No DHCP on pfSense VLAN with Cisco Smart Switch

johnpoz

@pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

anymore by new firmware versions

The sg250 seems to have gotten a firmware release quite recent.

My own sg300 hasn't had one since 18-Jun-2020

Pretty sure he has rebooted - since I know he changed firmwares at one point, etc.

mvikman

He originally had the latest firmware installed

Roth-SG250-50P-1
v2.5.9.16 / RCBS3.1_930_871_10

Also his latest "show tech" shows that firmware 2.5.9.16 is active

------------------ show version ------------------
Active-image: flash://system/images/image_tesla250_hybrid_2.5.9.16_release_cisco_signed.bin
  Version: 2.5.9.16
  MD5 Digest: c1f283dd662260f1532ef8cb26158014
  Date: 27-Feb-2023
  Time: 16:57:47
Inactive-image: flash://system/images/SG250-50P-Firmware_Backup_v2.4.0.94-image1-20230428.bin
  Version: 2.4.0.94
  MD5 Digest: 6f5be217100f34929986f2e93dd2d5e9
  Date: 31-May-2018
  Time: 02:39:58

Cannondale

@mvikman said in No DHCP on pfSense VLAN with Cisco Smart Switch:

He originally had the latest firmware installed

Confirmed the latest fw is active.

Screenshot from 2023-05-24 07-35-03.png

johnpoz

@mvikman yeah he has gone to older firmware at one point

Cannondale

@johnpoz said in No DHCP on pfSense VLAN with Cisco Smart Switch:

Just ordered a sg250-08HP off ebay

You're a stand up guy for going the extra mile johnpoz!
No need to spend your money to help solve my problem!
PM me and let me know how much it was so that I can reimburse you.

pete35

@Cannondale
i tought the same. Johnpoz is great.

can you post the whole page of the vlan 10 interface configuration on the firewall ?

Derelict

If you pcap on the parent interface you will see all the VLAN tags there along with all traffic on all VLANs. If you pcap on the VLAN interface you will not see the tags.

I sometimes create unnumbered pfSense interfaces on the parent (IPv4 and IPv6 set to None) just so I can pcap there.

Cannondale

@pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

can you post the whole page of the vlan 10 interface configuration on the firewall ?

vlan10 is configured for access mode on ge24
vlan20 is configured for general mode on ge20

Screenshot from 2023-05-24 08-33-22.png

Screenshot from 2023-05-24 08-33-55.png

pete35

@Derelict
thank you. i already found it. Wireshark shows the vlan tag under each packet. yo need to open a packet to see the vlan 802.1q information.

pete35

@Cannondale

Maybe we can do another configuration:

if you have a free port on your Pfsense, just configure it as LAN port with the IP address of your VLAN 10, first clear that VLAN 10 interface including that DHCP Server. Then configure two ports on the switch as access port in vlan 10. Connect one port directly to the second/new LAN port of pfsense, the other one to your workstation. You need to configure the DHCP Server at the new LAN port.

Your workstation should be able to get an IP DHCP address from Pfsense in this VLAN 10.

So no tagging is needed, if that is an issue with that switch.

Cannondale

@pete35
wireshark doesn't seem to be noob friendly. I'm in a "packets must be specified" loop!

Cannondale

@pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

Maybe we can do another configuration

Working on it now

Cannondale

@pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

Your workstation should be able to get an IP DHCP address from Pfsense in this VLAN 10

Got a vlan10 IP on the workstation. Didn't need to reconfigure the switch for vlan10 as port 23 and 24 were already configured for vlan10.

sw vlan.png

pete35

@Cannondale
That sounds good. Add more vlan 10 access ports to connect your servers and so on.
Until you find another solution with that tagging issue, this is as good as a trunked port and seperates the traffic.
Dont forget to add some firewall rules to limit the access to vlan 10 if you need this. Pfsense will route between Vlans.

pete35

@Cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

wireshark doesn't seem to be noob friendly. I'm in a "packets must be specified" loop!

@Cannondale
this sounds interesting. if you startup wireshark on your interface of a workstation, it should work out of the box. So maybe there is something crazy on your network at all. Did you select the correct running interface?

if you generate a tcpdump file with "tcpdump -i interface -e -w dumpfile.pcap" you can open it with wireshark and you can save captured wireshark packets into a file for later analysis.

Cannondale

@pete35
Plugged the test Linux workstation into switch port 20 (vlan20).
I was able to create a dumpfile.pcap file on pfSense and open it on another machine in Wireshark. As a non-Network Engineer, what should I look for?

Cannondale

@pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

if you startup wireshark on your interface of a workstation, it should work out of the box.

This is what I was seeing after entering some host information:

pete35

@Cannondale

looks like it needs some more parameters on startup or needs some more priviledges (root?)
check the "-c" parameter and maybe check all this here:
https://adamtheautomator.com/wireshark-linux/

pete35

@Cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

Plugged the test Linux workstation into switch port 20 (vlan20).

Do you need another vlan ? Or is this just for investigation?
You can configure another vlan with the same trick, if you have more interfaces on the pfsense.

If you can, you may wipe out the whole configuration on the switch and reset it to an initial state. Configure it then only on the GUI. There are a lot of configuration options, maybe not shown on the cli. So if something is hidden, it may influence this crazy vlan issue.

https://www.cisco.com/c/dam/en/us/td/docs/switches/lan/csbss/sf_sg250/quick_start/guide/en_US/78-100762-01A0.pdf

Cannondale

@pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

Do you need another vlan ? Or is this just for investigation?

Both. Ultimately need to confirm whether the switch is having an issue with tags. If not a config issue, I will replace it.

@pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

You can configure another vlan with the same trick, if you have more interfaces on the pfsense.

Understood. I'm not a network expert but I recall that this is called segmentation. My quad port card in the pfSence server is full now. It appears that using additional NIC ports to segregate the LAN is a hardware approach as opposed to the vlan approach. My preference would be to use vlans unless a particular use case suggests that segmentation would work better.