Make the main LAN a VLAN ?
-
Is there any advantage to creating a VLAN to carry the primary LAN ? Easier to distribute the LAN over multiple switches ?
BRgds/Alan
-
No, the purpose of VLANs is to carry multiple logical LANs over a singel physical LAN. For example, I have a VLAN so that my access point can have guest WiFi. The guest SSID is carried on a VLAN to pfsense, while the main SSID uses native LAN. Another example would be in businesses, where VoIP phones run over the same cable & switch port as the desktop computers. The cable goes first to the phone, where the VoIP traffic is stripped off and the native LAN continues on to the computer that is plugged into the phone.
You could use VLANs and managed switches to create separate physical networks for multiple subnets.
-
@alan-t said in Make the main LAN a VLAN ?:
Easier to distribute the LAN over multiple switches ?
The "vlan" doesn't have to be tagged to distribute it across multiple switches. The only time has to be tagged is when you carry more than 1 over the same physical wire as JKnott mentioned.
If you have other vlans, and you like to tag everything - then sure you could do that if makes easier for you. But there is nothing saying that it has to be tagged. You can have 1 network/vlan on a connection that is untagged. While other vlans you put on that same wire would be tagged.
-
@johnpoz said in Make the main LAN a VLAN ?:
You can have 1 network/vlan on a connection that is untagged. While other vlans you put on that same wire would be tagged.
? If it is untagged, it is not a vlan for pfSense anymore I would guess.
-
@bob-dig said in Make the main LAN a VLAN ?:
@johnpoz said in Make the main LAN a VLAN ?:
You can have 1 network/vlan on a connection that is untagged. While other vlans you put on that same wire would be tagged.
? If it is untagged, it is not a vlan for pfSense anymore I would guess.
Hint ... Native Vlan ....
https://www.educba.com/what-is-native-vlan//Bingo
-
Thank you all.
I am using Unifi for everything other than pfSense. My sense of what you were saying is that the primary LAN is distributed across multiple switches using the default VLAN 1 ? The only networks the Unifi switches āknowā about are the defined VLANs.
The problem is, I am trying to do this: (i.e. minimise use of VLAN 1)
https://www.stephenwagner.com/2019/10/05/change-management-vlan-on-ubiquiti-unifi-hardware-and-controller/BRgds/Alan
-
@bob-dig said in Make the main LAN a VLAN ?:
? If it is untagged, it is not a vlan for pfSense anymore I would guess.
No pfsense wouldn't consider it a "vlan" but it still a vlan - the switch will have to have some ID associated with it, be it 1, or some other ID you want to use.. Its still a "vlan" to the switch..
Just like any other device on a vlan normally doesn't know its on a vlan - because to the device you don't normally send the tag. You only send the tag to devices that need to be able to figure out what traffic is what when there is more than one vlan sent on the same wire - another switch, a router, a access point, etc..
(i.e. minimise use of VLAN 1)
Then don't use vlan 1 as the default vlan on your switching infrastructure if you don't want to - my default vlan is 9.. But pfsense doesn't actually know that - its lan is untagged. But to the switch this is vlan 9, on the ports I want to put in that vlan.. All vlan 1 is the default vlan..
-
@johnpoz said in Make the main LAN a VLAN ?:
Then don't use vlan 1 as the default vlan on your switching infrastructure if you don't want to - my default vlan is 9.. But pfsense doesn't actually know that - its lan is untagged. But to the switch this is vlan 9, on the ports I want to put in that vlan.
Ok, thank you. So to check my understanding:
Create a VLAN (letās say 9) āforā the primary LAN. On Unifi gear, any port I want this to go to should have VLAN 9 as the Native VLAN.Many thanks,
Alan -
@alan-t
Mmmm ... doesn't work.
I was creating a VLAN 9 on pfSense and then in Interface Assignments assigning the LAN to "VLAN 9 on igb1 - lan". There is a VLAN only network (9) on Unifi. If I do that, no matter what I do with the switch ports (including "ALL") I lose the connection. As soon as I put the LAN back to igb1 (i.e. no VLAN) the connection returns.Reading your post again, I think you mean leave the LAN without a VLAN on pfSense (although I don't understand why this won't work - the LAN is just another network ??). But then change the default VLAN on the Unifi gear ? I am not sure how to do that ... Do you mean just make VLAN 9 the native network for all the ports on Unifi ?
Thanks,
Alan -
@alan-t What is your goal? Didn't read your link though.
-
@bob-dig said in Make the main LAN a VLAN ?:
Didn't read your link though.
Don't bother its not really doing anything with the default vlan - he is not changing the default vlan of anything. He is just using a management vlan.
He is not changing the default vlan, he is just just not using vlan 1, and using a management vlan for his devices..
This has nothing to do with changing the default vlan on a switch and not using 1.. Or setting a vlan on "lan". This nothing to do with if lan is tagged or not to pfsense.
Notice my switch doesn't have a vlan 1 any more
My unifi stuff is using vlan 9 as the managment untagged vlan. As I was saying - just like pfsense it doesn't know that though - its just an untagged vlan.
Any vlan "on the switch" can be untagged. Be it the default vlan of the switch or not.
-
Thank you,
I am now just interested in how pfSense works. My experimentation seems to suggest that the first LAN created during installation HAS to reside on a bare interface. It cannot run over a VLAN. Any idea why this might be ?
Cheers/Alan
-
You can run lan on a tag if you want.. But yeah during first install its just native.. During install it asks you right up front if you need any vlans set or not.
https://docs.netgate.com/pfsense/en/latest/install/assign-interfaces.html
