pfSense on Watchguard M270

shaker

Hello,
I tried the whole night to bring me M270 to work.
But I didn't have success.

Can you please explain more detailed, what are the steps for get it done?

Thank you so much.

ozon08

@shaker
What have you done so far?

shaker

I installed OPNsense, which is very similar to pfSense without issues. The switchports are not able to work by default.
Then I opened "shell" to modify the files you recommended.

First I added this code

hint.mdio.0.at="ix1"
hint.e6000sw.0.addr=0
hint.e6000sw.0.is6190=1
hint.e6000sw.0.port0disabled=1
hint.e6000sw.0.port9cpu=1
hint.e6000sw.0.port10cpu=1
hint.e6000sw.0.port9speed=2500
hint.e6000sw.0.port10speed=2500

to /boot/device.hints

Then I created the scripts in /usr/local/bin/setup_switch.sh

#!/bin/sh
#
# Script to setup the switch in the M270
#
# SteveW 5/6/2020
#

echo "Configuring switch..."
logger Configuring switch...

etherswitchcfg vlangroup1 vlan 1 members 9
etherswitchcfg vlangroup2 vlan 2 members 3,4,5,6,7,8,10
etherswitchcfg vlangroup3 vlan 3 members 2,4,5,6,7,8,10
etherswitchcfg vlangroup4 vlan 4 members 2,3,5,6,7,8,10
etherswitchcfg vlangroup5 vlan 5 members 2,3,4,6,7,8,10
etherswitchcfg vlangroup6 vlan 6 members 2,3,4,5,7,8,10
etherswitchcfg vlangroup7 vlan 7 members 2,3,4,5,6,8,10
etherswitchcfg vlangroup8 vlan 8 members 2,3,4,5,6,7,10
etherswitchcfg vlangroup9 vlan 9 members 1
etherswitchcfg vlangroup10 vlan 10 members 2,3,4,5,6,7,8

etherswitchcfg port1 forwarding
etherswitchcfg port2 forwarding
etherswitchcfg port3 forwarding
etherswitchcfg port4 forwarding
etherswitchcfg port5 forwarding
etherswitchcfg port6 forwarding
etherswitchcfg port7 forwarding
etherswitchcfg port8 forwarding

echo "done"
logger done

Gave it this:
chmod +x setup_switch.sh

run it ./setup_switch.sh

But I get fault:

etherswitchcfg: Can't open control file: /dev/etherswitch0: No such file or directory

More Information:

root@OPNsense:/ # kldstat
Id Refs Address                Size Name
 1   39 0xffffffff80200000  215dc08 kernel
 2    1 0xffffffff8235e000     f460 carp.ko
 3    1 0xffffffff8236e000     3b18 pflog.ko
 4    3 0xffffffff82372000    75240 pf.ko
 6    1 0xffffffff82407000    3d648 if_ixv.ko
 7    1 0xffffffff82445000    4f610 if_ix.ko
 8    1 0xffffffff82495000     4b58 if_enc.ko
 9    1 0xffffffff8249a000     ba48 if_gre.ko
10    1 0xffffffff824a6000    18338 if_lagg.ko
11    2 0xffffffff824bf000     3538 if_infiniband.ko
12    1 0xffffffff824c3000     e4d0 if_bridge.ko
13    2 0xffffffff824d2000     7870 bridgestp.ko
14    1 0xffffffff824da000     e318 pfsync.ko
15    1 0xffffffff82720000     3250 ichsmb.ko
16    1 0xffffffff82724000     2180 smbus.ko
17    1 0xffffffff82727000     4700 nullfs.ko

root@OPNsense:/ # ifconfig -a
ix0: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        description: WAN (wan)
        options=4803828<VLAN_MTU,JUMBO_MTU,WOL_UCAST,WOL_MCAST,WOL_MAGIC,NOMAP>
        ether 00:a0:c9:00:00:02
        media: Ethernet autoselect
        status: no carrier
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
ix1: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        description: LAN (lan)
        options=4803828<VLAN_MTU,JUMBO_MTU,WOL_UCAST,WOL_MCAST,WOL_MAGIC,NOMAP>
        ether 34:12:78:56:01:03
        inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
        media: Ethernet autoselect
        status: no carrier
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
        inet 127.0.0.1 netmask 0xff000000
        groups: lo
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
enc0: flags=0<> metric 0 mtu 1536
        groups: enc
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
pflog0: flags=20100<PROMISC,PPROMISC> metric 0 mtu 33160
        groups: pflog
pfsync0: flags=0<> metric 0 mtu 1500
        syncpeer: 0.0.0.0 maxupd: 128 defer: off
        syncok: 1
        groups: pfsync

Let me know if you need any other information.
Thank you

ozon08

@shaker
Did you restart after adding the boot hints?

shaker

Yes I gestartet every time I made changes

stephenw10

OPNSense doesn't have the required drivers to access the switch. The same reason CE won't work. It can only work with pfSense Plus currently.

Steve

shaker

What a pitty.
I thought the base is Free BSD which give the possibility in general.
Is there no way to bring the correct driver to FreeBSD and let it work?

By the way, if somebody need access to the BIOS, just let me know.

stephenw10

It only happens to work in pfSense Plus because we have done the development work for the 7100. There is basically zero incentive for Deciso to sponsor that in OPN so I'd say it's very unlikely.

shaker

OK that's cool. Thank you.
So one last question. When it works with plus only, do I need top buy it, or is there a way to get it for private use.
I read there is a way to upgrade CE to plus, but therefore you need Internet access first on the device.
So what's the best option?

stephenw10

The easiest way is to install CE and upgrade to plus in something else then move the boot device across into the m270. Then re-register it there once you've added the switch scripts so it has connectivity.

shaker

Thank you very much for the support.
I have now running pfsense plus on my M270.

stephenw10

Cool!
Be aware that the driver code was never intended to run on that hardware so the startup scripts that ensure the 7100 works as expected will end up breaking it for the m270 at upgrade. At least currently.
So if/when you do a firmware upgrade you will need access to the console to copy back the device hints and regain connectivity. I usually just have a backup of the file I can quickly copy back into place.

Steve

shaker

Yes I will do. I made some notes to not forget.

Actually the ethernetswitch is configured to use 1 WAN and 7 LAN interfaces, working in switch mode.
Is it possible to configure it to have 7 independent LAN ports, where to activate VLANs on each?

stephenw10

Yes, you just to set them up as that in the switch configure script using etherswitchcfg.

shaker

Is this the right config to have all ports individual?

#!/bin/sh
#

echo "Configuring switch..."
logger Configuring switch...

etherswitchcfg vlangroup1 vlan 1 members 9
etherswitchcfg vlangroup2 vlan 2 members 10
etherswitchcfg vlangroup3 vlan 3 members 10
etherswitchcfg vlangroup4 vlan 4 members 10
etherswitchcfg vlangroup5 vlan 5 members 10
etherswitchcfg vlangroup6 vlan 6 members 10
etherswitchcfg vlangroup7 vlan 7 members 10
etherswitchcfg vlangroup8 vlan 8 members 10
etherswitchcfg vlangroup9 vlan 9 members 1
etherswitchcfg vlangroup10 vlan 10 members 2,3,4,5,6,7,8

etherswitchcfg port1 forwarding
etherswitchcfg port2 forwarding
etherswitchcfg port3 forwarding
etherswitchcfg port4 forwarding
etherswitchcfg port5 forwarding
etherswitchcfg port6 forwarding
etherswitchcfg port7 forwarding
etherswitchcfg port8 forwarding
etherswitchcfg port9 forwarding
etherswitchcfg port10 forwarding

echo "done"
logger done

I am not really sure how I need to configure it.

stephenw10

You need to set the switch in 802.1Q mode, it's in port vlan mode by default:

etherswitchcfg config vlan_mode DOT1Q

Then add the internal ports as tagged members to each group so you can address them as VLANs in pfSense. Also never use VLAN 1 (or 0) directly unless there no other way so:

etherswitchcfg vlangroup1 vlan 101 members 1,9t
etherswitchcfg vlangroup2 vlan 102 members 2,10t
etherswitchcfg vlangroup3 vlan 103 members 3,10t
etherswitchcfg vlangroup4 vlan 104 members 4,10t
etherswitchcfg vlangroup5 vlan 105 members 5,10t
etherswitchcfg vlangroup6 vlan 106 members 6,10t
etherswitchcfg vlangroup7 vlan 107 members 7,10t
etherswitchcfg vlangroup8 vlan 108 members 8,10t

Then you need to set the PVID for each port so untagged traffic arriving is placed in the correct vlan:

etherswitchcfg port1 pvid 101
etherswitchcfg port2 pvid 102
etherswitchcfg port3 pvid 103
etherswitchcfg port4 pvid 104
etherswitchcfg port5 pvid 105
etherswitchcfg port6 pvid 106
etherswitchcfg port7 pvid 107
etherswitchcfg port8 pvid 108

Because you only have one VLAN on port 9 you could also just use that untagged internally but if you ever want to move the VLANs around or add more on port 9 it's easier to set it up tagged now.
You can also do other things like setup the two internal ports as a lagg to the switch and put all the VLANs on that. We do that in the 7100 because in some situations it can provide more bandwidth. But you really have to try hard to pass more than 2.5Gbps total and it adds more complexity.

Steve

ivanbarr

@stephenw10 Is it possible to get the switch to appear in the Web UI on the M270? I think the UI code makes a call to some function like platform_has_switch() to determine whether to show the switch items under the interfaces menu. How does pfsense come to know if a device has a switch or not?

stephenw10

There's no easy setting for that. You'd have to patch the code. Probably in a few places. The defaults would need to be set differently to the 7100.

shaker

Hi stephenw10,

I configured the M270 like you described above.
Activate 802.1Q mode, and configured the etherswitchcfg all tagged.

Then I opened console and add a vlan 120, activate the IP on LAN, stuff like that.
Play a bit around.
This is how it looks like:

 WAN (wan)       -> ix0        ->
 LAN (lan)       -> ix1        -> v4: 192.168.10.1/24
 OPT1 (opt1)     -> ix1.120    -> v4: 192.168.120.1/24

 0) Logout (SSH only)                  9) pfTop
 1) Assign Interfaces                 10) Filter Logs
 2) Set interface(s) IP address       11) Restart webConfigurator
 3) Reset webConfigurator password    12) PHP shell + Netgate pfSense Plus tools
 4) Reset to factory defaults         13) Update from console
 5) Reboot system                     14) Enable Secure Shell (sshd)
 6) Halt system                       15) Restore recent configuration
 7) Ping host                         16) Restart PHP-FPM
 8) Shell

I tried to connect directly on port 1-7 and also with a switch, Tagged the port vom M270 on VLAN120 and untagged the port from my pc, but I can't reach the web from pfsense.

Do you know what I am doing wrong?

stephenw10

What does etherswitchcfg show?