Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    XG-7100 redundant connections to external switches

    Scheduled Pinned Locked Moved Official Netgate® Hardware
    35 Posts 6 Posters 4.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Configuring and additional lagg group in the switch does not create a new lagg in pfSense Interfaces. It's a lagg only between the switch and whatever is on those ports.

      The internal switch can only do load-balance lagg. The Cisco switch must also support that.

      Steve

      dragoangelD 1 Reply Last reply Reply Quote 0
      • dragoangelD
        dragoangel @stephenw10
        last edited by

        @stephenw10 yes I know that only LB can be done. No LACP. But still, when I have default hardware and clean OS/config changing "-" to something like 1 on port and click "save" destroy connectivity. So I don't know... Help pls.

        Latest stable pfSense on 2x XG-7100 and 1x Intel Xeon Server, running mutiWAN, he.net IPv6, pfBlockerNG-devel, HAProxy-devel, Syslog-ng, Zabbix-agent, OpenVPN, IPsec site-to-site, DNS-over-TLS...
        Unifi AP-AC-LR with EAP RADIUS, US-24

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by stephenw10

          Hmm, I see. That was an old config I have on that box.

          Try running at the console after making the change: etherswitchcfg

          That will show the current switch settings. Do you see, for example?:

          laggroup0:
                  members 5,6,9,10
          laggroup1:
                  members 5,6
          

          There I added ports 5 and 6 to lagg group 1 but they have been added to group 0 also.
          If so as a workaround you can set that back to just 9 and 10 using:
          etherswitchcfg laggroup0 members 9,10

          Steve

          dragoangelD 2 Replies Last reply Reply Quote 0
          • dragoangelD
            dragoangel @stephenw10
            last edited by dragoangel

            @stephenw10 ok, thanks. I will try maybe on monday, and will reply. but if I remove 5,6 ports from lagg0 this will be mean that pfSense can't reach them and clients on 5,6 will doesn't reach pfSense. This will be isolated switch, no?
            And if not remove 5,6 from lagg0 before add to lagg1 it will be collizion? That's why my pfSense was sticking previously...

            Latest stable pfSense on 2x XG-7100 and 1x Intel Xeon Server, running mutiWAN, he.net IPv6, pfBlockerNG-devel, HAProxy-devel, Syslog-ng, Zabbix-agent, OpenVPN, IPsec site-to-site, DNS-over-TLS...
            Unifi AP-AC-LR with EAP RADIUS, US-24

            1 Reply Last reply Reply Quote 0
            • dragoangelD
              dragoangel @stephenw10
              last edited by

              @stephenw10 about that you said:

              etherswitchcfg laggroup0 members 9,10

              I see that this is a BIG 🐛 in pfSense Switch WebConfigurator.
              Configuring laggs over shell works fine.
              I created bugreport about it - hope they will fix it soon, before this I will use shell for it 😒

              Latest stable pfSense on 2x XG-7100 and 1x Intel Xeon Server, running mutiWAN, he.net IPv6, pfBlockerNG-devel, HAProxy-devel, Syslog-ng, Zabbix-agent, OpenVPN, IPsec site-to-site, DNS-over-TLS...
              Unifi AP-AC-LR with EAP RADIUS, US-24

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by stephenw10

                It is already fixed in 2.5 snapshots if you're able to try those. It was in fact fixed in 2.4.5 snaps too.

                Steve

                1 Reply Last reply Reply Quote 0
                • dragoangelD
                  dragoangel
                  last edited by dragoangel

                  https://redmine.pfsense.org/issues/9447 :( wasted time. Ok. Thanks. I better wait for Stable release. I'm now on Latest Base 2.4.4_2. There is known date of 2.4.5 or 2.5 release?

                  Latest stable pfSense on 2x XG-7100 and 1x Intel Xeon Server, running mutiWAN, he.net IPv6, pfBlockerNG-devel, HAProxy-devel, Syslog-ng, Zabbix-agent, OpenVPN, IPsec site-to-site, DNS-over-TLS...
                  Unifi AP-AC-LR with EAP RADIUS, US-24

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Not for 2.5 release. I'm not aware of any particular issue with running 2.5 on it currently but things are changing there everyday.

                    You can set that command to run via the shellcmd package if you wish do you don't have to manually run it boot.
                    https://docs.netgate.com/pfsense/en/latest/development/executing-commands-at-boot-time.html

                    Steve

                    dragoangelD 1 Reply Last reply Reply Quote 0
                    • dragoangelD
                      dragoangel @stephenw10
                      last edited by dragoangel

                      @stephenw10 you mean that etherswitchcfg laggroup1 members 5,6 is not permanent? Ok.

                      Latest stable pfSense on 2x XG-7100 and 1x Intel Xeon Server, running mutiWAN, he.net IPv6, pfBlockerNG-devel, HAProxy-devel, Syslog-ng, Zabbix-agent, OpenVPN, IPsec site-to-site, DNS-over-TLS...
                      Unifi AP-AC-LR with EAP RADIUS, US-24

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        The config is actually correct. The bug is how it gets applied to the switch so when you reboot and that gets applied....

                        Let me test that quickly...

                        dragoangelD 1 Reply Last reply Reply Quote 0
                        • dragoangelD
                          dragoangel @stephenw10
                          last edited by dragoangel

                          @stephenw10 yes I test it, on reboot is same as like configuration from Web:
                          laggroup0:
                          members 3,4,5,6,9,10
                          laggroup1:
                          members 3,4
                          laggroup2:
                          members 3,4,5,6
                          I will wait stable release thanks, topic done

                          Latest stable pfSense on 2x XG-7100 and 1x Intel Xeon Server, running mutiWAN, he.net IPv6, pfBlockerNG-devel, HAProxy-devel, Syslog-ng, Zabbix-agent, OpenVPN, IPsec site-to-site, DNS-over-TLS...
                          Unifi AP-AC-LR with EAP RADIUS, US-24

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Sorry I was called away. That does work though:

                            Selection_604.png

                            I'll see if we can get a patch you can apply directly to 2.4.4p2 via the patches package. That would be cleaner.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Ok here's a patch you apply against 2.4.4p2. You can use the system patches package to do it which removes most of the scope for error.

                              Selection_605.png

                              switch_lagg_fix.diff

                              Steve

                              R 1 Reply Last reply Reply Quote 1
                              • R
                                Righter @stephenw10
                                last edited by

                                Hmm I not getting running a trunk. (I have applied the patch above on 2.4.4P2)

                                I have configure on the HPE/Aruba switch side two interfaces:

                                interface 1/45
                                   untagged vlan 1
                                   trunk trk3 trunk
                                
                                interface 1/46
                                   untagged vlan 1
                                   trunk trk3 trunk
                                

                                and this on the PFSense:
                                RIM-002-c.jpg

                                If I connect Eth5 on one of that interfaces it works.
                                If i connect Eth4 also to the switches, it still works but as soon as I unplug Eth5 my connection to the PF is lost.

                                etherswtchcfg seems ok:

                                laggroup0:
                                	members 9,10
                                laggroup1:
                                	members 3,4,5
                                
                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  How is the trunk configured in the HP switch? It must be as load balancing as the 7100 on-board switch is.

                                  Steve

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    Righter
                                    last edited by

                                    Hi I've just created a normal trunk without LACP

                                    trunk e 17/18 trk3 trunk
                                    
                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      And there is no setting for failover, load-balance etc?

                                      What happens if you connect Eth4 first in your current setup? Or just Eth3?

                                      Do you get traffic over the first connected link that then fails when you disconnect it?

                                      Steve

                                      R 1 Reply Last reply Reply Quote 0
                                      • R
                                        Righter @stephenw10
                                        last edited by

                                        @stephenw10
                                        Nope there is only an option if you wish an LACP Trunk or without LACP.
                                        The Trunk and interfaces are always up on the switch and the PF.
                                        But only one interface on the PF is working. Doesn't matter which one I connect first.

                                        If i configure eth 3-5 on the PF in the same LAG, only port 5 is working.
                                        If i configure eth 3-4 on the PF in the same LANG, only port 3 is working.
                                        really strange.

                                        If I ping the firewall i see on the packets counter that the traffic goes and comes from different interfaces in the LAG.

                                        1 Reply Last reply Reply Quote 0
                                        • I
                                          iV1n5
                                          last edited by

                                          Hi all, do you know if the fix is now part of the current version 2.4.4p3? I'd like to configure something similar but I don't want to mess with the terminal. Thanks.

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            The fix allowing additional lagg groups to be added should be in p3 yes. If that's what you're referring to.

                                            Steve

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.