• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Weird VLAN issue

Scheduled Pinned Locked Moved L2/Switching/VLANs
14 Posts 3 Posters 1.3k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • O
    ortizdr
    last edited by Aug 13, 2019, 6:55 PM

    Hello Everyone!

    I have an issue plaguing one of my VLANs.
    I have blown it out and rebuilt it several times.
    Soo on to the problem...

    I have an XG-7100 with a LAN and 2 VLANS, LAN, VOICE, and GUEST.

    LAN is 10.33.1.1
    VOICE is 10.50.1.1
    GUEST is 10.60.1.1

    Firewall rules are set to allow all.

    LAN can ping GUEST but not VOICE
    GUEST can ping LAN and VOICE

    If i change the VOICE interface from a /24 to a /32 save and apply changes then change it back, LAN can ping VOICE for about 5 seconds before dropping back out.

    It's not a switch issue, I have verified all connectivity thru there.
    I have spun up a test VLAN and ws able to ping it just fine.

    It is literally just the VOICE VLAN I cannot ping.

    Anyone have any ideas??

    Thanks in advanced!

    1 Reply Last reply Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz Aug 13, 2019, 7:31 PM Aug 13, 2019, 7:30 PM

      You can not ping the voice interface IP, or you can ping devices on the voice vlan?

      Can a device on lan ping the voice interface IP 10.50.1.1? And your rules on lan are any any? If not then you have a mask issue most likely.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • O
        ortizdr
        last edited by Aug 13, 2019, 7:38 PM

        That is correct. I can’t ping either the interface ip or any devices on that interface.
        All the interfaces are setup as a /24.

        I can ping the voice interface and associated subnet from all interfaces except The LAN.

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz Aug 13, 2019, 7:40 PM Aug 13, 2019, 7:40 PM

          lets see your full Lan rules, and do you have any rules on your floating tab.. You don't have a gateway set on your lan? Are you policy routing traffic out a gateway, ie do you have vpn setup on pfsense?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • O
            ortizdr
            last edited by Aug 13, 2019, 7:49 PM

            No floating rules.
            No Gateway on the LAN.
            The only thing special I have setup is a Multi-WAN redundant setup.

            Here is a really big kicker,
            I have a site-to-site vpn that can ping the VOICE interface and associated devices.

            LAN.PNG

            1 Reply Last reply Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz Aug 13, 2019, 8:12 PM Aug 13, 2019, 8:11 PM

              Your wan would have nothing to do with pinging the voice..

              your not doing any odd outbound nat? Its just auto? What is the mask on your lan and your voice.. Lets see the output of your routing table

              Also validate the mask on your client.. I Don't really see how that could be an issue then.. lets say you had a /19 then that would end at 63 and you shouldn't be able to ping guest either. And if you had 20 it would be at 47..

              But yeah very odd. But lets validate the setup of the voice and lets see your routing table.. Do you have some odd route sending it elsewhere?

              what are you using on your tunnel network for your site to site - and what are the networks on the other side of the vpn?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • O
                ortizdr
                last edited by Aug 13, 2019, 8:19 PM

                NAT is set at Auto.
                Endpoint for site-to-site is 10.34.1.0/24 connecting to 10.33.1.0/24 and 10.50.1.0/24
                Client is pulling from pFsense DHCP

                Routes.PNG

                1 Reply Last reply Reply Quote 0
                • J
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz Aug 13, 2019, 8:25 PM Aug 13, 2019, 8:22 PM

                  Yeah that all looks fine.. That makes no sense that you can not ping 10.50.1.1 from client on 10.33.1/24

                  When you ping the that IP from a client, you sniff on lan on pfsense - and you see the traffic?

                  You got no port forwards setup?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • O
                    ortizdr
                    last edited by Aug 13, 2019, 8:34 PM

                    Packet capture shows data flowing to pFsense, but nothing coming back.
                    No port forwards.

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by Aug 13, 2019, 8:39 PM

                      That is very odd.. So you see packet to 10.50.1.1 in the packet capture. And nothing in the log that it was blocked?

                      But you can ping 10.60.1.1 from lan just fine?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • O
                        ortizdr
                        last edited by Aug 13, 2019, 8:40 PM

                        Yup, Yup, and Yup!

                        Other then changing the VOICE subnet, i don't know what to do.

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by Aug 13, 2019, 8:42 PM

                          Yeah at loss, lets see if @Derelict or @stephenw10 are around and might have some ideas

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • D
                            Derelict LAYER 8 Netgate
                            last edited by Derelict Aug 13, 2019, 9:01 PM Aug 13, 2019, 8:59 PM

                            I have a site-to-site vpn that can ping the VOICE interface and associated devices.

                            What are the Phase 2 traffic selectors defined there?

                            Anything silly like captive portals?

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • O
                              ortizdr
                              last edited by Aug 13, 2019, 9:06 PM

                              OMG!
                              🤦 🤦 🤦

                              I took a look at the settings for the VOICE Phase 2 and for some reason had the remote subnet setup as my LAN subnet.

                              I can now ping and access from the LAN.

                              Well, I'm a special one!

                              Thanks everyone for your help! Sorry to waste your time!

                              1 Reply Last reply Reply Quote 0
                              7 out of 14
                              • First post
                                7/14
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                This community forum collects and processes your personal information.
                                consent.not_received