PfSense VLAN + switch tagging trunk questions



  • I have several VLANs setup on one interface that will be connected to one port on my HPE 1820 24g switch. Should this switch uplink to the pfsense interface be made a trunk on the HPE? Do we tag ports that will serve as trunk?


  • Netgate Administrator

    Yes the switch port should be a trunk connection to carry multiple VLANs.

    You don't need to do anything in pfSense to mark it as trunk. The interface serving as the VLAN parent will always send the VLAN packets tagged.

    Steve



  • This is probably a question for another forum but in which circumstances would I tag a port with multiple VLANs instead of trunking it? I can't seem to wrap my head around tagging vs trunking. To give an example I have a Ubiquiti AP that I have setup with 3 SSIDs (VLANs) . The switch interface is tagged with the three VLANs.This appears to work. Yet when I read Ubiquiti documentation, it says that I should be using a trunk between the switch and AP.



  • This is probably a question for another forum but in which circumstances would I tag a port with multiple VLANs instead of trunking it?

    You don't.  A port is either a trunk port or assigned to a VLAN (including native).  About the only exception I know of is with Cisco switches and VoIP phones, where Cisco Discovery Protocol will recognize a phone and put it on a VLAN, while the port is assigned to another.  Similar can happen with switches that can be configured to recognize MAC address prefixes, to put phones etc., on a VLAN.


  • Netgate Administrator

    Much of the confusion here is due to the different terminology and subtle differences in the way settings are applied between manufacturers.

    The term trunk port or trunk connection is actually a Cisco term I believe but has come to be widely used to mean a link/port carrying tagged VLAN traffic, usually multiple VLANs but doesn't have to be.

    I like to think of it like this, effectively there are three options for traffic on a VLAN leaving a switch port:

    Tagged; the packet leaves the port with VLAN tags. Trunk port.

    Untagged; the VLAN tags are stripped when the packet leaves the port. Access port. The PVID would almost always be set to that VLAN to re-tag the packets coming back in.

    Excluded; packets from that VLAN are not permitted to leave via that port.

    And indeed some switches mark the ports exactly like that which I always found the easiest to read. At least some HP switches are like that but lower end maybe…

    It is better to avoid untagged and tagged traffic on the same link if you can. It's easy to make mistakes doing that. Some switches can behave unexpectedly. However it is valid.

    The definitions between trunk port and access port blur when you have a port that is tagged on some VLANs but untagged on another.

    They blur even further when you have multiple VLANs untagged on one port! Many (most?) switches won't allow that and it's of 'limited' use.  ;)

    My own exposure to different switches is limited, open to thoughts on that.

    Steve



  • Thanks for your replies.

    The 1820 web administration has a VLAN section to define the VLANs and configure the ports as tagged, untagged or excluded. What adds to the confusion is that the web administration also has a separate section for trunking.

    More a question for HP, but if tagging = trunking, why can I apply a bunch of VLAN tags to a port in one section and then in a separate assign that port as a proper trunk? I would refer to a manual but the only one I can find is no help.

    I've attached screenshots of the web adminstration GUI.






  • On HP tagging != trunking. Trunking is used for link aggregation. No need to touch that if you just need VLAN functionality.



  • Thanks Andy. I did a bit more digging and found that same answer too.
    Cheers.


  • Netgate Administrator

    …..and there's the confusion!  ;)

    But that's especially confusing. Good to know.  Thanks.

    Steve



  • @SR190 has anyone been able to resilve this as i have not been able to transport vlan traffic to tagged ports

    Here is my setup

    Port 48 goes to my pfsense firewall

    Untagged vlan 1 by default on port 48
    Vlan 11 tagged on port 48
    Vlan 12 tagged on port 48
    Vlan 13 tagged on port 48

    The switch model is hpe 1820-48G



  • @jwhitewick01

    Have you configured those VLANs on pfSense?



  • @JKnott yes all vlans are configured on pfsense.



  • @jwhitewick01

    Well, fire up wireshark, to see what's happening. Wireshark has a column for VLAN ID, but you have to enable it.


  • Netgate Administrator

    I assume you have those VLANs untagged on other ports on the switch where you testing connecting hosts to them?



  • @JKnott said in PfSense VLAN + switch tagging trunk questions:

    @jwhitewick01

    Well, fire up wireshark, to see what's happening. Wireshark has a column for VLAN ID, but you have to enable it.

    Screenshot 2020-02-20 at 16.24.42.png



  • @NogBadTheBad

    All I can see is there's no VLAN traffic at whatever point you're looking at. Are the VLANs configured on that interface? You'll have to do something to generate traffic on the VLANs, such as pinging a non-existent address. This will cause multiple ARP broadcasts, which give you something to watch for.



  • The ID column shows traffic tagged vlan 4, 5 & 6.



  • @NogBadTheBad

    Sorry, my mistake. I haven't had my morning beer yet. 😉

    So, you have VLANs enabled on that switch. Is that traffic coming from the switch where you're monitoring or is it being received by it? With managed switches, you can test at each end and then see what happens. So, if you see those tagged frames coming in, are they being sent out on the appropriate port? I see STUN packets. That implies VoIP or perhaps games? Where is that port you're monitoring in relation to your Internet connection. Hopefully, you're not trying to send VLAN frames out to the Internet.



  • @JKnott

    Yup vlan 4 is my IOT vlan and vlan 6 is VOIP, the screen shot was just to show @jwhitewick01 what to set as a column rule.

    I did a capture on my pfsense parent interface.



  • @NogBadTheBad

    Then why is VLAN4 showing a STUN packet? That should be on VLAN6. Is that packet incoming to pfSense? Or outgoing? I also see a router advertisement on there. I assume that MAC address matches the pfSense port and you don't another router out on VLAN5. And that 172.16.6.1 is pfSense on VLAN6. There is at least some communication between 172.16.6.2 and .1 Is that .2 on the correct VLAN?



  • The STUN packet would appear to be from my Apple-TV.

    Screenshot 2020-02-20 at 17.39.08.png

    I don't normally resolve hostnames.

    The capture was done on my pfSense interface hence the RA.

    Ah they do use STUN.

    https://support.apple.com/en-us/HT202944



  • @NogBadTheBad

    Whoever it it, it's a STUN packet on a VLAN that's supposed to be IoT, You'd normally only see STUN with VoIP or some games. Also, the VLAN IDs on pfSense don't appear to match up with those on the switch. They must be the same everywhere. So, if you have IoT on VLAN4 in pfSense, then it must also be VLAN4 on the switch trunk port.



  • The VLAN IDs are correct both end as I said previously "vlan 4 is my IOT vlan and vlan 6 is VOIP"

    The STUN packets on vlan 4 are from 2 x Apple-TVs.

    I'd see STUN packets on vlan 4 (IOT) and vlan 6 (VOIP).



  • @NogBadTheBad said in PfSense VLAN + switch tagging trunk questions:

    The VLAN IDs are correct both end

    Then what's this?

    Port 48 goes to my pfsense firewall

    Untagged vlan 1 by default on port 48
    Vlan 11 tagged on port 48
    Vlan 12 tagged on port 48
    Vlan 13 tagged on port 48

    Those certainly don't look like 4, 5 & 6 to me.



  • @JKnott said in PfSense VLAN + switch tagging trunk questions:

    @NogBadTheBad said in PfSense VLAN + switch tagging trunk questions:

    The VLAN IDs are correct both end

    Then what's this?

    Port 48 goes to my pfsense firewall

    Untagged vlan 1 by default on port 48
    Vlan 11 tagged on port 48
    Vlan 12 tagged on port 48
    Vlan 13 tagged on port 48

    Those certainly don't look like 4, 5 & 6 to me.

    LOL I'm not @jwhitewick01 !



  • @NogBadTheBad

    That's what happens when someone takes over anohter's thread.

    Your trunk 4, for example, where is it supposed to go? Does it get there so that you can see those STUN packets arriving where they're supposed to? I don't know what you have and haven't seen much in useful info to help with whatever your problem is?

    Scrolling back, the first post I see from you is in response to my suggestion that the OP use Wireshark. Why did you post a capture there? All you seem to be doing at that point is creating confusion.

    Also, I don't know about others here, but I don't sit around watching a thread all day. I'm at my desk, with the forum open. I see when there's a new post in some thread and then read it, so I'm not paying close attention to what happened earlier. When you posted in the thread with only the capture and no other comment, what was I supposed to assume?



  • To show the @jwhitewick01 how to set a column up in wireshark.


  • Netgate Administrator

    Well that went off the rails 😉

    Let's wait to hear from jwhitewick01.



  • @stephenw10 I will have to wait for this tuesday coming to go on site in order to test.


Log in to reply