Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    2 Switches, 2 LAGGs, 1 LAN

    General pfSense Questions
    3
    8
    396
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      scilek last edited by

      Hi

      I am setting up a new router for a small student hostel. The students will all connect via the 12 Unifi Access Points. The problem is that there are two blocks and I want to install one switch for each block in order to cut down on the CAT6 cable. The distance is not that great and the cost is not an issue at all –I just want to ensure maximum performance. I have installed one IBM Intel 4-port GB PCI-E NIC and one Intel Pro M PCI card. I also have the onboard RealTek PCI NIC.

      I want to connect two gigabit interfaces on each of the HP switches via LACP; LAGG0 for Switch A and LAGG1 for Switch B. But I also want to make them one single LAN.

      Is that possible? If yes, how do I do that?

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by

        You would do that with your distribution layer switch..  Network design 101, your typical access, distribution, core..

        So your laggs would run to your distribution layer switch, which would then connect up to pfsense.

        Pfsense is not a switch.. So unless you have the sg-3100 running pfsense that has a built in switch your best bet would be to put a switch between… Why are you wanting to lagg.. What is the internet speed here?  Is your internet faster than 4 gig?  Do you want the lagg for redundancy?  Sounds like you want it for bandwidth.. Whats the point of feeding possible 4 gig into pfsense to route to internet that is only 512? for example..

        Why would you want/need them on 1 lan?  You almost never see a wifi network, especially in some sort of setup like a hostel where wifi device would need to talk to another device on the wifi.. Such networks wifi are almost always setup isolated.. You don't want device A talking to device B because you get some "hack0r" wannabe or someone infected with something talking to all the other guests on the network, etc.  So see no reason for the 2 areas of wifi needing to be on the same layer 2..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

        1 Reply Last reply Reply Quote 0
        • S
          scilek last edited by

          So your laggs would run to your distribution layer switch, which would then connect up to pfsense.

          I don't have one and it would be an overkill. I also want to keep both switches at the same level of distribution.

          Is your internet faster than 4 gig?

          They wish!

          Do you want the lagg for redundancy?  Sounds like you want it for bandwidth..

          I want both.

          Why would you want/need them on 1 lan?

          Because I want to be able  to manage ALL the Unifi APs from a single laptop and hence a single broadcast domain.

          You don't want device A talking to device B because you get some "hack0r" wannabe or someone infected with something talking to all the other guests on the network, etc.

          That is not an issue at all.

          1 Reply Last reply Reply Quote 0
          • S
            scilek last edited by

            Well… I see that is not recommended at all.

            But is it still possible?

            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by

              Yes it is possible - just bridge your 2 lagg interfaces.

              But not a recommended setup.. Just put a cheap smart switch that can lagg infront of pfsense. In a normal setup this distribution layer switch in front of pfsense would be a stack.  With 1 leg of each lagg connecting to different switch in the stack.  So then you get true redundancy while allowing bandwidth. But if you do not have anywhere close to 4gig then you have no need for the extra bandwidth and complexity of the lagg setup.

              As to managing your 2 different layer 2 from the same controller - this is simple via L3 adoption of your AP that are on the same layer 2 as your controller.

              There are many ways to skin the cat so to speak..  The distribution switch in front of pfsense would be the most direct and easier setup and less complex.  It does not have to be an expensive switch for sure.. A $50 smart switch can do lagg for example.  This would be better solution than bridging your lags in pfsense to maintain them all on the same layer 2.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

              1 Reply Last reply Reply Quote 0
              • S
                scilek last edited by

                But not a recommended setup..

                Thanks for the advice. I had to buy a brand new "HPE OfficeConnect Switch 1820 24G J9980A" switch, which turned out to have basic core switch capability.

                1 Reply Last reply Reply Quote 0
                • Derelict
                  Derelict LAYER 8 Netgate last edited by

                  Good. That should absolutely be done in your switching layer.

                  Chattanooga, Tennessee, USA
                  The pfSense Book is free of charge!
                  DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • johnpoz
                    johnpoz LAYER 8 Global Moderator last edited by

                    "which turned out to have basic core switch capability"

                    Any switch could be your core to be honest.. It doesn't have to do routing, etc.  It could be a dumb switch.. The nutshell of the access, distribution, core is just a pyramid way of looking at how you fan out your network from the edge to the devices.

                    Such a layout as attached, be it all dumb switches could be seen as top switch as core, middle as distribution and bottom row as access.  With your devices connected to the access layer.

                    It for sure can get way more complicated than that, and normally there is stacks with redundant connections, etc.  If all you have is access switches directly connected to pfsense then pfsense becomes your combo core/distribution layer, etc.  Or you could look at it like you don't have the core or the distribution layer, etc.


                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post