VLAN Help Requested: I Give....diagram & screenshots included
-
@derelict said in VLAN Help Requested: I Give....diagram & screenshots included:
Looks reasonable.
You are tagging all traffic and have nothing assigned to the untagged igb2 interface.
That is fine.
Quick test:
Make an unused port on the switch untagged VLAN 10 PVID VLAN 10. Connect a laptop. Does DHCP and access work? Repeat on the same port for VLANs 20 and 30.
With that out of the way you can move on from the pfSense- to-switch trunk to the Access Point.
You have to determine what VLAN you are using for AP management. Many APs (Ubiquiti) like management traffic to be untagged, with tags on certain wireless networks. That, or you have to specifically set a management VLAN.
I am personally completely unfamiliar with any TP-Link APs and how they do things or what they expect of the management network.
The TP-Link AP has the option for a management VLAN. The default setting is NOT enabled and the default VLAN ID is 1. So it's an option. I have not enabled it.
Set up your described scenario on Port 8. Laptop would connect to "unidentified network" and had no internet. It did not appear in the DHCP Lease table within pfSense.
-
Is there a DHCP server enabled and properly-configured on that VLAN's interface?
You might also want to post the switch config for the port you're testing - to be sure it's correct.
If your AP is expecting untagged management traffic and the untagged VLAN there is 1, I am not sure how you expect that to work since VLAN 1 isn't set to anything on Layer 3 / pfSense.
-
@derelict said in VLAN Help Requested: I Give....diagram & screenshots included:
Is there a DHCP server enabled and properly-configured on that VLAN's interface?
You might also want to post the switch config for the port you're testing - to be sure it's correct.
If your AP is expecting untagged management traffic and the untagged VLAN there is 1, I am not sure how you expect that to work since VLAN 1 isn't set to anything on Layer 3 / pfSense.
-
See screenshot
-
Screenshots
-
I apologize, but I do not follow what you are saying. It's over my head on what you are getting at. I've attached a screenshot of my options here.
Thank you so much for the help!!!
-
-
Forget about the AP until a DHCP client connected to port 8 works.
Concentrate on one VLAN until that works then duplicate for the rest.
Based on what you have posted, the SECURE interface is tagged VLAN 10 out igb2 and patched to port 1 on the switch. DHCP is enabled on SECURE. VLAN 10 is tagged on switch port 1. VLAN 10 is untagged on switch port 8 and a DHCP client device is connected there.
If all that is true, the device on port 8 should get a DHCP address. If it doesn't doublecheck that all of that is still the case.
-
@derelict said in VLAN Help Requested: I Give....diagram & screenshots included:
Forget about the AP until a DHCP client connected to port 8 works.
Concentrate on one VLAN until that works then duplicate for the rest.
Based on what you have posted, the SECURE interface is tagged VLAN 10 out igb2 and patched to port 1 on the switch. DHCP is enabled on SECURE. VLAN 10 is tagged on switch port 1. VLAN 10 is untagged on switch port 8 and a DHCP client device is connected there.
If all that is true, the device on port 8 should get a DHCP address. If it doesn't doublecheck that all of that is still the case.
pfSense is patched to switch on Port 1
SECURE - VLAN 10 on igb2
VLAN 10 is Tagged on Port 1 on switch
VLAN 10 is Untagged on Port 8 on switchWindows 10 laptop connected to Port 8 does not get DHCP address or internet.
-
Packet capture on the VLAN10 interface on pfSense and see what's happening there.
For grins do a full stop and start of the DHCP service on the firewall. I have seen adding VLANs there not be picked up before without a restart though it's been quite some time.
Else it's Layer 2. I would expect what you have done to work but I have never configured one of those ZyXEL switches so there may be some caveats there.
-
you have multiple vlans untagged on port 3-8 ... thats big no no (in almost any situation)
-
A real switch wouldn't allow that.
ZyXELs are generally well thought of. But it might be getting in the way here. Nice catch.
-
lots of 'real' switch i know, allow it.
only thing i've seen that actively prevents it are some dlink & ubiquiti gear
-
SSH@6450-223#sh vlan 223
Total PORT-VLAN entries: 37
Maximum PORT-VLAN entries: 64Legend: [Stk=Stack-Id, S=Slot]
PORT-VLAN 223, Name MAIN_LAN, Priority level0, Spanning tree Off
Untagged Ports: (U1/M1) 2 4 5 6 7 8 11 28
Tagged Ports: (U1/M1) 35 36 41 44
Tagged Ports: (U1/M2) 2 4
Uplink Ports: None
DualMode Ports: (U1/M1) 3 26 43
Mac-Vlan Ports: None
Monitoring: DisabledSSH@6450-223#config t
SSH@6450-223(config)#vlan 224
SSH@6450-223(config-vlan-224)#untagged eth 1/1/11
error - port ethe 1/1/11 are not member of default vlanAdding port 1/1/11 untagged on a second VLAN denied.
SSH@6450-223(config)#vlan 223
SSH@6450-223(config-vlan-223)#no untagged eth 1/1/11
SSH@6450-223(config-vlan-223)#vlan 224
SSH@6450-223(config-vlan-224)#untagged eth 1/1/11
Added untagged port(s) ethe 1/1/11 to port-vlan 224.Remove 1/1/11 from untagged 223 and adding untagged to 224 allowed.
A port on two untagged VLANs is nonsense.
-
I am back trying to solve this problem.
One thing I have noticed on the wireless clients is I can get them to connect to the VLAN ONLY if the interface is selected as the same as my LAN interface.
Example:
LAN is on igb1 (switch is patched to this physical port to port 1 on switch)
VLAN10 set to igb2 = No IP address on wireless device (phone)
VLAN10 set to igb1 = IP address connects and appears in DHCP table correct (192.168.10.100)From there, the phone says "Connected, no internet" which leads me to believe the issue is with the firewall rules. I believe my Pass rule is correct but would like to know if I need to add NAT rules. A recent post in this category had a guy connecting a Ubiquiti AP to an unmanaged switch and he required a NAT rule as well as a firewall rule. I have attempted to duplicate both but cannot make it out to the internet.
As always the help is appreciated.
UPDATE:
Progress. The phone is now on the internet. I had to select the SECURE interface in the DNS Resolver in addition to the already selected LAN & localhost.
I still have the firewall rules but deleted the NAT rules I was trying to make. So I'm still looking for answers there.
ETA: IT WORKS!!!
I chased this all night but it came down to my NAT rules being set to manual due to an older OpenVPN setup. One click on Auto and all devices have internet.
Talk about a nightmare. I'll get to setting up the VPN later.
