Newb questions - switches managed and unmanaged
-
In other words, undefined behavior by the spec with arbitrary implementation and tested by manufacturers.
What is defined is switches pass valid Ethernet frames and VLAN tagged frames are still valid Ethernet frames. For a switch to pass a frame, it requires source & destination MACs and a valid CRC. If it has those, the frame is valid and passed, no matter what's between the source MAC and CRC.
What is also defined is devices not configured for a VLAN ignore any VLAN frames.
Unless you examine the Ethertype field, you can't tell whether it's a VLAN frame or not.
Managed switches can look at the VLAN tag and take appropriate action. Unmanaged switches just pass it on as usual.
Here's a list of Ethertype values that could be found after the source MAC. And with 802.3, there could be any number, up to 1500. It makes no difference to a switch. It just passes the valid frames.
https://en.wikipedia.org/wiki/EtherType#ExamplesOn a modern LAN, you're likely to see 0x0800 for IPv4, 0x86DD for IPv6 and 0x9100 for VLAN tags. You may also see 802.3 frames for spanning tree.
-
All great.. You still have the issue with every single broadcast/multicast frame going out over every single port… I showed you this in that other thread were you yet again suggest someone just use dumb switch for their vlans!
This is some of the WORSE freaking advice anyone could possible give!! Especially to people that are not up to speed on vlans.. I am just flabbergasted why someone with any networking understanding at all would ever suggest such a thing.. If you needed to use the dumb switch to be a repeater for a long run or something on your trunk uplink.. Ok do in a pinch, etc. But that you actually suggest users do this for their setup is just beyond me..
I just ordered different "smart" switch to replace that tp-link I got to play with.. Cost me a whole $35 bucks.. wow what a bank breaker for a 8 port gig switch - that actually understands vlans.. And this one allows you to remove vlan 1 from the ports its not suppose to be on ;)
-
Johnpoz. Please understand that I am not advocating managed switches not be used. In fact, I encourage their use. I'm just trying to point out some of the fallacies that exist, such as your claim that an unmanaged switch wouldn't know where to forward a VLAN frame. As far a receiving all those broadcasts, that would only happen if a device is configured to receive the VLAN. In this case, it's no worse than other unwanted broadcasts. If you have VLANs, there will be essentially the same amount of traffic on the network, including on trunks and going through switches etc. The only difference is that with a managed switch, the devices on access ports won't see anything from other VLANs. That's it. Now, with VLANs, you have some control over which switches receive the frames and what access ports pass it, but other than a bit of wasted bandwidth, unwanted VLAN frames will not harm network devices not configured for the VLAN, because they simply ignore those frames. Also, with the move to IPv6, broadcasts will disappear and the multicasts that replace them can be far more selective.
I bet after this discussion, you now know your ideas about the switch not knowing how to forward a VLAN frame were wrong and people here have a better understanding of Ethernet, VLANs etc. There's nothing magical about VLAN frames. They're just another Ethernet frame and passed as usual by switches.
BTW, I currently have a Cisco SD216 unmanaged, 100 Mb switch on my home network. I am considering replacing it with a Cisco managed gigabit switch, to pick up some of the features a managed switch provides (I use port mirroring a lot!). In the mean time, VLANs work just fine with the current, unmanaged switch. As I mentioned a while ago, in another thread, I experiment with things on my network and this is how I know VLANs do not have a problem with unmanaged switches. Instead of just taking a position, I verify it by trying and using Wireshark to see what's actually happening. I also do a lot of research, including that Ethernet book I mentioned.
-
And my position is taken from experience with unmanaged devices that DID NOT properly forward dot1q frames. You do realize it changes the maximum frame size from 1518 to 1522 bytes I assume? You must acknowledge that there might be some devices out there that get confused by that and drop your perfectly valid dot1q frames because they were not designed to deal with them.
It has been said time and time again that it might work and might not.
Though I em extremely glad it works for you in your environment with your gear, It is still lousy design practice and lousy advice.
 -
You do realize it changes the maximum frame size from 1518 to 1522 bytes I assume?
Yes, and I did mention older equipment may have problems. However, the spec has been updated over the years to allow larger frame to accommodate VLAN tags. Also, as I mentioned, a lot of equipment can now handle jumbo frames, which can be 9KB or more, a lot bigger than a VLAN frame.
-
Here's a bit more info:
"802.3ac 1998 Max frame size extended to 1522 bytes (to allow "Q-tag") The Q-tag includes 802.1Q VLAN information and 802.1p priority information."
from https://en.wikipedia.org/wiki/IEEE_802.3The 802.3ac spec, which extends the frame size to 1522 bytes was set in 1998. That's 19 years ago and a lot of equipment and been made, sold and scrapped in that time. Back around then, switches and 100 Mb were just starting to become popular and I bought an 8 port 10 Mb hub that cost then, more than twice what I paid for a 5 port managed gigabit switch last year.
-
I had a brand new, stupid, powerline adapter that would not pass 1522 and that was a lot more recent than 1998.
Still lousy advice.
Just stop. You lose. It might or might not work.
-
"I bet after this discussion, you now know your ideas about the switch not knowing how to forward a VLAN frame were wrong"
No not really, as have stated in every one of these threads… And there have been WAY too many of them when you bring it up.. That it might or might not work, etc. I have some old 10/100 switches for just drop them.. Been doing this for year and years - before there were even switches ;) To be honest many days it seems like yesterday was adding co processors to 486 machines and installing tcp/ip on the 3.1 windows they were running. Building still had thicknet in areas.. Remember the coax T connectors..
And can tell for FACT that many switches back a few years, latter than 1998 that is for sure!! would drop them.. Why should a "dumb" switch support Q-tag, etc..
I am with Derelict - if you want to discuss different hardware and the max frame size it will pass - great.. I have some older switches on the shelf I could fire up, etc. And we could test them.. But please do not bring up such HORRIBLE HORRIBLE advice to someone asking about vlans.. And even suggest to them that they can just use a dumb switch, etc. It FUD to be honest that your spreading.. And users are like parrots... They really do not understand a debate about "if" something can work, etc.. All they get out of is I heard on pfsense that I don't need smart switch to use vlans.. And such FUD spreads and spreads!
To be honest: Mods should go into every single thread where you have suggested such nonsense and put in a BIG RED NOTE stating this not valid advice - do not do this!! This is BAD!!
-
Hope this guy does not secure Networks for a living ;)
-
Do you guys realized the OP never even asked about VLANs? His question was whether pfSense requires managed switches. The answer is "no."
-
"One NIC" means VLANs. And even more of a case against an unmanaged switch. Unless one should put both their inside and outside traffic on the same broadcast domain. What could go wrong?
-
"One NIC" means VLANs. And even more of a case against an unmanaged switch. Unless one should put both their inside and outside traffic on the same broadcast domain. What could go wrong?
He says he has 3 NICs: WAN, LAN, OPT1 ergo VLANs are not required.
-
"I bet after this discussion, you now know your ideas about the switch not knowing how to forward a VLAN frame were wrong"
No not really, as have stated in every one of these threads… And there have been WAY too many of them when you bring it up.
In another thread, you had stated that an unmanaged switch would not know how to forward VLAN traffic and would have to broadcast out all ports. This would imply that the switch could not see the MAC addresses. With a VLAN frame, there is absolutely no difference with the MAC addresses. This article shows how the VLAN tag is inserted in an Ethernet frame:
https://en.wikipedia.org/wiki/IEEE_802.1Q#Frame_formatNotice that the MACs are unchanged and the original Ethertype field is replaced with the VLAN Ethertype and the original Ethertype field is pushed back 4 bytes. After the VLAN tag is stripped of, that Ethertype field will be right back where it always was. If you think the VLAN tag interferes with the MAC, please explain how.
-
All great.. You still have the issue with every single broadcast/multicast frame going out over every single port… I showed you this in that other thread were you yet again suggest someone just use dumb switch for their vlans!
I'm going to give an example that I've come across at a couple of customers. Please note this configuration came from their hosted VoIP provider and is not the way I would have done things. These customers have 2 ADSL modems, one for regular Internet access and one for VoIP only. Both modems are connected to the same unmanaged switch, with the Internet modem configured on 1 subnet & with DHCP. The VoIP modem is on a 2nd subnet, with no DHCP. The phones are configured with a static address. Users can plug their computers into the back of their phones. So, on 1 network, there are 2 subnets, with completely independent traffic. Both have their broadcasts too. So, all devices see all the broadcast, whether on their "network" or not. As per usual, the broadcasts are received and handle when appropriate or discarded. Everything works fine, at least until the phone company (ADSL provider) tech shows up and breaks things. How do all these broadcasts make any difference with the same customer, but using VLANs too? At least with VLANs the broadcasts from the other network won't make it as far as the IP stack, unlike the current situation, where all broadcasts are received by all devices, no matter which subnet they're on.
Regardless, my original point was that unmanaged can switches pass VLAN frames just fine. They just can't do anything with them, such as assign an access port to them. I don't recall if it was you or someone else that questioned why someone would include larger frames in an unmanaged switch. The way the IEEE works is they occasionally update the spec. I believe the latest for Ethernet is 802.3-2015, indicating it was released in 2015. What they do with these updates is roll all the various changes into the new spec. So I expect the larger 1522 byte frame is now part of the spec, which manufactures are supposed to use. Also, many devices now support jumbo frames which are generally around 9K and so wouldn't have any problem with the larger VLAN or double¹ VLAN frames.
https://en.wikipedia.org/wiki/Jumbo_frame1. And yes, I have worked with double VLAN over fibre. The first VLAN tag is used by the carrier and the 2nd is available to the customer.
-
As doktornotor likes to say, this thread is starting to stink.
