Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No DHCP for VLAN 5

    Scheduled Pinned Locked Moved DHCP and DNS
    53 Posts 4 Posters 8.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GrimetonG
      Grimeton @JKnott
      last edited by

      @JKnott I can tell you from experience that all you've just written is false.

      JKnottJ 1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott @NasKar
        last edited by

        @NasKar

        Four switches is not a problem if they're configured properly. You have a VLAN. I assume you have the VLAN configured on pfSense and any switch that has to pass VLAN frames configured appropriately. At some point, either a switch or in the AP, the VLAN frames are converted to native frames, by removing the VLAN tags. However, given that you're getting an offer after a discover, there is communication between the iPhone and DHCP server, so I doubt VLAN tags are the problem.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        GrimetonG 1 Reply Last reply Reply Quote 0
        • JKnottJ
          JKnott @Grimeton
          last edited by

          @Grimeton

          False in what way? I have viewed the captured traffic in Wireshark and I can see the discover, coming from the iPhone, followed immediately by the offer, coming from the DHCP server. That tells me the phone and server are communicating up to that point. The next step is for the phone to request the offered address, but that's not happening. The question is why. If it was a VLAN issue, we'd see the discover, but not the offer.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          1 Reply Last reply Reply Quote 0
          • GrimetonG
            Grimeton @JKnott
            last edited by Grimeton

            @JKnott This is pointless. I'm not here to measure the size of my dick. I can tell you from experience that switches are the most buggy devices on earth. They leak all kinds of information across VLANs, while other devices like to ignore VLAN-tags in the L2-header based on the moon phase. Especially when it comes to WIFI. There are WIFI devices that forward VLAN-tagged packets and the receiving device just happily ignores them.

            So from my experience it's important to make sure that the configuration is fine, ESPECIALLY when the communication is just lost in a brodcasted setup like this one.

            JKnottJ 1 Reply Last reply Reply Quote 0
            • JKnottJ
              JKnott @Grimeton
              last edited by

              @Grimeton

              Please explain why there's an offer, if the devices are not communicating. If there was a switch failure, there would be no offer, as the server wouldn't have heard from the phone.

              Have you looked at that capture? I have it opened in Wireshark right now.

              PfSense running on Qotom mini PC
              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
              UniFi AC-Lite access point

              I haven't lost my mind. It's around here...somewhere...

              GrimetonG 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                We know that pfsense gets the discover and makes the offer, we have no idea if the phone is getting it.

                You really need to validate that by connecting to the wifi if that is where your having a problem.

                Are you saying these are 4 dumb switches between your AP and pfsense?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • JKnottJ
                  JKnott
                  last edited by

                  I just noticed something curious, though I doubt it has anything to do with the problem. The first frame in the capture is an 802.3 LLC frame, whereas everything to do with IP uses Ethernet ll frames.

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  1 Reply Last reply Reply Quote 0
                  • GrimetonG
                    Grimeton @JKnott
                    last edited by

                    @JKnott The trace is from one end of the problem.

                    The device requests an IP-address and gets handed an offer. If the WIFI-device is forwarding the L2 package with tagged headers the phone might be lost/ignoring it, hence the answer is thrown away.

                    Just one explanation.

                    So please, please, please, with lots of sugar on top of it. Make sure that the VLAN-configuration is fine across all devices.

                    JKnottJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      Exactly!! Where exactly was this sniff taken? On the pfsense vlan interface?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      JKnottJ 1 Reply Last reply Reply Quote 0
                      • JKnottJ
                        JKnott @Grimeton
                        last edited by

                        @Grimeton

                        Again, there is no sign of VLAN tags in the capture, from either end. Also, devices not configured for VLANs should not accept them. For them to do that, it means accepting a frame with the wrong Ethertype. The frames show the Ethertype for IPv4, not VLAN, which means the VLAN tags have been removed before that point.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        GrimetonG 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          If he is sniffing on the vlan interface vs the parent physical he wouldn't see the tags in his sniff.. He would have to sniff on the parent physical interface with -e to see the tags.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • GrimetonG
                            Grimeton @JKnott
                            last edited by

                            @JKnott Depending on WHERE the trace was taken you do not see VLAN-tags because they were filtered out by a lower layer.

                            But above in the description people are talking about VLANs and VLAN5.

                            So we ASSUME that it's 802.1q.

                            JKnottJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              ^ exactly I would for assure assume 802.1q but he prob sniffed on the vlan interface directly... But lets make sure we know exactly where that sniff was taken.

                              And we don't have a sniff from the other end via a wireless client (laptop) connected to that same ssid do we?

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              GrimetonG 1 Reply Last reply Reply Quote 0
                              • JKnottJ
                                JKnott @johnpoz
                                last edited by

                                @johnpoz said in No DHCP for VLAN 5:

                                Exactly!! Where exactly was this sniff taken? On the pfsense vlan interface?

                                If taken there, I'd expect to see VLAN tags, unless the port connects to a managed switch that puts the frame on a VLAN. So, we'd expect VLAN tags somewhere, but we haven't yet determined where they're added & removed. If it's just dumb switches, then we'd see VLAN tags everywhere between pfSense and the AP. However, I believe that capture was taken on the network used for the AP, which is VLAN 5 somewhere, but there are no tags at that point.

                                PfSense running on Qotom mini PC
                                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                UniFi AC-Lite access point

                                I haven't lost my mind. It's around here...somewhere...

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  You wouldn't see the tag if you sniffed in pfsense gui on the vlan.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • GrimetonG
                                    Grimeton @johnpoz
                                    last edited by

                                    @johnpoz

                                    Yeah besides that, tagged L2 packets via WiFi are a a thing on its own. As I wrote before: some devices ignore the tags and take the packet, others ignore the packets completely and so on...

                                    It gets really nasty really quick if this isn't setup correctly.

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      @Grimeton said in No DHCP for VLAN 5:

                                      It gets really nasty really quick if this isn't setup correctly.

                                      Preaching to the choir there my friend ;)

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • JKnottJ
                                        JKnott @Grimeton
                                        last edited by

                                        @Grimeton said in No DHCP for VLAN 5:

                                        So we ASSUME that it's 802.1q.

                                        Again, at what point? Where was that capture taken? Where ever it was, there are no VLAN tags. If you don't believe me, download that capture file and look at it in Wireshark.

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        GrimetonG 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          And again @JKnott if you sniff in the gui in pfsense on the vlan interface - you will not see any tags!

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          JKnottJ 1 Reply Last reply Reply Quote 0
                                          • JKnottJ
                                            JKnott @johnpoz
                                            last edited by

                                            @johnpoz

                                            I think we're arguing the same point. We don't have enough info about the network config and where that capture was made. Did you notice any mention of VLAN tags in what I posted from Wireshark? I even have an extra column configured in Wireshark to display VLAN ID, but don't see anything in that column.

                                            PfSense running on Qotom mini PC
                                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                            UniFi AC-Lite access point

                                            I haven't lost my mind. It's around here...somewhere...

                                            GrimetonG 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.