Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Connecting Cisco 3560 to Netgate 2100

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    18 Posts 3 Posters 1.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      WN
      last edited by

      Help with Connecting Cisco Switch to 2100.

      I've tried six way to Sunday to get connectivity between them to work.
      Looking for layer 2 at the switch and 3 on the firewall. Followed the Netgate documentation to a T and still no go.

      Switchport access
      Switchport Trunk

      Nothing works. Need someone who's set this up, I believe my issue is on the Netgate but after struggling for 4 days and working with another Network Engineer we still can't get connectivity.

      johnpozJ C 2 Replies Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @WN
        last edited by

        @wn and what exactly have you done.

        Your saying you can not get basic access to any port on your 2100? Whatever your switches default vlan is? Access port and connect to one of the lan ports? This would be untagged traffic..

        Do you get lights? If your trying to do vlans on the switch ports of the 2100, what is the config you have setup?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • C
          cdarsac @WN
          last edited by

          @wn

          Hello, 🙂

          I’m afraid I’m in the same situation with a Cisco 2970.

          I have open a post named "Can't ping new VLAN Interface" (Bis)" here.

          1 Reply Last reply Reply Quote 0
          • W
            WN
            last edited by

            Strange thing is that I believe the issues is on the Cisco switch and not able to route back to the interfaces I have created on the 2100. Let give you all the current state:

            1. Set up three vlan's tagged, have DHCP service running on all vlans.
            2. All interfaces are IPed as the gateway for each vlan
            3. Currently have any/any rule set up on each vlan do all traffic can pass
            4. DHCP is working! my servers can get the proper IP for the server vlan! Woot!
            5. What is not happening is I can't ping the gateway IP of the 2100 interface. I can ping between hosts on the same subnet/vlan. But no traffic is getting towards the gateway IP.
            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @WN
              last edited by johnpoz

              @wn said in Connecting Cisco 3560 to Netgate 2100:

              What is not happening is I can't ping the gateway IP of the 2100 interface.

              And what rules did you put on these interfaces? When you create a new interface, vlan or not there will be no rules on it. If you want to be able to ping the pfsense IP of that interface you would need to have a rule that allows that on that interface.

              Currently have any/any rule set up on each vlan do all traffic can pass

              Is it truely any or default to tcp when you create a new rule.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • W
                WN
                last edited by WN

                Created any/any firewall rules for each interface. There's no blockers that should prohibit hosts on that Vlan from at the least ping the interface with ICMP traffic.

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @WN
                  last edited by

                  If your saying dhcp is working for each of your vlans.. But you can not ping the IP of that interface. Then either your rule is not correct, or maybe you have something stepping on the IP of pfsense interface?

                  But your L2 connectivity is there if your getting dhcp. So rule would seem the issue to me. On your client trying to ping the IP of pfsense. What do you show for the mac of pfsense IP? Is it correct?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • W
                    WN
                    last edited by

                    So on my cisco switch:

                    switch#s arp
                    internet xxx.xxx.20.1 90.ec.770d.8e0b.8e0b

                    From pFsense
                    Diagnostics/ ARP Table:

                    Vlan20 xxx.xxx.20.1 90.ec.770d.8e0b.8e0b

                    I also gave the vlan on the switch an IP of .5 which is showing in the ARP table of both the switch and pFsense box with the poper MAC.

                    Losing my mind here can figure out why they are not communicating

                    xxx.xxx.20.5

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @WN
                      last edited by

                      And you can not ping the pfsense IP from the switch? Then that screams firewall rule dude!

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • W
                        WN
                        last edited by

                        ef9ae277-c7e4-49ef-b591-044b5cbc981c-image.png

                        So that rule wont allow traffic to PING the interface? Can you confirm so I'm not losing it.

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @WN
                          last edited by johnpoz

                          No - its TCP only! That doesn't allow ICMP.

                          tcp.jpg

                          Or UDP for dns either. If you want a ANY rule - icmp, tcp, udp, etc.. Then you have to set that in the rule and would show little *

                          anyrule.jpg

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • W
                            WN
                            last edited by

                            The top one should be correct then? I just want to get connectivity going and then I'll start peeling it back. Also, most of my experience is with ASA's. Do I need a bi-directional rule within the same interface?

                            832b7627-af6c-4cb5-b069-39c232d5a1b1-image.png

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @WN
                              last edited by johnpoz

                              Yeah that rule would be true any any rule.

                              edit: no you wouldn't need bidirectional rule, any return traffic would be allowed by the state created when inbound traffic to the interface is allowed.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • W
                                WN
                                last edited by

                                Yeah... Still didn't work.

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @WN
                                  last edited by johnpoz

                                  Well sniff on pfsense - pfsense can not answer ping if it never sees it.

                                  Its not rocket science here - the traffic is tagged or its not, etc Post up your switch port config on pfsense and your switch..

                                  If your seeing the mac - that says your L2 is connected.. If your rule allows for answer then it would work.

                                  edit: You don't have any floating rules do you?

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    WN
                                    last edited by

                                    No floating just the any/any on each interface. Below are the uplinks for each vlan 10,20 and 30. I removed the vlan interfaes off the switch and te defalt gateway. there should be no more layer 3 on the switch

                                    interface GigabitEthernet0/16
                                    description Uplink to pFsense Vlan 10
                                    switchport access vlan 10
                                    switchport mode access
                                    spanning-tree portfast

                                    interface GigabitEthernet0/32
                                    description Uplink to pFsense Vlan 20
                                    switchport access vlan 20
                                    switchport mode access
                                    spanning-tree portfast

                                    interface GigabitEthernet0/48
                                    description Uplink to pFsense Vlan 30
                                    switchport access vlan 30
                                    switchport mode access
                                    spanning-tree portfast

                                    11b043a1-8e22-462e-8ca4-eff7977eae9b-image.png Arp on

                                    4b370f40-1c27-4538-8194-6ccc8041431e-image.png

                                    520ab3df-6e88-4e9f-92b1-68cae51b5538-image.png

                                    f261fe9d-fd0f-46b7-94c0-3f514662305c-image.png

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @WN
                                      last edited by johnpoz

                                      @wn Nothing jumping out at me that is wrong there.. Have very sim setup on a 3100 with switch ports being untagged vlans.

                                      If your firewall rules are any any.. and you showing the mac in your device your trying to ping from.. Then you should get an answer..

                                      Really the only thing left to validate is traffic is being seen by pfsense - as stated if pfsense never sees the ping, it for sure can not answer. Seeing the traffic would have zero to do with rules being wrong or not, etc.

                                      edit: Just for reference and example.. Here is my very sim sort of setup

                                      mysetup.jpg

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • W
                                        WN
                                        last edited by

                                        I I believe me removing all layer 3 interfaces from the cisco switch might have done the trick. I can ping the interfaces from the server IP's.

                                        Thank you again for letting me bounce things off of you. Extremely important to have other eye look at your work. Thanks again!

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.