SG-1100 configuring LAN and OPT to be on the same VLAN

  • LAYER 8 Netgate

    Some people might want LAN and OPT to be "bridged" to be on the same LAN network. The procedure will be substantially similar on the SG-3100 and XG-7100, but those devices come from the factory with multiple ports on the same VLAN (LAN). This procedure should be safe to run connected to the LAN port without being locked out.

    All you have to do is make the following changes:

    Interfaces > Switches, Ports

    Click on the Port VID for OPT1. It should say 4092. Change that to 4091 and Save.

    Click the VLANs tab.

    Click the edit button on VLAN group 3, click Delete on Member 1. Save.

    Click the edit button on VLAN group 2, click the Add member button. Enter Member 1, uncheck tagged. Save.

    You should end up with something that looks like this:

    0_1548530537281_Screen Shot 2019-01-23 at 2.29.31 PM.png

    0_1548530558186_Screen Shot 2019-01-23 at 2.29.45 PM.png

    Note that unlike software bridging, traffic between ports 1 and 2 will never leave the switch chip so it will perform at switching speed. You also cannot filter traffic between the two ports as pfSense will never see it, just like with any other (external) switch.

  • Rebel Alliance

    @derelict What if you also wish to include a Tap Ovpn interface on the bridge with the 2 Lan ports?

  • LAYER 8 Netgate

    You would have to bridge it with the VLAN interface (mvneta0.4091), unfortunately. Shouldn't be anything additional needed on the switch.

  • Rebel Alliance

    I assume the old Interface assignments are still correct.


  • LAYER 8 Netgate

    Everything should be the same as any TAP bridge. You'll just have OPT and LAN on the same switch VLAN.

Log in to reply