Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VLAN tagging with untagged parent interface

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    16 Posts 8 Posters 4.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • NogBadTheBadN
      NogBadTheBad @johnpoz
      last edited by NogBadTheBad

      @johnpoz said in VLAN tagging with untagged parent interface:

      you can sniff on pfsense with tcpdump directly and the -e to see vlan tags.

      tcpdump -i ix0 -e would do it

      So you can :)

      Andy

      1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        saves a step if all your doing is validating there is traffic being seen tagged and untagged, etc. ;)

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • B
          b82rez
          last edited by

          Thanks for the fast replies!

          Verify trunking on HP:
          <sw001>display vlan 10
          VLAN ID: 10
          VLAN Type: static
          Route Interface: not configured
          Description: VLAN 0010
          Name: VLAN-10
          Tagged Ports:
          Ten-GigabitEthernet1/0/27 <<--- PFsense
          Untagged Ports: none

          Caught the "Reboot to get the VLAN tagging to work" from various google searches, perhaps this is referencing an old release.

          Just to confirm, it's a supported design to run IP ontop of the parent interface whilst tagging like I've done here?

          I'll look at doing the capture also, thanks!

          JeGrJ 1 Reply Last reply Reply Quote 0
          • H
            heper
            last edited by

            If you don't have untagged ports on that vlan, you can't connect dumb clients

            1 Reply Last reply Reply Quote 0
            • JeGrJ
              JeGr LAYER 8 Moderator @b82rez
              last edited by

              @b82rez said in VLAN tagging with untagged parent interface:

              Just to confirm, it’s a supported design to run IP ontop of the parent interface whilst tagging like I’ve done here?

              I'd avoid it in the end to avoid debugging chaos with tagged or untagged traffic on the same interface, but yes it is working and supported. We run it like that at our office location, too. Untagged traffic (vlan1) is the old deprecated server network, all other new networks are using a proper VLAN and are tagged (or using a switch access port in the appropriate VLAN). So yes, that works.

              Don't forget to upvote 👍 those who kindly offered their time and brainpower to help you!

              If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

              NogBadTheBadN 1 Reply Last reply Reply Quote 0
              • NogBadTheBadN
                NogBadTheBad @JeGr
                last edited by

                @jegr said in VLAN tagging with untagged parent interface:

                @b82rez said in VLAN tagging with untagged parent interface:

                Just to confirm, it’s a supported design to run IP ontop of the parent interface whilst tagging like I’ve done here?

                I'd avoid it in the end to avoid debugging chaos with tagged or untagged traffic on the same interface, but yes it is working and supported. We run it like that at our office location, too. Untagged traffic (vlan1) is the old deprecated server network, all other new networks are using a proper VLAN and are tagged (or using a switch access port in the appropriate VLAN). So yes, that works.

                I do it and use it just for my LAN management subnet, switch management addresses, wireless controller & ap YMMV.

                Andy

                1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  Yes I run parent native (untagged) with network 192.168.2 and then vlans on top of that parent interface with different networks .3 and .4 with vlan id 3 and 4, etc.

                  Derelict is sure not a fan of this sort of setup :) But yes it works just fine if you know what your doing and setup your switch ports correctly.

                  Partly this way because unifi AP until recently had to be untagged. And previous had network is place already that used untagged, and adding the vlans to this was easier than just tagging everything, etc.

                  I might get around to changing it - but it works no issue, it is a well supported configuration. It allows for being able to connect a device to that port without having to worry about the device support tags, etc.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by Derelict

                    It has its place. Unifi being one of them. It is always sort of a crap shoot how the connected switch will handle it but if it works it works. It has been a while since I saw a switch that didn't like it. I would still absolutely make the untagged VLAN on the switch something other than VLAN 1.

                    Another nicety is you can directly connect a laptop to the port and get to a network without having to worry about tagging traffic there. Handy for smaller networks.

                    Another consideration is if you run Diagnostics > Packet Capture on the parent interface, you get all traffic for all VLANs with the dot1q tags present on the tagged VLANs. This might or might not be what you want.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • jahonixJ
                      jahonix
                      last edited by

                      I can remember times when it was a no-go to mix tagged and untagged traffic on the same interface. I still cringe when I read about it ... but try to 🤐 at least.

                      JKnottJ 1 Reply Last reply Reply Quote 0
                      • JKnottJ
                        JKnott @jahonix
                        last edited by

                        @jahonix said in VLAN tagging with untagged parent interface:

                        I can remember times when it was a no-go to mix tagged and untagged traffic on the same interface. I still cringe when I read about it ... but try to 🤐 at least.

                        You'll find that's typical when VoIP phones and computers share the same cable. Same with WiF access points and multiple SSIDs.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        JeGrJ jahonixJ 2 Replies Last reply Reply Quote 0
                        • JeGrJ
                          JeGr LAYER 8 Moderator @JKnott
                          last edited by

                          @jknott said in VLAN tagging with untagged parent interface:

                          @jahonix said in VLAN tagging with untagged parent interface:

                          I can remember times when it was a no-go to mix tagged and untagged traffic on the same interface. I still cringe when I read about it ... but try to 🤐 at least.

                          You'll find that's typical when VoIP phones and computers share the same cable. Same with WiF access points and multiple SSIDs.

                          Exactly. One of the corner cases, where other solutions aren't workable (at least not with a single wire solution) ;)

                          But even if client ports are configured that way, one is still a bit cleaner in configuring the upstream port to pfsense as trunk with VLANs only. But that's just IMHO :)

                          Don't forget to upvote 👍 those who kindly offered their time and brainpower to help you!

                          If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                          1 Reply Last reply Reply Quote 0
                          • jahonixJ
                            jahonix @JKnott
                            last edited by

                            @jknott said in VLAN tagging with untagged parent interface:

                            You'll find that's typical when VoIP phones and computers share the same cable.

                            Do I sound as if I needed this explained?
                            Being able to remember the distant past but not 5 minutes ago is called Morbus Alzheimer. My mom suffers from it badly.

                            Same with WiF access points and multiple SSIDs.

                            Buy serious wireless APs with all traffic tagged, not consumer gear on steroids.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.