Quick VLAN Question
-
No it would be constant, minus whatever other traffic was on the physical interface at the time. The best you could hope for would be half for intervlan traffic.
That has to transverse the same physical path.But only if the traffic is hairpinned.. If you can only carry 1gig, and you have to go over the same road twice ie up and then down, its /2
If traffic is only 1 direction then it would just be shared.. If its hairpin then its /2 minus other traffic on the wire. Keep in mind the /2 is just a approximation.
If you have to travel the same physical path twice then yeah you get a /2… This is the same with wifi.. Since it is shared bandwidth.. If wireless to wireless /2 if on the same band, if wireless to wired then you can get full bandwidth.
-
No it would be constant, minus whatever other traffic was on the physical interface at the time. The best you could hope for would be half for intervlan traffic.
That has to transverse the same physical path.But only if the traffic is hairpinned.. If you can only carry 1gig, and you have to go over the same road twice ie up and then down, its /2
If traffic is only 1 direction then it would just be shared.. If its hairpin then its /2 minus other traffic on the wire. Keep in mind the /2 is just a approximation.
If you have to travel the same physical path twice then yeah you get a /2… This is the same with wifi.. Since it is shared bandwidth.. If wireless to wireless /2 if on the same band, if wireless to wired then you can get full bandwidth.
That makes perfect sense and is how I would expect it to perform. Appreciate all the help.
Did my plan to roll this out sound like the ideal way to do it?
-
You mean that link to some site from 2014?
You can tag everything you want, or you could leave lan as untagged.. There are multiple ways to skin the cat.. If you only have the 1 physical interface adding tagged vlans to it and leaving lan as untagged does allow you to do it all from the lan side and not some other interface - like the wan in that link. Since you won't kick yourself off, etc.
That is clearly an older version of pfsense - but overall how you do vlans has not really changed. Some people like all tagged if doing tagged, I am open to native and tagged on the same interface.. Nothing wrong with either way. If your all tagged then sure you could lock yourself out if traffic is not tagged. Which is why I like to leave a native network on the interface.
-
So my question is, are VLANs inherently private?
They're private because a device configured for one VLAN cannot see traffic on another, even if both are on the same wire.
That is misleading. Yes, the device can see the traffic - it is just selectively-filtered by the local host using the VLAN tag.
However, if you were to run Wireshark, you could see both. The VLAN traffic will have VLAN tags on the Ethernet frames.
You sort of get to it there.
The VLAN traffic will have VLAN tags on the Ethernet frames. Another use would be for guest WiFi, which connects only to the Internet, while internal WiFi has access to the local network. Many access points support multiple VLANs and SSIDs for this purpose.
If you want to use VLANs for security, use a managed switch and only put the VLANs on specific ports that you want the connected device to see.
-
Yes, I know it's not new, but it seemed like a few sites used the same method.
How do you go about the untagged method? Have a link or care to share a quick overview? Seems there are several ways to achieve this and each have different pro/cons. lol
Derelict - I am using a managed Cisco switch I just purchased. As mentioned, the man was to use a trunk port and then create the same VLANs that the pfsense has. Then assign the ports to each VLAN. So that would be the secure method?
-
Yes, I know it's not new, but it seemed like a few sites used the same method.
How do you go about the untagged method? Have a link or care to share a quick overview? Seems there are several ways to achieve this and each have different pro/cons. lol
If the pfSense interface is assigned to, say, igb0 then traffic to the connected device for that interface will be untagged.
If the pfSense interface is assigned to, say, VLAN 100 on igb0 (igb0.100) then traffic to the connected device for that interface will be tagged with VLAN 100.
Derelict - I am using a managed Cisco switch I just purchased. As mentioned, the man was to use a trunk port and then create the same VLANs that the pfsense has. Then assign the ports to each VLAN. So that would be the secure method?
Sounds good.
-
So for example… Here is uplink to my igb2 interface on my sg300 switch
interface gigabitethernet5
description "sg4860 WLan and vlans"
switchport trunk allowed vlan add 3-7
switchport trunk native vlan 2vlan 2 native there is the untagged vlan 2 on my switch which is my "wlan" network. My AP and controller on are on this vlan on the switch... unifi until recently did not allow for tagged management vlans so your IP on your AP had to be untagged. They have recently allowed for tagged management vlan but have not moved over to it yet. And not sure if will since this works just fine in my environment.
-
Right. But if you were to tag VLAN 2 between pfSense and the switch it does not mean it can't be untagged from the switch to the APs if that is what they require.
interface gigabitethernet5
description "sg4860 WLan and vlans"
switchport trunk allowed vlan add 2-7interface gigabitethernet6
description "Unifi AP"
switchport trunk allowed vlan add 3-7
switchport trunk native vlan 2 -
You sort of get to it there.
Hi Derelict.
I was just giving a general idea. We can certainly get into a lot deeper discussion, if you wish.
-
You sort of get to it there.
Hi Derelict.
I was just giving a general idea. We can certainly get into a lot deeper discussion, if you wish.
The question was about isolation and privacy between VLANs. I just want to be sure OP understood that if the VLAN traffic is sent to a device but that device is only configured to grab the traffic for one VLAN it is not in ANY way considered secure since the other traffic is still being sent to that device and it is a simple configuration change on the edge device to see that traffic.
-
Thanks to both of you. I'm going to take a stab at this when I get home and I'll let you know if I have any further questions. Fingers crossed I can get it to work without too many issues (there's always a few) :D
-
"Right. But if you were to tag VLAN 2"
Very very true! And good point to bring up.. I could tag it to pfsense sure - I just keep in the same across the network is all. I know that vlan 2 is a native vlan.. Only place its tagged is on uplink to other switch.
Many ways to skin the cat to be sure.
-
You sort of get to it there.
Hi Derelict.
I was just giving a general idea. We can certainly get into a lot deeper discussion, if you wish.
The question was about isolation and privacy between VLANs. I just want to be sure OP understood that if the VLAN traffic is sent to a device but that device is only configured to grab the traffic for one VLAN it is not in ANY way considered secure since the other traffic is still being sent to that device and it is a simple configuration change on the edge device to see that traffic.
I'm a little loss. So how to I make the VLAN secure so it can't access computers/devices on a separate VLAN? Sorry, all new to this :D
-
Derelicts point was that if you tag say vlan 10,20,30 to port and you connect device to that port then it can see traffic for any of those vlans.
You normally do not trunk or tag multiple vlans to a port where a single device will be connected. So lets say port 10 on your switch where your PC will be connected and you want it only to be in vlan 20. Then you would set that port as untagged vlan 20..
The only traffic a device on that port would be capable of seeing would be vlan 20… if it wants to send traffic to say vlan 30 then it would have to go through your router.
A trunk port with multiple vlans on it would normally only be sent to a device that will understand the tags and keep the traffic isolated, say a router or a switch.
So on your switch say port 1, connected to pfsense you tag 10,20 and 30.
On port 2, you have a device in 10, on port 3 you have vlan 20, on port 4 of this switch you have vlan 30..
On port say 5 you have vlan 10, port 6 vlan 20, port 7 vlan 30..
The only traffic those devices will see are traffic in those specific vlans. For them to talk to other vlans they would have to route through pfsense.
So 2 and 5 can talk, 3 and 6 and ports 4 and 7... if port 2 wanted to talk to port 3 it would have to route through pfsense and pfsense firewall.
-
OOOOH, OK. No, that is not my intent. My intent is to create VLAN 1 and set Cisco to set ports 1-5 to that same Pfsense VLAN #. Then VLAN 2 and set Cisco ports 6-10 to the same VLAN #. That way only those ports are in the same VLAN. I don't care if ports 6-10 see each other, but I don't want them to see 1-5. Will that work as intended?
-
The point is to enforce what VLANs are sent to a device in the switch, not in the edge device.
Just because the device is only looking at one VLAN, it can capture any traffic on any VLAN on the port it is connected to.
Cisco refers to the type of ports you might connect a single edge device to as access ports. They only send traffic for one VLAN and they send and receive frames untagged.
-
The point is to enforce what VLANs are sent to a device in the switch, not in the edge device.
Just because the device is only looking at one VLAN, it can capture any traffic on any VLAN on the port it is connected to.
Cisco refers to the type of ports you might connect a single edge device to as access ports. They only send traffic for one VLAN and they send and receive frames untagged.
EDIT: johnpoz edited his comment to make it clear. It sounds like what I'm trying to achieve and how I understand it. Sorry for the confusion.
I think things will be a bit clearer when I have the Cisco up and running tonight. But It sounds like there will be something in the port/vlan configuration of the Cisco to ensure this. Trunk port accepts all VLANs data and then sends it to the access ports. Those access ports then need to be configured to only accept data that is tagged for it, in a certain VLAN #. Am I close? lol
-
The devices on the access ports don't need to know anything about VLANs. To them it looks like they are connected to any port on any switch - managed or unmanaged. They will only see other devices on the same VLAN.
-
I'm a little loss. So how to I make the VLAN secure so it can't access computers/devices on a separate VLAN? Sorry, all new to this :D
Normally, a device on a network will only see the LAN or VLAN it's configured for and many devices don't even support them at all. This means that while there may be multiple VLANs on the wire, as is the case with a trunk port, a computer will normally be configured to access one. There is, however, one very big exception. It's called promiscuous mode, which enables the computer to receive everything on the wire. PfSense uses this to provide VLANs through 1 interface. Another common use is a network monitoring app called Wireshark, which can see just about everything that can be carried over a network cable. It can even see things like spanning tree, which are normally ignored by network devices.
For security, you'd use managed switches, with access ports configured only for the VLAN you want them to be on. This way, a computer connected to that port will only see traffic for that VLAN and none other.
-
Actually, promiscuous mode is more about getting frames off the wire that have been sent to other, non-broadcast MAC addresses regardless of VLAN… The connected switch will already be filtering most of this in normal circumstances unlike when hubs were a thing and you could see everything.
Promiscuous mode need not be enabled for a pfSense interface to "trunk" VLANs.
