came up in my search, and shows what to do:
https://help.ubnt.com/hc/en-us/articles/219654087-UniFi-Using-VLANs-with-UniFi-Wireless-Routing-Switching-Hardware -
^ exactly…
So what "vlan" is the management IP of your AP it, is it 20? Then 20 would be untagged.. And normally that would be the PVID of that port.. Then 50 and 60 would be tagged..
I can never think of any sort of setup where you would run more than 1 vlan untagged on the same port.. Other than maybe a span port that you were sniffing traffic on?
-
^ exactly…
So what "vlan" is the management IP of your AP it, is it 20? Then 20 would be untagged.. And normally that would be the PVID of that port.. Then 50 and 60 would be tagged..
I can never think of any sort of setup where you would run more than 1 vlan untagged on the same port.. Other than maybe a span port that you were sniffing traffic on?
Thanks both,
Yes APs will be managed from vlan20 and there will be SSIds setup on each for access to 30 50 and 60. I've made the necessary changes to the Google spreadsheet (link above) if you wouldn't mind checking? (sorry for asking all this!) -
what did you change - I still see multiple untagged vlans.. on switch 3 on the same port.
-
what did you change - I still see multiple untagged vlans.. on switch 3 on the same port.
not sure why (maybe google drive didnt update?! Anyway, ive attached screens…
-
Netgear switches are complete and utter piles of crap. See those ports (01-06) with both untagged and tagged VLANs on 10.0.10.12? Are those your Ubiquitis?
Try also manually setting the PVID to 20 on those ports. Not having the PVID shown there makes me think that might be your issue.
-
Netgear switches are complete and utter piles of crap.
I would concur!
See those ports (01-06) with both untagged and tagged VLANs on 10.0.10.12? Are those your Ubiquitis?
Try also manually setting the PVID to 20 on those ports. Not having the PVID shown there makes me think that might be your issue.
thanks, will give that a go..
