@jknott

Yes typo, thank you.
S/b: VLAN 1 untagged on ETH5-8.

I have since added all the VLANs I need and VLAN1 works untagged and the rest are tagged and working on ETH5-8.

pfsense_xg7100_Switch_VLANs.jpg

I will try that, and see how it goes.

If not, I can do it manually.

/Jan

Bridging VLANs like that is generally not recommended.

How many internal interfaces do you need configured like that?

If it's just one you could try breaking the ix2-3 lagg and reconfiguring the switch to connect Eth8 to ix2 directly and bridge that. Removing the VLAN will probably prevent the loss there.
Make sure you have some access to the firewall other than via the switched ports if you try that as it's very easy to get locked out!

Do you need to filter traffic across the bridge? If not you would be better off using an external switch to set that up.

probably something is triggering a restart of dpinger

^ exactly! ;) if you found a 8860 at a price point you are happy with - snag it! ;)

its prob overkill to be honest, but if your happy with the price..

I have a 4860 on my home network - it is for sure way more than what is required.. But go big or go home works for me ;)

Theoretically that might be possible. However no-one has tested that card in a 7100, and certainly not one with modified firmware. It's impossible to say if it would work there.

Steve

Hey @Derelict Thanks for the ideas. I've managed to find the issue, and it was an equipment problem on our ISP side.

I ran some packet captures on both the internal VoIP VLAN, and the external SBC interface(our phone comes in over the same fiber asour IP, but on a separate interface on the demarcation unit(T-340)), found a lot of dropped packets, moved onto our WAN switch, and saw that there was an EXCESSIVE amount of Tx/Rx errors and collisions on the demarcation interface. When I dug into the interface itself, found that it was only negotiating at half-duplex, which would explain the issues. When I went back through my old config files for the SG-8860, I found that I had to force it into full-duplex mode as the T-340 for some reason will not auto-negotiate to full-duplex, but if I force my side to full, it works just fine, and not a single error since.

Thanks again for chiming in.

It's better to create a ticket on go.netgate.com and describe your problem

Hi Mate.

Thanks for your response.

I don't think so , the wan is set up statically and supplied by a data centre. The connection will be coming from another firewall VLAN.

When we plugged the older pfsense in with the same config no issues were occurring.

Just trying to look through the logs using shell due to the fact they only show a certain time in the GUI.

Thanks

This won't answer all your questions but, I did find this on reddit:
https://www.reddit.com/r/PFSENSE/comments/8hbsze/xg7100_performance_with_suricata_at_1_gbps/