Routing with L3 switch
-
Yes, it is most likely a routing issue.
Make sure you add your L3 switch (192.168.2.10) as a gateway on the LAN interface
Next add a static routes to 192.168.100.0/24 and select the LAN gateway you just added from the drop-down list.
You might also want to repeat that for 192.168.101.0/24 so that both VLAN 100 and 101 are reachable.
Lastly, make sure you have firewall rules to allow these subnets out. -
I don't see a router-interface on the transit network to pfSense. Pretty sure you need that. What you have looks like it's for management only.
vlan X
untagged eth 1/1/1
router-interface ve1 ip address 192.168.2.10/241/1/1 connected to pfSense . Note that I would tag this on principle and assign transit to vlan X on pfSense. That way you can tag other VLANs to your switch if necessary without mixing tagged and untagged traffic (see brocade dual-mode ports for that).
I would not put the Layer 3 switch on LAN with a bunch of hosts. There should be two things on 192.168.2.0/24 - pfSense and the Switch. No other hosts or you will have asymmetric routing issues which are unnecessary and bad.
-
Derelict,
Nice diagram, very clear! -
There are only 4 important things which you need to get right using a layer 3 switch.
1. Make sure the layer 3 switch uses the LAN interface on pfsense for it's default gateway.
2. With static routes pfsense needs routing statements for all networks on the layer 3 switch pointing to the gateway IP address on the layer 3 switch
3. You need firewall statements on pfsense to allow all the networks on the layer 3 switch out through the firewall on pfsense
4. The PCs on the layer 3 switch need to have the layer 3 switch's network as their default gatewayI think these are the important steps which make a layer 3 switch work with pfsense or any router.
-
5. Don't put any other hosts on LAN with the switch or you will have asymmetric routing issues.
-
5. Don't put any other hosts on LAN with the switch or you will have asymmetric routing issues.
I have heard that before but it works if you let the layer 3 switch handle the local routing. And if you don't believe me try it.
-
It is still asymmetric and it is still bad design. Even if it works for you now it will likely bite you in the ass later.
-
It may be bad design but it happens even in production environments.
-
Bad design is bad design, regardless of scale.
-
I think both agree on bad design.
