Install pfSense on Stormshield SN300
-
I'm back !
I successfully installed the image "pfSense-CE-memstick-2.4.3-RELEASE-amd64.img" with rufus on storage and still have a network port detected
-
I put back the version "pfSense-CE-memstick-2.4.5-RELEASE-p1-amd64.img" however the command "~~" does not work to exit the serial port
-
The escape command is
~~.To escape just the local console session it would be
~.but you are in a session inside that.You really need to be on the current version.
Steve
-
I already tried and it doesn't work
[2.4.5-RELEASE][admin@pfsense-SN300A.home]/root: cu -l cuau1 -s 19200 Stale lock on cuau1 PID=80957... overriding. Connected General Commands: ----------------- Help/?: Get help on a group or a specific command Up : Move one command level up Logout: Exit CLI Command Groups: --------------- System : System settings and reset options IP : IP configuration and Ping Port : Port management MAC : MAC address table VLAN : Virtual LAN PVLAN : Private VLAN Security : Security management STP : Spanning Tree Protocol Aggr : Link Aggregation LACP : Link Aggregation Control Protocol LLDP : Link Layer Discovery Protocol EEE : Energy Efficient Ethernet QoS : Quality of Service Mirror : Port mirroring Config : Load/Save of configuration via TFTP Firmware : Download of firmware via TFTP Loop Protect: Loop Protection IPMC : MLD/IGMP Snooping Debug : Switch debug facilities Type '<group>' to enter command group, e.g. 'port'. Type '<group> ?' to get list of group commands, e.g. 'port ?'. Type '<command> ?' to get help on a command, e.g. 'port mode ?'. Commands may be abbreviated, e.g. 'por co' instead of 'port configuration'. >~~. Invalid command >~~ Invalid command >~. Invalid command -
I said nothing, in copy / paste it works with
~.>~. Invalid command >~ [EOT] [2.4.5-RELEASE][admin@pfsense-SN300A.home]/root: ~. -
Hmm, weird. I will say the terminal only looks for escape characters immediately following a return. I usually hit return a couple of time before ending it to be sure.
Steve
-
I tried to show all interfaces of the SN300 to Pfsense via the
cu -l cuau1 -s 19200and nothing helps.Am I doing it right?
pfSense - Serial: 1530B00379 - Netgate Device ID: 06645fdd1d35deecde91 *** Welcome to pfSense 2.4.5-RELEASE-p1 (amd64) on pfsense-SN300A *** WAN (wan) -> em0 -> v4/DHCP4: 192.168.1.66/24 v6/DHCP6: 2a01:cb19:8f84:c700:20d:b4ff:fe11:6c5c/64 0) Logout (SSH only) 9) pfTop 1) Assign Interfaces 10) Filter Logs 2) Set interface(s) IP address 11) Restart webConfigurator 3) Reset webConfigurator password 12) PHP shell + pfSense tools 4) Reset to factory defaults 13) Update from console 5) Reboot system 14) Disable Secure Shell (sshd) 6) Halt system 15) Restore recent configuration 7) Ping host 16) Restart PHP-FPM 8) Shell Enter an option: 8[2.4.5-RELEASE][admin@pfsense-SN300A.home]/root: cu -l cuau1 -s 19200 ConnectedI have enabled all ports and it is connected to my network through port 1
>port configuration Port Configuration: =================== Port State Mode Flow Control MaxFrame Power Excessive Link ---- -------- ----------- ------------ -------- -------- --------- ---- 1 Enabled Auto Disabled 9600 Disabled Discard 1Gfdx 2 Enabled Auto Disabled 9600 Disabled Discard Down 3 Enabled Auto Disabled 9600 Disabled Discard Down 4 Enabled Auto Disabled 9600 Disabled Discard Down 5 Enabled Auto Disabled 9600 Disabled Discard Down 6 Enabled Auto Disabled 9600 Disabled Discard Down 7 Enabled Auto Disabled 9600 Disabled Discard Down 8 Enabled Auto Disabled 9600 Disabled Discard Down 9 Enabled Auto Disabled 9600 Disabled Discard 1GfdxFor the test, I created one VLAN per interface
VLAN>config VLAN Configuration: =================== Port PVID Frame Type Ingress Filter Tx Tag Port Type ---- ---- ---------- -------------- ---------- ------------- 1 1 Untagged Disabled Untag PVID S-Port 2 2 Untagged Disabled Untag PVID S-Port 3 3 Untagged Disabled Untag PVID S-Port 4 4 Untagged Disabled Untag PVID S-Port 5 5 Untagged Disabled Untag PVID S-Port 6 6 Untagged Disabled Untag PVID S-Port 7 7 Untagged Disabled Untag PVID S-Port 8 8 Untagged Disabled Untag PVID S-Port 9 1 Untagged Disabled Untag PVID S-Port VID VLAN Name Ports ---- -------------------------------- ----- 1 port1 1-9 2 port2 2 3 port3 3 4 port4 4 5 port5 5 6 port6 6 7 port7 7 8 port8 8He only sees me as a network interface, even after a full reboot
-
Did you add the VLANs in pfSense on the internal interface?
Never use VLAN 1.
Here's how I have mine:
>vlan config VLAN Configuration: =================== Port PVID Frame Type Ingress Filter Tx Tag Port Type ---- ---- ---------- -------------- ---------- ------------- 1 101 Untagged Disabled Untag All S-Port 2 102 Untagged Disabled Untag All S-Port 3 103 Untagged Disabled Untag All S-Port 4 103 Untagged Disabled Untag All S-Port 5 104 Untagged Disabled Untag All S-Port 6 104 Untagged Disabled Untag All S-Port 7 104 Untagged Disabled Untag All S-Port 8 104 Untagged Disabled Untag All S-Port 9 104 Untagged Disabled Untag All S-Port 10 104 Untagged Disabled Untag All S-Port 11 105 Untagged Disabled Untag All S-Port 12 105 Untagged Disabled Untag All S-Port 13 None Tagged Disabled Tag All C-Port 14 None Tagged Disabled Tag All C-Port VID VLAN Name Ports ---- -------------------------------- ----- 101 WAN1 1,13,14 102 WAN2 2,13,14 103 LAN1 3,4,13,14 104 LAN2 5-10,13,14 105 WIFI1 11-14 VID VLAN Name Ports ---- -------------------------------- ----- VLAN forbidden table is emptyThough now I'm looking at it 'Untag PVID' would probably be better there. Hmm, been a long while since I configured that....
Ports 13 and 14 are the internal ports in the u250s. I have them as an LACP lagg.
Steve
-
Ok reviewing the untag all doesn't matter since it only untags member VLANs. In my case I don't have any mixed tagged/untagged ports so I could either.
You need to have port 9 a member of all the VLANs so it carries them tagged to pfSense.
The frame type needs to be 'all' since that port is carrying tagged and untagged traffic.
At least port 9 should be set to c-port or unaware so it tags for vlans.
Steve
-
I only have vlan 1 put on the em0 interface in WAN
On the internal interface? em0?
Internal ports? what does it correspond to?
I have port 9, I tried to put port 9 in "Frame Type : Tagged" and I lost control in ssh.
I didn't understand what "S-Port" and "C-Port" were
-
Yes em0 is the internal port, it's connected to port 9 on the switch.
It's frame type has to be 'all' because it's carrying tagged and untagged traffic in your setup.
Then you need to create the vlan interfaces in pfSense on em0.
Soem0.2em0.3etc.Steve
-
I just reviewed my configuration based on what I planned
VLAN>conf VLAN Configuration: =================== Port PVID Frame Type Ingress Filter Tx Tag Port Type ---- ---- ---------- -------------- ---------- ------------- 1 None Tagged Disabled Tag All S-Port 2 None Tagged Disabled Tag All S-Port 3 100 Untagged Disabled Untag PVID S-Port 4 100 Untagged Disabled Untag PVID S-Port 5 100 Untagged Disabled Untag PVID S-Port 6 101 Untagged Disabled Untag PVID S-Port 7 None Tagged Disabled Tag All C-Port 8 None Tagged Disabled Tag All C-Port 9 None Tagged Disabled Tag All C-Port VID VLAN Name Ports ---- -------------------------------- ----- 1 1-9 100 LAN 3-5,7-9 101 DMZ 6-9 832 OrangeDataVoIP 1,2,9 840 OrangeTV 1,2,9 VID VLAN Name Ports ---- -------------------------------- ----- VLAN forbidden table is emptyI just reviewed my configuration according to what I planned
I have :
- ports 1 and 2 in VLAN 832 and 840 for the WAN (in trunk)
Port 1 is the operator WAN
port 2 is a LAN to the operator router WAN- ports 3 to 5 are the LAN - port 6 is for a DMZ (for a server)
- ports 7 and 8 are for a LACP with my manageable switch in trunk
On pfsense, I created VLAN 100, 101, 832 and 840 on em0 and I put em0.100 in WAN port and I connected my local network to one of the LAN ports (vlan 100)
-
Ports 1 and 2 will need to be a C-port or Unaware.
I think S-port is wrong for anything we are doing but on an untagged port it doesn't matter:
https://www.etherwan.com/support/faq/ethernet-switches/what-defines-vlan-trunk-modes-unaware-c-port-s-port-and-s-custom-port
That's probably based on the same switch chip family.That looks correct for LAN. Are you able to connect to pfSense on ports 3, 4 or 5?
Steve
-
I switched ports 1 and 2 to C-port
VLAN>conf VLAN Configuration: =================== Port PVID Frame Type Ingress Filter Tx Tag Port Type ---- ---- ---------- -------------- ---------- ------------- 1 None Tagged Disabled Tag All C-Port 2 None Tagged Disabled Tag All C-Port 3 100 Untagged Disabled Untag PVID S-Port 4 100 Untagged Disabled Untag PVID S-Port 5 100 Untagged Disabled Untag PVID S-Port 6 101 Untagged Disabled Untag PVID S-Port 7 None Tagged Disabled Tag All C-Port 8 None Tagged Disabled Tag All C-Port 9 None Tagged Disabled Tag All C-Port VID VLAN Name Ports ---- -------------------------------- ----- 1 1-9 100 LAN 3-5,7-9 101 DMZ 6-9 832 OrangeDataVoIP 1,2,9 840 OrangeTV 1,2,9 VID VLAN Name Ports ---- -------------------------------- -----I put the em0.100 (LAN) interface in WAN port and I connected my local network to one of the LAN ports (port 3)
To explain what I want to do.
The operator network will arrive on port 1 with VLAN 832 (options 60, 77, 90, 125 must be sent by the DHCP client to obtain an IP) and 840 for television.
On port 2, I send the vlan 832 (with option 90, 119, 120, 125 by DHCP server) and 840 on the WAN port on the operator router.
I retrieve the LAN from the operator router (by disabling the DHCP server to use the pfsense DHCP server) to send it to the pfsense LAN ports (on the Stormshield SN300).
I created a network for myself a DMZ.
There will be NAT on port 1
-
Hmm, OK. Seems complex! I would start simple first.
You were able to connect over VLAN100 to pfSense?
Steve
-
This is why I would have liked to have the Stormshield ports directly seen by pfsense. From what I understand, there is a lack of driver and the driver does not exist.
Yes, I access the pfsense web interface via the vlan 100.
-
It's not so much a lack of a driver as a system design issue. The ports are not connected individually to pfSense, you have to use the switch.
However that may actually be an advantage for what you're doing. Otherwise you'd have to bridge some of the interfaces to get the pass-through to the ISP router.Steve
-
All right,
I will also change the WAN port on em0.832 which will be the final wan port to lie on the em0.100
-
I defined the LAN and WAN interfaces using the interfaces with the vlans
[2.4.5-RELEASE][admin@pfsense-SN300A.home]/: exit exit pfSense - Serial: 1530B00379 - Netgate Device ID: 06645fdd1d35deecde91 *** Welcome to pfSense 2.4.5-RELEASE-p1 (amd64) on pfsense-SN300A *** WAN (wan) -> em0.832 -> LAN (lan) -> em0.100 -> v4: 192.168.1.252/24 DMZ (opt1) -> em0.101 -> v4: 192.168.2.254/24 VLAN_TV (opt2) -> em0.840 ->I found that : http://asmodeus.com.ua/library/os/freebsd/freebsd_interface_em.html
I get stuck at the stage
Собираем это дело: makewith the error
[2.4.5-RELEASE][admin@pfsense-SN300A.home]/root/em-6.9.20/src: make make: "/usr/share/mk/bsd.kmod.mk" line 12: Unable to locate the kernel source tree. Set SYSDIR to override. -
There are no build tools in pfSense, you cannot run 'make'.
But why are you trying to build em? The driver is already loaded.
Those instructions are for an ancient version of FreeBSD anyway.
Steve
-
S stephenw10 referenced this topic on