Can VLANs on a Cisco AP work with PFSense?

Dave R2 · Dec 16, 2020, 5:45 PM

On my (home) Pfsense firewall, I have port 80 and 443 traffic routed to a VPN provider. Some services (like Etsy) make it a real PITA to use with a VPN. Naturally, people get upset that they can't get to Etsy.

I've tried a few things but they end up sucking air. Is it possible to setup a Cisco 3702 AP with two SSIDs, with two separate VLANs, and then tell Pfsense that stuff on (for instance) vlan_100 should bypass the VPN completely and everything else (on vlan_200) would just be routed over the VPN as usual? I have an HP 2560 switch (does VLANs) that the 3702 (and pfsense) would be jacked into.

My Cisco knowledge is thin. I'm not sure where to start on this but I do have a 3702 sitting here for a wifi upgrade anyway so thinking wth.

NogBadTheBad · Dec 16, 2020, 1:39 PM

Depends exactly what the model is, is it a standalone AP or does it require a wireless controller?

It's been ages since I've touched a standalone Cisco AP, it should just be a matter of configuring ethernet0, ethernet0.100, ethernet0.200 and then associate the dot11radio interfaces.

Then have the uplink pass the native, 100 & 200 vlans.

https://www.cisco.com/c/en/us/td/docs/wireless/access_point/15-3-3/configuration/guide/cg15-3-3.html

You may be better configuring it via the web interface.

https://www.youtube.com/watch?v=krSDfvRbWX0

Dave R2 · Dec 16, 2020, 2:23 PM

@nogbadthebad Standalone. The AP is model AIR-AP3702I-UXK9 running ap3g2-k9w7-xx.153-3.JA4 firmware.

Thanks for the link. I found that video over the weekend and started following along at the CLI. Just wasn't sure this would all work with PFSense. Also, a warning to anyone who hasn't watched this video -- the volume of the terminal bell is 11 while his mic is at 5.

Maybe I can skip around the video and get more out of. If the VLAN traffic is compatible then I'll keep going.

johnpoz · Dec 16, 2020, 2:28 PM

vlans are vlans are vlans.. Anything that supports vlans should work with any other device that supports vlans..

Its a standard.. unless you were doing something with cisco proprietary vlan stuff - say VTP then there should be any problems. Or their ISL..

bingo600 · Dec 16, 2020, 2:52 PM

I'm running 6 SSID's of several Cisco AP's (Non CAPWAP)

/Bingo

stephenw10 · Dec 16, 2020, 2:59 PM

Yes, this should absolutely be possible.

And in fact you will probably get much better results if you route everything over the VPN from one SSID and nothing on the other. All or nothing will break far fewer things.

Steve

Dave R2 · Dec 16, 2020, 3:01 PM

@stephenw10 I'll give it a whirl then. Thanks everyone!

NogBadTheBad · Dec 16, 2020, 3:44 PM

@dave-r2

I'd be tempted to test it on an unused pfSense interface if you have one, then move the ap to the HP switch once its working, if you have a spare one and a poe injector.

JKnott · Dec 16, 2020, 5:45 PM

@dave-r2

Think of VLANs as physically separate interfaces and ask your question again. If the answer is yes, then it will still be yes with VLANs. All you have to do is match VLAN IDs. Incidentally, here I have pfsense connected to a Cisco switch, connected to a Unifi AP and have a guest WiFi connected via VLAN. I just made sure that they all were configured for the same VLAN ID.

BTW, if you have 2 SSIDs, you'd normally have 1 VLAN and the main LAN, unless you have specific reasons for not putting your main WiFi on the main LAN.

Dave R2 · Dec 16, 2020, 6:41 PM

@nogbadthebad said in Can VLANs on a Cisco AP work with PFSense?:

I'd be tempted to test it on an unused pfSense interface if you have one

@nogbadthebad That's a great idea. If I run into snags which the HP switch I'll keep this in mind.

Dave R2 · Dec 16, 2020, 7:04 PM

@jknott

@jknott said in Can VLANs on a Cisco AP work with PFSense?:

BTW, if you have 2 SSIDs, you'd normally have 1 VLAN and the main LAN,

Hmm now that makes sense. The HP switch has a "Default" VLAN which, I guess, is everything that isn't on a specific VLAN. If I create a second VLAN for the bypass SSID, I essentially have two VLANs but really it's only one since all LAN traffic is on the "Default"

Now that I'm thinking this through a little more, how does PFsense see traffic from the "bypass" VLAN? Can I use a VIP on the LAN interface, or do I need to have a PHY?

JKnott · Dec 16, 2020, 7:08 PM

@dave-r2

If you're using VLANs, you create one on a physical interface. For example, I created VLAN3 on my LAN interface for my guest WiFi. I then configured my switch to pass VLAN3 on the ports connected to pfsense and my AP and then configured VLAN3 and 2nd SSID on my AP.

Dave R2 · Dec 16, 2020, 7:26 PM

@jknott

@jknott said in Can VLANs on a Cisco AP work with PFSense?:

If you're using VLANs, you create one on a physical interface.

Ok I see. When I created VLAN 200 in pfsense, it ended up assigned to my LAN interface as em1.200. I was experimenting a couple weekends ago and didn't catch it was a virtual nic. It's making more sense now, thanks.