Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Weird VLAN issue

    L2/Switching/VLANs
    3
    14
    358
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • O
      ortizdr last edited by

      Hello Everyone!

      I have an issue plaguing one of my VLANs.
      I have blown it out and rebuilt it several times.
      Soo on to the problem...

      I have an XG-7100 with a LAN and 2 VLANS, LAN, VOICE, and GUEST.

      LAN is 10.33.1.1
      VOICE is 10.50.1.1
      GUEST is 10.60.1.1

      Firewall rules are set to allow all.

      LAN can ping GUEST but not VOICE
      GUEST can ping LAN and VOICE

      If i change the VOICE interface from a /24 to a /32 save and apply changes then change it back, LAN can ping VOICE for about 5 seconds before dropping back out.

      It's not a switch issue, I have verified all connectivity thru there.
      I have spun up a test VLAN and ws able to ping it just fine.

      It is literally just the VOICE VLAN I cannot ping.

      Anyone have any ideas??

      Thanks in advanced!

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by johnpoz

        You can not ping the voice interface IP, or you can ping devices on the voice vlan?

        Can a device on lan ping the voice interface IP 10.50.1.1? And your rules on lan are any any? If not then you have a mask issue most likely.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

        1 Reply Last reply Reply Quote 0
        • O
          ortizdr last edited by

          That is correct. I can’t ping either the interface ip or any devices on that interface.
          All the interfaces are setup as a /24.

          I can ping the voice interface and associated subnet from all interfaces except The LAN.

          1 Reply Last reply Reply Quote 0
          • johnpoz
            johnpoz LAYER 8 Global Moderator last edited by johnpoz

            lets see your full Lan rules, and do you have any rules on your floating tab.. You don't have a gateway set on your lan? Are you policy routing traffic out a gateway, ie do you have vpn setup on pfsense?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

            1 Reply Last reply Reply Quote 0
            • O
              ortizdr last edited by

              No floating rules.
              No Gateway on the LAN.
              The only thing special I have setup is a Multi-WAN redundant setup.

              Here is a really big kicker,
              I have a site-to-site vpn that can ping the VOICE interface and associated devices.

              LAN.PNG

              1 Reply Last reply Reply Quote 0
              • johnpoz
                johnpoz LAYER 8 Global Moderator last edited by johnpoz

                Your wan would have nothing to do with pinging the voice..

                your not doing any odd outbound nat? Its just auto? What is the mask on your lan and your voice.. Lets see the output of your routing table

                Also validate the mask on your client.. I Don't really see how that could be an issue then.. lets say you had a /19 then that would end at 63 and you shouldn't be able to ping guest either. And if you had 20 it would be at 47..

                But yeah very odd. But lets validate the setup of the voice and lets see your routing table.. Do you have some odd route sending it elsewhere?

                what are you using on your tunnel network for your site to site - and what are the networks on the other side of the vpn?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                1 Reply Last reply Reply Quote 0
                • O
                  ortizdr last edited by

                  NAT is set at Auto.
                  Endpoint for site-to-site is 10.34.1.0/24 connecting to 10.33.1.0/24 and 10.50.1.0/24
                  Client is pulling from pFsense DHCP

                  Routes.PNG

                  1 Reply Last reply Reply Quote 0
                  • johnpoz
                    johnpoz LAYER 8 Global Moderator last edited by johnpoz

                    Yeah that all looks fine.. That makes no sense that you can not ping 10.50.1.1 from client on 10.33.1/24

                    When you ping the that IP from a client, you sniff on lan on pfsense - and you see the traffic?

                    You got no port forwards setup?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                    1 Reply Last reply Reply Quote 0
                    • O
                      ortizdr last edited by

                      Packet capture shows data flowing to pFsense, but nothing coming back.
                      No port forwards.

                      1 Reply Last reply Reply Quote 0
                      • johnpoz
                        johnpoz LAYER 8 Global Moderator last edited by

                        That is very odd.. So you see packet to 10.50.1.1 in the packet capture. And nothing in the log that it was blocked?

                        But you can ping 10.60.1.1 from lan just fine?

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                        1 Reply Last reply Reply Quote 0
                        • O
                          ortizdr last edited by

                          Yup, Yup, and Yup!

                          Other then changing the VOICE subnet, i don't know what to do.

                          1 Reply Last reply Reply Quote 0
                          • johnpoz
                            johnpoz LAYER 8 Global Moderator last edited by

                            Yeah at loss, lets see if @Derelict or @stephenw10 are around and might have some ideas

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                            1 Reply Last reply Reply Quote 0
                            • Derelict
                              Derelict LAYER 8 Netgate last edited by Derelict

                              I have a site-to-site vpn that can ping the VOICE interface and associated devices.

                              What are the Phase 2 traffic selectors defined there?

                              Anything silly like captive portals?

                              Chattanooga, Tennessee, USA
                              The pfSense Book is free of charge!
                              DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • O
                                ortizdr last edited by

                                OMG!
                                🤦 🤦 🤦

                                I took a look at the settings for the VOICE Phase 2 and for some reason had the remote subnet setup as my LAN subnet.

                                I can now ping and access from the LAN.

                                Well, I'm a special one!

                                Thanks everyone for your help! Sorry to waste your time!

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post