Pfsense configuration with Layer3 Switch

johnpoz

It will make it far easier to firewall between the segments that is for sure. If your box running pfsense has multiple physical interfaces you can use uplinks per vlan from your switch vs even having to do tagging. This would eliminate any hairpin traffic for intervlan traffic.

How many physical interfaces does your pfsense box have? How many ports does your switch have open that could be used for uplinks?

You really only see downstream routers come into play when the network grows beyond a certain point, or the need for high speed flow between vlans is more important than security between the vlans.. Or you have so many freaking vlans that is harder to manage them on the firewall at the edge..

I have been doing this for like 30 years.. I deal with complex layer 2 and 3 networks in large DataCenters and customer networks. My switches at home are both layer 3 capable (cisco sg300).. I only use them as layer 2 because my home network has zero need for that sort of layering at layer 3 - pfsense is more than capable of routing between the vlans, and full speeds, etc.

Sonicpat2018

I have a brand new XG-7100U box with 8 interfaces.
The network is about 60 computers and another 50 phones on the wifi.
The businness plan to grow about the double in the next 2 years.
I just wanted to isolate 2 different lan traffic plus the Guest WIFI.
I think as you said that the Pfsense box will pretty easyly handle all the traffic without any speed issue.
I was planning to implement SQID as proxy soon too.

Thanks you very much for your light!

johnpoz

@sonicpat2018 said in Pfsense configuration with Layer3 Switch:

XG-7100U

Are you using the sfp+ ports? Or just port on the switch.

Sonicpat2018

only ports

johnpoz

Do you plan on using them at some time in the future at only 1 gig? I recall some threads I believe where they only work at 10ge.. People had to send their units in, or replace them or something.. Will try to find the thread in question.

But sure your switch ports will be fine as uplinks for your 2 vlans, etc.

Here is atleast 1 of the threads I remember
https://forum.netgate.com/topic/131725/xg-7100-sfp-module-1gbps

gjaltemba

@sonicpat2018
Also need pass rules on lan interface for subnets 192.168.0.0 and 10.0.10.0

Sonicpat2018

Ok now I tried to reconfigure the pfsense from scratch and experiment another problem when I try to assign interface to vlan 2 and 3

The only interface availlable is the Lagg0 wich is the switch for ethernet port 2-8.
I am pretty confused about this setup.
How would I be able to dedicate a single port to a specific vlan without having the ability to choose one?

Thanks

johnpoz

why do you have a lagg setup?

But sure you can assign your vlans to a lag.. Or you can assign your switch ports to different vlans.

Sonicpat2018

The pfsense unit came with this setup by default
Lagg1 for WAN with vlan 4090
Lagg0 for LAN with vlan 4091

I tried to assign the switch ports to different vlan, but i am unable to communicate between vlans.

Does anyone know about documentation on how to configure pfsense hardware with internal switch configuration in vlan?

Thanks

pfSenseTest

@sonicpat2018 said in Pfsense configuration with Layer3 Switch:

The pfsense unit came with this setup by default
Lagg1 for WAN with vlan 4090
Lagg0 for LAN with vlan 4091

This is incorrect according to the documentation...
https://www.netgate.com/docs/pfsense/solutions/xg-7100/switch-overview.html

Sonicpat2018

Sorry you arre right, configuration reflecting LAGG0 with different vlan for WAn and LAN.

But the point is that with vlan configured other than default one EX: Vlan 3 : 10.0.10.0 /24 I am not able to ping the gateway in this vlan.

I configured the Vlan 3 by tagging port 9 and 10 in the menu:
interfaces / switch / Vlans
And add port 4, untaggged as it is the port I plan to use for this network.

But I am still unable to ping the gateway in the vlan3

Sonicpat2018

Now everything is working correctly on the pfsense for Vlan routing.
It was firewall issues.
I am facing a problem where I am unable to isolate vlan on particular port on the ubiquiti Switch.
Vlan are isolating well on the Pfesense interface but I am unable to tag ports on the Edgeswitch.
Does anyone have exemple of a working setup with a pfsense Vlan routing and a Ubiquiti Edgeswitch only in vlan aware mode?

Thanks

Derelict

What does UBNT mean when they say "VLAN aware" mode.

Tag the VLANs on a port on the XG-7100 switch.

Tag the VLANs on a port on the UBNT switch.

Cross-connect them.