SG-1100 Running Real VLANs



  • I just unboxed my SG-1100 and saw the default configuration is the following:

    WAN (wan)       -> mvneta0.4090 -> 
    LAN (lan)       -> mvneta0.4091 -> v4: 192.168.1.1/24
    OPT (opt1)      -> mvneta0.4092 ->
    

    It looks like 4090, 4091, 4092 are "fake" VLANs assigned somewhere by the SoC to differentiate between the physical ports. That's cool, but my LAN has ~5 real VLANs I need to assign to the LAN physical port.

    I don't seem to see any traffic (using TCP dump) on any of the non "4090, 4091, 4092" VLANs inside the netgate device when I assign them coming in through the LAN port.

    Ie;

    WAN (wan)       -> mvneta0.4090 -> 
    LAN (lan)       -> mvneta0.3  -> v4: 192.168.1.1/24
    

    WAN works. I see WAN traffic. LAN does not, I see no traffic coming in to mvneta0.3.

    My LAN switch sends VLAN tagged frames out the port and I'm replacing an x86 pfSense box so I know the VLAN and switch config works.

    Am I missing something? Can this device not do "real" VLANs?

    I am also curious ... is this really just a single 1GBit port (ie; total bandwidth)?


  • LAYER 8 Rebel Alliance



  • So, I have spent many hours on youtube, and have read many articles, (including the links above). Very helpful, BUT, SG-1100 acts differently. So it looks like it doesnt like to be set to Port VLAN Mode, as I cant do anything with it after hitting save. What is the proper way to add VLANs to Port 2 on 2.4.4P2? Having a heck of a time to accomplish the following

    • Add VLAN10, for IoT, and VLAN 20 for Guest to Port 2 (LAN) Mostly from default config, so far defined VLAN, and interface (doesnt appear to associate to a port) and set DHCP server. Do I need to add anything under switches (like VLAN 10 0t, 2t) and have existing LAN VLAN 4091 set as 0t, 2t as well?
    • I chose to do VLAN/port segregation from switch, How can I make LAN and OPT1, 2 port switches with same attributes?
      I think whats throwing me off is that there isnt native hard ports to select on interface assignments.

    Hope this makes sense. Lots of documentations on switch configs for SG-3100, XG-7100 and many others, but since SG-1100 is so new there isnt much out there, although I know concept is the same.


  • Rebel Alliance Netgate Administrator

    @bsd29 said in SG-1100 Running Real VLANs:

    WAN works. I see WAN traffic. LAN does not, I see no traffic coming in to mvneta0.3.
    My LAN switch sends VLAN tagged frames out the port and I'm replacing an x86 pfSense box so I know the VLAN and switch config works.
    Am I missing something? Can this device not do "real" VLANs?

    Sorta, You need to set the VLAN's up in the WebUI, and assign them to the interface (tagging them as needed), see the guides @Rico sent over

    I am also curious ... is this really just a single 1GBit port (ie; total bandwidth)?

    No, it's Two 1 Gigabit Ethernet Ports, configured as dual WAN or one WAN one LAN
    plus four-port 1 gbps Marvell 88E6141 switch, uplinked at 2.5 gbps to the third port on the SoC for LAN.


  • Rebel Alliance Netgate Administrator

    @penicheiro said in SG-1100 Running Real VLANs:

    Add VLAN10, for IoT, and VLAN 20 for Guest to Port 2 (LAN) Mostly from default config, so far defined VLAN, and interface (doesnt appear to associate to a port) and set DHCP server. Do I need to add anything under switches (like VLAN 10 0t, 2t) and have existing LAN VLAN 4091 set as 0t, 2t as well?

    Yes/No.
    Yes, you need to add the VLAN's on the interfaces and tag them
    No, 4090/4091/4092 are VLAN uplinks and should rarely be changed.

    I chose to do VLAN/port segregation from switch, How can I make LAN and OPT1, 2 port switches with same attributes?

    From above, 4090/4091/4092 are VLAN uplinks and should rarely be changed. This is one of the few times where you change the uplink to match.
    0_1548503869191_Screenshot from 2019-01-26 06-57-35.png

    I think whats throwing me off is that there isnt native hard ports to select on interface assignments

    They are different, but once you get them, they behave in a similar fashion

    Lots of documentations on switch configs for SG-3100, XG-7100 and many others, but since SG-1100 is so new there isnt much out there, although I know concept is the same

    They are the same. One has 3 ports, the others have 4 and up. You are right, the concepts are the same.


  • Banned

    @chrismacmahon said in SG-1100 Running Real VLANs:

    No, it's Two 1 Gigabit Ethernet Ports, configured as dual WAN or one WAN one LAN
    plus four-port 1 gbps Marvell 88E6141 switch, uplinked at 2.5 gbps to the third port on the SoC for LAN.

    Did you confuse the 3100 with the 1100 there, I don't see 6 ports on the 1100.


  • Rebel Alliance Netgate Administrator

    https://store.netgate.com/pfSense/SG-1100.aspx
    Network Interfaces 1x Marvell 88E6141 networking switch
    3x GbE Ethernet (WAN/LAN/OPT)

    We only use 3 of the 4 ports on the sg-1100, the 4th is the miniPCIe Bus (wifi)


  • Banned

    @chrismacmahon said in SG-1100 Running Real VLANs:

    https://store.netgate.com/pfSense/SG-1100.aspx
    Network Interfaces 1x Marvell 88E6141 networking switch
    3x GbE Ethernet (WAN/LAN/OPT)

    We only use 3 of the 4 ports on the sg-1100, the 4th is the miniPCIe Bus (wifi)

    So looking at the official ESPRESSObin schematics your information seems to be wrong. The switch is linked to the SOC and then offers 3 Ethernet ports, which also aligns with the default VLAN configuration. So these are not dedicated Ethernet interfaces and it is in essence a router on stick with the switch already included.

    Additionally miniPCIe does not carry Ethernet, unless you cooked up something completely outside the standards there.

    0_1548514174651_ESPRESSObin-V7-Hardware-Block-diagram-181202.png


  • Rebel Alliance Netgate Administrator

    Your correct, looks like the material was old I was pulling from:

    https://www.cnx-software.com/2016/09/23/marvell-espressobin-board-with-gigabit-ethernet-sata-pcie-and-usb-3-0-to-launch-for-39-and-up-crowdfunding/

    Network Connectivity
    1x Topaz Networking Switch
    2x GbE Ethernet LAN
    1x Ethernet WAN
    1x MiniPCIe slot for Wireless/BLE periphereals

    My pre-caffeine google fu was not the best.


  • LAYER 8 Netgate

    @penicheiro said in SG-1100 Running Real VLANs:

    Do I need to add anything under switches (like VLAN 10 0t, 2t) and have existing LAN VLAN 4091 set as 0t, 2t as well?

    In the following configuration, whatever is connected to switch port 2 (OPT) will need to be configured for:

    Whatever you want the existing OPT network, untagged. For consistency this should probably be VLAN 4092 in the switch. If you would like 4092 tagged to the switch, just check tagged on port 2 in Interfaces > Switches, VLANs and edit the PVID on port 2 to VLAN 1 (or some other unused VLAN id) in Interfaces > Switches, Ports

    VLANs 10 and 20 tagged.

    Just edit, enable, and number OPT2 and OPT3 as desired, make desired ingress firewall rules, configure DHCP servers, Captive Portals, etc.

    0_1548529420578_Screen Shot 2019-01-26 at 11.00.36 AM.png

    0_1548529430626_Screen Shot 2019-01-26 at 11.00.50 AM.png

    0_1548529451220_Screen Shot 2019-01-26 at 11.03.13 AM.png

    0_1548529465204_Screen Shot 2019-01-26 at 11.02.03 AM.png



  • @derelict You must have been typing as I edited those. VLANs now working!! All of the tutorials i had viewed made no mention of the VLANs TAB under SWITCHES. That was it. Added VLAN 10 and 20, tagged 0 and 2, and that was it, everything else I had configured. THANK YOU. Working very Stably right now.

    Onto my next task. In order to make LAN and OPT port work as a switch.
    -Under SWITCH/PORTS edit port VLAN on OPT from 4092 to 4091.

    • Add Port 1 to TAGGED VLANS 10 and 20

    Is the last step to add port 1 to VLAN 4091 (untagged), and delete VLAN 4092?

    Just want to confirm I am not missing anything, and that I wont get locked out AGAIN. lol

    Thanks


  • LAYER 8 Netgate



  • @derelict MIND READER!!! Thank you SIR!! Still adjusting to this interface, coming from tomato, and so far... I am impressed.



  • Ok, I have been reading through many threads and watching all the videos on vlan setups. I have tried just about everything and spent hours trying to get my vlans set up on my sg-1100. I can never get DHCP working on my unifi AC, if I try and set it up on extra vlans. Are you saying you got yours to work? This is driving me crazy.


  • LAYER 8 Netgate

    Yes, they work. post your interface and switch configuration and describe what you are trying to do.



  • 0_1549314413679_1.png 0_1549314418011_2.png 0_1549314421427_3.png 0_1549314425559_4.png

    I also have the firewall rules for each vlan, as well as the DHCP set for each. However clients are never able to grab a DHCP address. I am hoping its just something simple I am missing.


  • LAYER 8 Netgate

    And the pfSense switch ports tab?



  • 0_1549314679890_5.png


  • LAYER 8 Netgate

    That all looks fine for managing that AP on a LAN address if it is connected to port 2.

    Anything in the DHCP logs? DHCP has automatic rules for any interface with a DHCP server enabled.

    Based on what you have posted I'd look at the DHCP logs and packet captures on UDP port 67.

    Does the smooth network work?



  • Nothing showing up in the DHCP logs then I try to connect to the Work or Guest network. I can connect just fine to the regular Smooth network, clients connect and get a DHCP address. Port two is connected to a switch. I had a similar setup working with untangle, just want to make the jump to pfsense.


  • LAYER 8 Netgate

    Well, you have to tag VLANs 10 and 20 through to the AP on the switch on the ports connected to pfSense and the AP.


  • Banned

    If the L2 is setup correctly check the L3. How are the networks configured, a common beginner mistake is to use the default /32 CIDR for example.



  • 0_1549316340258_6.png Yep, doublechecked /24

    and vlan set on the switch port
    0_1549316365694_10.png


  • LAYER 8 Netgate

    OK. On what switch port are 10 and 20 tagged to the AP?



  • All to port 1


  • LAYER 8 Netgate

    OK, on what port are 10 and 20 tagged to pfSense port 2?



  • Not sure I follow, are you talking about the switch on the sg-1100?


  • LAYER 8 Netgate

    No. What switch port on your switch is connected to pfSense port 2? That port needs 10 and 20 tagged as well.



  • Brilliant! Ok well that was easy. That worked. Thanks for all your help!


  • LAYER 8 Netgate

    @pfsmooth Tag 10 and 20 on switch port 2 and I think you will be pleased with the results.



  • Well all was running smooth for a while, had it all set up and all of a sudden I get flooded with " Default deny rule IPv4 (1000000103) " and things like my plex server wont allow external connections. If I rebuild pfsense from scratch it is fine until i add the vlans. Then boom plex falls off. Any ideas?


  • LAYER 8 Netgate

    From that description, no. Not enough information.



  • Not sure if I should start a new thread. But basically the port forwarding is not working directly to 32400. I have set the NAT rule and the FW rule with no luck. A search shows this pops up often but I haven't been able to pin down a solution.


  • LAYER 8 Netgate

    That would probably be better in a NAT thread. If pfSense is both receiving the traffic to be forwarded on WAN (verified by Diagnostics > Packet Capture on WAN) and can Diagnostics > Test Port to the address/port it is being forwarded to, then you likely did the port forward incorrectly.


  • LAYER 8 Global Moderator

    your switch only shows port 1 with tagged vlans on it, where is the port connecting to pfsense?

    Your vlans will have to be tagged on the port going to pfsense, and the port going to AP.

    How is everything connected exactly? What is the point of tagging vlans to your what looks like a sg108e if no other ports are using those vlans, and no other uplink to another device like AP that is tagged?



  • Thanks John, yes. I figured out that the port pfsense was plugged into needed to be tagged to the same vlan as the port the AP was plugged into. All good there.


Log in to reply