PfSense managment interface

viragomann

Firewall > NAT > Outbound
By default the outbound NAT is working in automatic mode, so pfSense sets rule automatically for upstream interfaces.
If you add extra rules, set it into the hybrid mode first.

Then add a new rule like this:
interface: OPT1
source: Network 10.3.1.99/24 (or only the MGM PC 10.3.1.99/32)
destination: 10.3.99.11
translation: interface address

That translates the source address in packets destined for the switch into the pfSense OPT1 address and the switch should response to it, since now the request come from inside its subnet.

jahonix

@SR190:

Can i use a virtual IP to trick the switch into thinking that my host is in the same broadcast domain?

Why do you think that's necessary? If the switch has a gateway configured it should work routed, shouldn't it?

edit: err, just read your first post. A dedicated mgmt interface is unlikely to be reachable from the rest of the switch. It's separated for security purposes and usually can only be reached connected directly, no matter how you try to fool it.

On your suggestion viragomann, I have attempted to use a NAT rule to pass the outbound MGMT traffic between the switch and my LAN host. Just to clarify, at the moment I have very permissive FW rules between my LAN and the MGMT VLAN on OPT1, in both directions. I have attached a screenshot of my manual NAT rule that is based on your suggestions.

On a separate note, could I (should I) bridge my LAN interface with OPT1 and assign the NIC on my LAN host to VLAN99 so that the switch sees my NIC as part of the 99 subnet/VLAN? Are bridges generally bad practice? The LAN interface will really be dedicated to MGMT traffic, so I don't need it to be on a separate subnet.

Thanks.

nat-rule.png_thumb

viragomann

If access to the switch doesn't work with that NAT rule you either did something wrong or you won't also get no access from inside the VLAN99 or when you bridge it to LAN.

So take a computer and put it into the MGMT_LAN and try if you can access the switch management interface.
If you get access check if the NAT rule is working. You can use the packet capture from the Diagnostic menu.

BTW: When you bridge the LAN interface with the OPT1, there is still no VLAN on the LAN interface. Only the MGMT_LAN is a VLAN.

Thanks viragomann. Am I missing port definitions for the NAT rule? I wasn't sure what to put in there.

viragomann

No. If the port is not specified the rule is applied to any port.
Is the outbound NAT working in hybrid or manual mode?

Derelict

Zero need for any of that if the switch has a gateway configured on its management interface network.

Presuming it actually works as configured.

NAT is in hybrid mode.

The gateway for the switch is 10.3.99.1 (the interface address for the MGMT LAN).

Interestingly, I have the same MGMT gateway setup for my UAPs and can SSH into them, adopt them etc from the LAN host (with rules of course). The switch in between the pfsense and my UAPs seems deaf to any traffic from my LAN.

I checked my pfsense logs the other day when trying to resolve the switch web address. I noticed some sync closed entries.

Derelict

Sounds like a broken or misconfigured switch then.

Thank you for all of your suggestions.

I figured out what was preventing my host from accessing the switch over VLAN 99. On the setup page are two parameters for management access the switch: a management VLAN and a management port. When the management port is set to anything other than none, management access becomes exclusive to that port.

jahonix

You're talking about HPE 1820 switches?

Yes. It's the HP 1820-24g.