Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No DHCP on pfSense VLAN with Cisco Smart Switch

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    147 Posts 7 Posters 90.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pete35 @mvikman
      last edited by pete35

      hmmm lets asume that the switch is working properly.

      if we set the workstation manually to the desired ip address/mask and gateway, there
      should be a ping answer from the gateway on the pfsense.
      just an idea to check this out.

      next : change the workstation port to lets say port 23 and try to set the vlan there

      and maybe : reboot pfsense and change the cables

      <a href="https://carsonlam.ca">bintang88</a>
      <a href="https://carsonlam.ca">slot88</a>

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @pete35
        last edited by

        @pete35 all of that has already been done. Sniff on port going to pfsense no vlan tags - which has nothing to do with pfense

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        P 1 Reply Last reply Reply Quote 0
        • P
          pete35 @johnpoz
          last edited by

          @johnpoz
          we are using a lot of these switches and i never saw such problems. There are other problems with this switches but not within those basic vlan stuff. As these switches have a lifetime warranty from cisco, maybe a return and exchange will solve this issue. Otherwise im out of ideas what is wrong here.

          <a href="https://carsonlam.ca">bintang88</a>
          <a href="https://carsonlam.ca">slot88</a>

          C 1 Reply Last reply Reply Quote 0
          • C
            Cannondale @pete35
            last edited by

            I plugged in a Linux workstation into switch port 20, which was a normal lan port.
            Got an IP from pfSense as expected.
            Configured switch port 20 as a vlan using the cli. Note: port 20 was not previously configured as a vlan.

            Output below of:
            show vlan
            sho run int
            show interfaces switchport

            Note: Switch port 1 is the pfSense Trunk port.

            Roth-SG250-50P-1(config-if)#do show vlan
            Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN
            
            Vlan       Name           Tagged Ports      UnTagged Ports      Created by    
            ---- ----------------- ------------------ ------------------ ---------------- 
             1           1                            gi2-19,gi21-23,           DV        
                                                      gi25-50,Po1-4                       
             10      testvl10             gi1                gi24               S         
             20      testvl20             gi1                gi20               S         
            
            
            Roth-SG250-50P-1#sho run int gi1
            interface GigabitEthernet1
             switchport mode trunk
             switchport access vlan 10
             switchport trunk allowed vlan 10,20
            !
            
            Roth-SG250-50P-1#sho run int gi20
            interface GigabitEthernet20
             switchport access vlan 20
            !
            
            
            Roth-SG250-50P-1(config-if)#do show interfaces switchport ge1
            Name: gi1
            Switchport: enable
            Administrative Mode: trunk
            Operational Mode: up
            Access Mode VLAN: 10
            Trunking Native Mode VLAN: 1 (Inactive)
            Trunking VLANs: 10,20
            General PVID: 1
            General VLANs: none
            General Egress Tagged VLANs: none
            General Forbidden VLANs: none
            General Ingress Filtering: enabled
            General Acceptable Frame Type: all
            General GVRP status: disabled
            Customer Mode VLAN: none
            
            
            Roth-SG250-50P-1(config-if)#do show interfaces switchport ge20
            Name: gi20
            Switchport: enable
            Administrative Mode: access
            Operational Mode: down
            Access Mode VLAN: 20
            Trunking Native Mode VLAN: 1
            Trunking VLANs: 1,10,20
                                    2-9,11-19,21-4094 (Inactive)
            General PVID: 1
            General VLANs: none
            General Egress Tagged VLANs: none
            General Forbidden VLANs: none
            General Ingress Filtering: enabled
            General Acceptable Frame Type: all
            General GVRP status: disabled
            Customer Mode VLAN: none
            
            
            Roth-SG250-50P-1(config-if)#do show interfaces switchport ge24
            Name: gi24
            Switchport: enable
            Administrative Mode: access
            Operational Mode: up
            Access Mode VLAN: 10
            Trunking Native Mode VLAN: 1
            Trunking VLANs: 1,10,20
                                    2-9,11-19,21-4094 (Inactive)
            General PVID: 1
            General VLANs: none
            General Egress Tagged VLANs: none
            General Forbidden VLANs: none
            General Ingress Filtering: enabled
            General Acceptable Frame Type: all
            General GVRP status: disabled
            Customer Mode VLAN: none
            
            

            I ran tcpdump -i igb1 -e on the pfSense server while plugging in the Linux workstation into port 20.
            Searched the sniffer output for "vlan" and did not find that string.

            P 1 Reply Last reply Reply Quote 0
            • P
              pete35 @Cannondale
              last edited by

              @cannondale

              Try to configure another port to vlan 10 from/with the GUI. Save the config and reboot the switch and test afterwards. I just checked one of my switches and it works straightforward.

              <a href="https://carsonlam.ca">bintang88</a>
              <a href="https://carsonlam.ca">slot88</a>

              C 1 Reply Last reply Reply Quote 0
              • C
                Cannondale @pete35
                last edited by

                @pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                Try to configure another port to vlan 10 from/with the GUI. Save the config and reboot the switch and test afterwards.

                Thanks for the suggestion pete35!
                Configured switch port 23 to be a member of vlan 10 via GUI.
                copied running-config to startup-config

                Show output below.

                Roth-SG250-50P-1#show vlan
                Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN
                
                Vlan       Name           Tagged Ports      UnTagged Ports      Created by    
                ---- ----------------- ------------------ ------------------ ---------------- 
                 1           1                            gi2-19,gi21-22,           DV        
                                                          gi25-50,Po1-4                       
                 10      testvl10             gi1              gi23-24              S         
                 20      testvl20             gi1                gi20               S         
                
                Roth-SG250-50P-1#sho run int gi1
                interface GigabitEthernet1
                 switchport mode trunk
                 switchport access vlan 10
                 switchport trunk allowed vlan 10,20
                !
                Roth-SG250-50P-1#sho run int gi23
                interface GigabitEthernet23
                 switchport access vlan 10
                

                Ran tcpdump -i igb1 -e on the pfSense box while plugging in the Linux workstation into port 23. Searched the sniffer output for "vlan" and did not find that string.

                Note: was not able to bounce the switch before the test as several users are using the system.
                Can try that later today if it would help.

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @Cannondale
                  last edited by johnpoz

                  @cannondale said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                  was not able to bounce the switch before

                  There is no reason you should have to bounce the switch, the only time you should ever have to reboot a switch is if you are updating its firmware.

                  Well @mvikman shows his output as showing that vlan 1 as native for ingress and says its working.. Which isn't what the output would express if you ask me.

                  But yours isn't

                  My sg300 correctly shows that native ingress on whatever access vlan I put on a port.. See my example output where I change the port 28 to different vlan and then back, etc..

                  Maybe the sg250 is just crap when it comes to what the cli shows - but then why isnt this working?

                  For a last hope go to general mode and specifically set the native vlan and the vlan your on..

                  But sorry if your not seeing tagged coming into pfsense where you have a vlan setup - its never going to work.. That is for sure..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  C 1 Reply Last reply Reply Quote 0
                  • C
                    Cannondale @johnpoz
                    last edited by

                    johnpoz, thanks for continuing to hang in there!
                    The Interface Settings page in the GUI only shows two options for a port. Access and Trunk.

                    Screenshot from 2023-05-23 19-01-04.png

                    But the Port VLAN Membership page in the GUI shows Access, Trunk, General and Customer.

                    Screenshot from 2023-05-23 19-05-42.png

                    My question is can I change the port access mode to General in the cli if the General option in not available in the GUI? If so would it appear as General on the Port VLAN Membership page?

                    1 Reply Last reply Reply Quote 0
                    • C
                      Cannondale
                      last edited by

                      Update:

                      Tried configuring port 20 (VLAN20) via cli to general mode.

                      Roth-SG250-50P-1(config)#do sho run int ge20
                      interface GigabitEthernet20
                       switchport mode general
                       switchport general allowed vlan add 20 untagged
                       switchport access vlan 20
                       switchport general pvid 20
                      !
                      
                      Roth-SG250-50P-1(config-if)#do sho run int ge1
                      interface GigabitEthernet1
                       switchport mode trunk
                       switchport trunk allowed vlan 10,20
                      !
                      

                      Looked at the GUI Port VLAN Membership page, which looked ok to me.
                      Couldn't upload the screenshot here do to error:parse-error.
                      Here is the text version:

                      F - Forbidden member	T - Tagged member	U - Untagged member	I - Inactive VLAN	P - PVID
                      Interface	Mode	Administrative VLANs	Operational VLANs
                      GE1	        Trunk	1UI, 10T, 20T	                10T, 20T	
                      GE20	        General	20U, 20P	                20U
                      

                      Ran tcpdump -i igb1 -e on the pfSense box while plugging in the Linux workstation into port 20. Searched the sniffer output for "vlan" and did not find that string.

                      OMG!

                      1 Reply Last reply Reply Quote 0
                      • M
                        mvikman
                        last edited by

                        Just a thought... the CBS-series GUI has a dropdown menu on the top right that switches between Basic and Advanced views, the Basic hides some stuff on the menus. Does the SG250 have that?

                        1cbd6ac1-02d2-41ef-b11f-969f79c4a665-image.png

                        pfSense Plus 24.11-RELEASE (amd64)
                        Dell Optiplex 7040 SFF
                        Core i5-6500, 8GB RAM, 2x 240GB SSD (ZFS Mirror)
                        HPE 561T (X540-AT2), 2-port 10Gb RJ45
                        HPE 562SFP+ (X710-DA2), 2-port 10Gb SFP+

                        P C 2 Replies Last reply Reply Quote 1
                        • P
                          pete35 @mvikman
                          last edited by pete35

                          @Cannondale I did a quick configuration on a local CBS350 Switch with a tagged port from a pfsense to that switch similar the configuration you have. Requesting a DHCP address from a workstation on an acces port and dumping the traffic with tcpdump on the pfsense. Tcpdump doesn't show up any VLAN Information with tcpdump -i ix0 -e - but opening the dumpfile with wireshark shows DHCP Request and DHCP Ack to that port and to an Access port on that switch which works without any issues. Maybe you should search for DHCP in your dumpfile and not for vlan ?

                          Doing a PacketCapture on the pfsense also doesn't show up (with Wireshark) any VLAN information, but the DHCP Request and Ack Sequence.

                          It is not common to see Vlan tags on packet capture or tcpdump files, you need to configure the adapter for that. It looks like pfsense is not configured to show vlan tags on the interfaces for capturing.

                          Im assuming that your switch doing its job correctly.

                          TESTSWITCH#sh vlan
                          Created by: D-Default, S-Static, G-GVRP, R-Radius Assigned VLAN, V-Voice VLAN
                          Vlan Name Tagged Ports UnTagged Ports Created by


                          1 1 gi1/0/5, D
                          101 TEST1 gi1/0/5 gi1/0/6 S

                          TESTSWITCH#sh run interface gi 1/0/5
                          interface GigabitEthernet1/0/5
                          switchport mode trunk
                          switchport trunk allowed vlan 1,101
                          !
                          TESTSWITCH#sh run interface gi 1/0/6
                          interface GigabitEthernet1/0/6
                          switchport access vlan 101

                          <a href="https://carsonlam.ca">bintang88</a>
                          <a href="https://carsonlam.ca">slot88</a>

                          johnpozJ C 2 Replies Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @pete35
                            last edited by

                            @pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                            Tcpdump doesn't show up any VLAN Information with tcpdump -i ix0 -e

                            And how is that - if your traffic is not tagged.. ?

                            tagged.jpg

                            It is not common to see Vlan tags on packet capture or tcpdump files

                            It is when you use -e

                            -e
                                Print the link-level header on each dump line. This can be used, for example, to print MAC layer addresses for protocols such as Ethernet and IEEE 802.11.
                            

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            P 1 Reply Last reply Reply Quote 0
                            • P
                              pete35 @johnpoz
                              last edited by

                              @johnpoz

                              Showing up VLAN tags may depend on the pfsense type/version/device driver and the nic. At least within my configuration it doesnt show up any VLAN Tags. Lets check cannondales dump file again.

                              <a href="https://carsonlam.ca">bintang88</a>
                              <a href="https://carsonlam.ca">slot88</a>

                              johnpozJ DerelictD 2 Replies Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @pete35
                                last edited by johnpoz

                                @pete35 said in No DHCP on pfSense VLAN with Cisco Smart Switch:

                                type/version/device driver and the nic

                                Possible.. But if it was working and sending the tags, why is his dhcp server not seeing the discover?

                                For it to work, the tags have to be there - so why wouldn't basic function of tcpdump not show them?

                                He is using igb interfaces - same as me. Maybe there is something with your ix interfaces, but have been using tcpdump for years.. I have never seen such an issue on all kinds of different hardware and OSes - and it for sure has worked on freebsd and pfsense going back as far as I can remember.

                                edit: Just ordered a sg250-08HP off ebay.. Going to play with one of these myself.. This can not be this difficult ;) Says should be here

                                Estimated delivery:
                                Sat, May 27 - Tue, May 30

                                Hoping for the 27th ;)

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                P C 2 Replies Last reply Reply Quote 0
                                • C
                                  Cannondale @mvikman
                                  last edited by

                                  @mvikman
                                  This is what my menu looks like:

                                  Screenshot from 2023-05-24 06-40-01.png

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    pete35 @johnpoz
                                    last edited by

                                    @johnpoz
                                    i cant imaging how this switch shouldnt do vlan tagging correctly. If its defect it wouldnt do anything. There are thousand of SGXXX switches out there, googleing for vlan tagging problems doesnt give any problems at all.

                                    for the tcpdump vlan story: you see the vlan tags if running tcpdump with "-v". With "-w" it goes to a file which can be open with wireshark, vlan tags are not shown there by default.

                                    <a href="https://carsonlam.ca">bintang88</a>
                                    <a href="https://carsonlam.ca">slot88</a>

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @pete35
                                      last edited by johnpoz

                                      @pete35 its quite possible he is looking at his output from tcpdump wrong? But I was quite clear on how to do it and showed examples.. Its a simple std output to the screen.

                                      I am with you - there are 1000's or even 10s or 100s of thousands of these out there - if there was some issue with vlans you would think it would be easy enough to find people complaining.

                                      I will have one to play with here in a few days ;) As long as it works - it will allow me to get rid of an injector using for my flex HD unifi AP have sitting on my floor in my computer room..

                                      Its an open box off ebay - so you never know. But says fully operational just missing couple of the rubber feet on the bottom ;)

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      P 2 Replies Last reply Reply Quote 0
                                      • P
                                        pete35 @johnpoz
                                        last edited by pete35

                                        @johnpoz

                                        I would really like to know the issue here. CBS350 or Catalyst 1000 is the better modern choice for this switches. SG250 is really old in terms of Cisco switches. Most of the models arent supported anymore by new firmware versions. Vlans are are working for pfsense and also for this Cisco switch. So there must be a issue between them or on layer 8 maybe.

                                        <a href="https://carsonlam.ca">bintang88</a>
                                        <a href="https://carsonlam.ca">slot88</a>

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • C
                                          Cannondale @pete35
                                          last edited by

                                          Thanks for your efforts pete35! Very interesting information.
                                          Not familiar with wireshark. Will install it and see what I can find.

                                          I did check the pfSense DHCP log for DHCPREQUEST on the vlan20 IP but don't see anything. Just the entry for "Listening on BPF/igb1"

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            pete35 @johnpoz
                                            last edited by

                                            @johnpoz @Cannondale

                                            pls reboot that switch:

                                            393b7dae-4799-4e45-bab2-e0defb11f3fe-image.png

                                            <a href="https://carsonlam.ca">bintang88</a>
                                            <a href="https://carsonlam.ca">slot88</a>

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.