no devices connected but still traffic on vlan ?

stephenw10

@noplan said in no devices connected but still traffic on vlan ?:

oh boy ... this will be fun

johnpoz

@noplan said in no devices connected but still traffic on vlan ?:

why would they tag VLAN-1 on the uplink port ...

Because like I said they don't actually have a clue to how vlans are suppose to work ;)

Why would you trust a company to do anything correctly that wouldn't allow you to remove vlan 1 from a port? If you were assigning the port to a different vlan?

noplan

@johnpoz

I m crawlin through a lousy lazzy sloppy documentation

With a kind a daisy chain uplink connected switches terminating in 1 port of pfsense

As far as I can see this through

They got some untouched switches somewhere
That are on vlan 1 and r uplinking to this sweet daisy chain of tp Links

Oh yeah fun... On a remote day!!

stephenw10

Mmm, VLAN1 should never be tagged outside a switch IMO. But that is just an opinion, technically vlan 1 is just as valid as any other tag.
It's really only because of misbehaving switches and bad documentation that VLAN 1 needs to be avoided. It still amazes me how many times we see people who think that tagged VLAN1 is the same as untagged.

Steve

noplan

@stephenw10

Yep it doesn't matter if it's tag 1777 or 1
As long as all of the switches know how to deal with it.

The more and more we do this kind of work the more we find that kind of configs

Off topic a couple of days we fond a pfsBox
With Lan rule 1st line allow any2any then followed by 90 other rules ;) sweet?

stephenw10

Was it labelled 'test - must delete' ?

Bonus points if it was on an interface group covering all the other interfaces including WAN!

I've seen things man!

Steve

johnpoz

Yeah you can tag vlan 1 if your equipment supports such a thing.. Its not a common or recommended thing to do... but sure you might have need to do such a thing at some point.

But vlan 1 wouldn't and shouldn't also be untagged - which couldn't happen. There should either be no untagged or native vlans on that port, or it needs to be something other than 1 if your going to tag 1, etc.

JKnott

@stephenw10 said in no devices connected but still traffic on vlan ?:

Mmm, VLAN1 should never be tagged outside a switch IMO. But that is just an opinion, technically vlan 1 is just as valid as any other tag.
It's really only because of misbehaving switches and bad documentation that VLAN 1 needs to be avoided. It still amazes me how many times we see people who think that tagged VLAN1 is the same as untagged.

I have noticed something curious with my Cisco SG 200-08 switch. When using port mirroring, it appears to use VLAN 1 tags on outgoing data from the switch port, but not incoming. It really had me confused, until I figured out where the VLAN tag was coming from. I assume that's an artifact of the port mirroring.

noplan

@johnpoz

none of this equipment here needs or requires a VLAN1

this is ~~afaik~~ what i see here, they use VLAN to seperate offices / teams whatever
with tPLink switches (from 8 tp 16 port and from v1 - v5)

what i see here is that the whole "original" LAN (LAN interface on the pfsBox) leads to ports on the switches as tagged / untagged with VLAN1 (sometimes default setting sometimes confiurated as VLAN1)

so what i m guessing is that these folkes done some things with their equipment and were pretty lazzy as long as it worked and tagged vlan1 all around to get access to the gui of a TPLINK :)

gonna figure this out tomorrow after a nice chat with these hardware / network folks on site ;)

i ll keep u posted when i killed the broadcast caused by VLAN1 on that interface
brNP

stephenw10

@noplan said in no devices connected but still traffic on vlan ?:

what i see here is that the whole "original" LAN (LAN interface on the pfsBox) leads to ports on the switches as tagged / untagged with VLAN1 (sometimes default setting sometimes confiurated as VLAN1)

Mmm, that sounds exactly like the work of someone who didn't understand the difference between tagged vlan1 and untagged.

johnpoz

hehehe - my point exactly.. From the stuff I have seen their entry level do, and responses from their support.. I just don't think they get vlans at a basic concept level even ;)

I would just stay away from that whole line, if what you want is vlan support.. That works as it should.. Not like there are not other options at the same price point.

You throw in equipment that doesn't do vlan correctly, then with people trying to use said equipment that also don't actually understand vlans and you end up with a great big steaming pile of you know what ;)

JKnott

@johnpoz said in no devices connected but still traffic on vlan ?:

I just don't think they get vlans at a basic concept level even ;)

That's the impression I got when I was talking to their "support" people about my AP problem. They didn't understand that a VLAN is supposed to behave as though it was a physically separate LAN. When I talked to 2nd level support, he knew that, but there was still no fix forthcoming, though apparently it has been resolved on later versions.

It's often "fun" trying to get past 1st level support, when it's obvious they're clueless. When I call my ISP, I usually immediately ask to speak to 2nd level, as I know I'd likely be wasting my time with 1st level.

stephenw10

I do also have a TP-Link T1700G-28TQ and have nothing but good things to say about it really. It ticks a lot of boxes. I suspect it came from a completely different design team.

Steve

AKEGEC

Does your TP-Link have a password overflow issue?

JKnott

@AKEGEC

Not that I noticed.

noplan

Same here