Cant ping vlan on pf sense from any device?
-
@johnpoz It is all just old equipment I use for home use so no i do not care about speed. it supports my wireless devices just fine. My AP is connected to port 8 on my cisco switch.
Yes correct on pf sense, my lan1 is 192.168.1/24 your vlan 20 is 192.168.20/24.I do not know how to assign a SSID to my vlan network. i do not know if i do that only unifi (if so how).
If i have to set anything up in Pf sense for this aside from what I already shared. I am not sure. As in PF Sense there is a wireless interface which i have nothing setup.
here is the firewall block rule.
here is the firewall allow rule
I was under the impression that I had to be able to ping 192.168.20.1 (pf sense vlan20 IP) from a device on my network (PC on netgear switch, or from cisco switch etc. for it to even see that and get a response). Then i was informed (from others) to try and ping 20.1 IP from pf sense itself and i couldn't etc.
What else do i need to do to get all of this working?
Thank you again for helping me. I really appreciate it.
-
@travelmore said in Cant ping vlan on pf sense from any device?:
Then i was informed (from others) to try and ping 20.1 IP from pf sense itself and i couldn't etc.
If pfsense can not ping its own IP - then yeah something is clearly wrong. I would fix that before you worry about anything else.. Rules wouldn't have anything to do with pfsense not being able to ping its own IPs.. Clearly something is not correct if pfsense can not ping its own IP, be a native IP directly on the interface, or a vlan interface.
Did you actually assign an interface for your vlan?
I already posted how to set ssid to a vlan in unifi..
-
@johnpoz yes I believe i did assign an interface to my vlan. this is what i see below.
then this is the vlan section
then this is the plan dhcp setup (just incase for reference)
here is the DHCP setup for vlan20 settings. i did just notice, that in this setting, i did not setup my DNS server as my pihole so idk if that is what the issue is? (i did not change it i left it be as the screenshot below and asked here incase it would be the issue)
for the unifi wifi part i went back and looked at your settings and made an adjustment to mine. please see below. I went to wifi, then hit create new wifi network, named it smart bulbs w/a password. I do not know if what i did was correct but I'm trying. When i did click on my default network, the vlan only network is grayed out (pic below) and so that is why i created a new network.
new network created called smart bulbs w/password.
here is networks over view:
here is wifi over view
-
@travelmore but pfsense can not ping itself? something is serious wrong then.
-
@johnpoz here is the actual pf sense box IP, it can ping itself but when it comes to the vlan20 IP i sent for it 20.1. it cannot.
-
@travelmore well something is wrong.. You should be able to ping pfsense own IP address.. Not sure how its going to work if it can not even talk to itself..
I would disable and re-enable the network interface..
What does your routing table look like? Here are my two tagged vlans in the route table, and me pinging them.
-
@johnpoz well, i disabled the interface and pinged it (just for measure) and got the results below.
THEN I enabled the interface as you suggested. Tried pinging it again and got this
then after seeing that progress, i went to my cisco switch and tried to ping, no luck.
then i tried to ping from my pihole that is physically connected to port 2 on my netgear switch (only on vlan1) and i could ping the 20.1 IP, see below.
here is the routing table, to note, there is nothing past the IPV6 Routes table.
Since we are making progress it seems by just disabling and renableing that interface, what are the next steps to get this to the end goal of vlan20 on my wireless AP?
Again, thank you so much for all your help.
-
@travelmore well I already went over why your switch might not be able to ping it. What is the route table look like on your switch.
So do clients that connect to your ssid on vlan 20, get an IP? When you created that new ssid and assigned it to your smart bulbs network, I saw that you created a smart bulbs network vlan only, I assume you set the vlan ID to 20.
But I don't see where you stated what port you connected your AP to your 2960, nor do I see any ports on the 2960 that you posted that are tagged for vlan 20 going to your AP. Nor any ports on vlan 20 that are the uplink through your dumb switch back to your netgear switch, etc.
pfsense - 1U,20T -- netgear -- 1U,20T -- dumbswitch -- 1U,20T - cisco -- 1U,20T -- AP -
@johnpoz so literally on port8 on my netgear switch is the AP that my smart bulb vlan is plugged into. yes, i did set the vlan on the unifi to vlan20. I do not have anything on this smart vlan except for the smart bulbs if i can ever get them connected. on my phone i tried connecting my phone to the smart bulb wifi and it said failed to obtain IP address. and here is a pic below.
-
@travelmore said in Cant ping vlan on pf sense from any device?:
I still have to ask, are you sure you're actually applying any settings you make??
That image still shows the "apply changes" button and it shouldn't. -
@jarhead yes i dont know why it said that but it did.
here is a pic of pf sense pinging 20.1 IP
and here is that interface settings page w/no message at the top
-
@travelmore Yes, but that's after John had you bounce the interface. There's no way that "apply" button would be there if you clicked it. This would also explain why the interface had the "N/A" instead of an IP address.
-
@travelmore said in Cant ping vlan on pf sense from any device?:
literally on port8 on my netgear switch is the AP that my smart bulb vlan is plugged into
That is not how you have it draw at all - you show all your AP plugged into your cisco.
You show untagged vlan 20 on port 8 of your cisco, but how exactly does vlan 20 get there? You have no other ports in vlan 20..
If this netgear, and pvid on ports 4 and 8 are 1 then this is correct. if pfsense re0 is plugged in to port 4 and your AP is plugged into port 8
I am with @Jarhead as well, when you make a change to any gui page you have to hit save/apply etc..
A client connecting to your ssid for your smartbulbs should get vlan 20 address. Devices connecting to your other ssid without any vlan on it should be on your lan network.
Testing that vlan 20 is working, put a port on your netgear in vlan 20, untaggged, with pvid set to to 20. Plug in your laptop and it should get an IP on your vlan 20 network. And make sure you remove vlan 1 from this port.
-
@johnpoz and @Jarhead I checked. I think after we disabled and re-enabled that interface that fixed that issue because I see this now.
my apologies, i must have typo'd when i stated "literally on port8 on my netgear switch is the AP that my smart bulb vlan is plugged into", that was an incorrect statement, i meant literally on port 8 on my Cisco switch is the AP that has the smart bulbs wifi setup and on vlan 20.
on my netgear switch port 8 is only vlan20 so i could plug a PC in for testing purposes if needed.
i have tried again to connect my cell phone to the Smartbulbs ssid and it fails.
-
@travelmore said in Cant ping vlan on pf sense from any device?:
on port 8 on my Cisco switch is the AP that has the smart bulbs wifi setup and on vlan 20.
Well how exactly is vlan 20 going to get to that switch from pfsense.. If you only have 1 port in vlan 20?
See my little ascii drawing from before.
pfsense - 1U,20T -- netgear -- 1U,20T -- dumbswitch -- 1U,20T - cisco -- 1U,20T -- AP -
@johnpoz I did not understand that drawing. but after looking at it again, i believe i have to set port 1 which connects my cisco switch to my dumb switch to be on vlan20 as tagged. then it should all work, right?
If that is correct. this is what i have done below
tried again to connect my phone to the smart bulbs ssid and no luck.
when i did make the change for the cisco switch i had to do that via concole cable because while i was trying it i lost connection and couldnt get back in, so i console-cabled in and grabbed that screenshot of the settings. after making those changes i am not able to remotely connect to my cisco switch via putty and i get network error: connection timed out but i am able to console cable in.
that being said, while consoled into my cisco switch, i cannot ping out at all.
i am not sure how to fix being able to remote into the cisco switch/ping from it now.
what i type in was:
conf t
then, interface f0/1
then switchport mode access
then switchport access vlan 20
then no shut
then exit
then ctrl z
then writethen i could'nt connect to cisco remotely (so i consoled in to get the screen shot above) and now i still cant connect remotely to my cisco switch.
Gosh, I am not sure what in the world happened from the settings i changed on my cisco switch as shown above.
i feel like im somewhat so close to getting this all figured out.now my cell phone is trying to connect to my normal network and says 'ready to connect when network quaility improves'.
what is next? what do i need to do?
thank you again for all your help. -
@travelmore As I showed vlan 1 untagged, this your lan.. And vlan 20 Taggged (1U, 20T).. In cisco lan this a trunk port. Not a access port..
If you do not understand what tag or untagged vlan is - your going to have a really hard time working with vlans..
sg300-10#sho vlan Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN Vlan Name Tagged Ports UnTagged Ports Created by ---- ----------------- ------------------ ------------------ ---------------- 1 1 V 2 Wlan gi9 gi8 S 3 DMZ gi2,gi9 gi7 S 4 W_PSK gi8-9 S 6 W_Guest gi8-9 S 7 W_Roku gi8-9 gi2,gi6 S 9 9 gi1,gi3-5,gi9-10, D Po1-8 10 disabled S sg300-10#sho run int gi9 interface gigabitethernet9 description "Uplink sg300-28" switchport trunk allowed vlan add 2-4,6-7 ! sg300-10#sho run int gi8 interface gigabitethernet8 flowcontrol on description "UAP-AC-Lite (Kitchen)" switchport trunk allowed vlan add 4,6-7 switchport trunk native vlan 2 ! sg300-10#On port 8 I have native vlan 2 set because this is the vlan my AP are on for management which is untagged. I talk to the switches on vlan 9. You see that is untagged on port 9 which is port that connects to my upstream switch sg300-28, that is connected to my pfsense.
If you put the port that connects through the dumb switch to your netgear only on vlan 20, how would you talk to the switch via default vlan 1 which is your lan network..
-
@johnpoz After what you mentioned about trunk port instead of access. I made the following changes below. please see the cmds typed in the screenshot. hopefully, that is correct.
on my cisco switch, port 8 is the AP that is plugged in. on port 1 is the cable that connects from my cisco switch to my dumb switch.
here are some more settings of my cisco switch currently
yes I agree i have more reading / learning to do w/tagged & untagged.what do i need to fix or is that correct?
my normal ssid wireless is acting weird after making those changes, not allowing things to connect etc. so i am not sure if adding the vlan to the cisco switch made it worse or not.
I went to check my APs and it seems like something is off. see the screenshots below. I am not sure what needs to be fixed.
-
@travelmore where is 192.168.0 ??
I thought your lan was 192.168.1/24
Why would your AP be on a 192.168.0 network?
From your cisco - you have 20 trunk only on port 8, how does vlan get to this switch from your pfsense??? What are you not understanding about this?
pfsense - 1U,20T -- netgear -- 1U,20T -- dumbswitch -- 1U,20T - cisco -- 1U,20T -- APYour lan is native and untagged.. 192.168.1.x this would be the default vlan on your switch.. You then tag vlan 20 on same lan interface re0.. So your switch that connects to pfsense lan interface would need to be vlan 1 untagged. Vlan 20 tagged.
Now as you pass this traffic to your cisco.. Again vlan 1 untagged and tagged vlan 20.. Your dumb switch is stupid he doesn't know anything about tags, but you still have to tag the traffic as it gets sent to your dumb switch.. Then as it enters the cisco, the cisco needs to know that untagged traffic is vlan 1, and that tagged traffic on 20 goes where, etc..
So on the port your AP connected to vlan 1 would be untagged, and vlan 20 would be tagged.
Just at a loss to where/why your AP are on this 192.168.0 network?? Yeah that isn't going to work..
-
@johnpoz Okay good catch. that is weird i scrolled up and looked at the pics and they do show
the 192.168.1 address. i didn't change anything in those settings the only thing i did was change those commands on the cisco switch.
how does something like that even change?
