Setting up a VLAN part 2

A Former User · Jun 28, 2012, 1:37 AM

Part 1 is here and it is ugly, but i am linking it as a reference.

http://forum.pfsense.org/index.php/topic,44488.0.html

ok, since that thread, i think i need to take a step back and do this in baby steps just to make sure i am doing everything right and not trying to take too much information all at once.

my pfsense has 3 interfaces, but i only want to use 2 of them (for the purpose of vlans and testing with only a WAN and LAN interface).

Physical Interfaces:

re0- WAN
re2- LAN

Virtual Interfaces:
wifi- vlan 100 on re2 (vlan100)

wifi interface settings:

type- static
ip- 10.10.10.1

Services- DHCP Server

10.10.10.10-10.10.10.50

everything else is blank (the dhcp server settings mirror my LAN DHCP server settings and LAN is working w/o any issues, so i left it at that).

now for the HP vlan switch settings….default state with 5 ports being used on the existing 192.168.1.x network (LAN).

there is 1 default VLAN in the HP switch

VLAN Name- Default Vlan
VLAN 1

U,U,U,U,U,U,U,U

thats it.

now, before i talk about brining in a wifi AP, my goal is to set this up with a spare laptop plugged into port 2 of my HP switch and run that off of VLAN 100 from pfsense. and i should add that port 6 on the HP switch plugs into a 16 port netgear switch (not managed) on my network. i want all PCs on the netgear switch to run on the 192.168.1.x network as well as the few devices i have in the HP switch taking up spots. my only open ports in the vlan HP switch are 1,2,6, everything else is in use.

1, is that possible?
2, would i set it up as follow:

Vlan 1 (HP switch)

TEUUUUUU (port 1 is pfsense re2 interface, port 2 is vlan PC/device).

Vlan 100 (HP switch)

TUEEEEEE (port 1 is pfsense re2 interface, port 2 is vlan PC/device).

i hope whoever attempts to help me isnt lost, if so i can try to break it down.

EDIT

does the NIC in the laptop and the netgear switch (running the rest of my network) have to be VLAN ready?

meaning, even though the ports they are plugged into on the HP switch might be configured to run on on the proper VLAN, does the NIC and switch still need to have VLAN capabilities?

if that is the case, maybe i have been setting up the HP switch right all along (above) and was lacking the rest of the VLAN equipment.

stephenw10 · Jun 28, 2012, 8:22 AM

That first thread is epic! ;)

Yes that is possible but you are using the same interface for tagged and untagged traffic which can cause problems and should be avoided if possible. Why don't you want to use the 3rd interface?

The switch setup looks correct though I'm not familiar with thosse switches.

The laptop and unmanaged switch do not have to deal with VLANs at all so will be fine. The VLAN tags are stripped or added at the HP switch port.

Steve

A Former User · Jun 28, 2012, 4:50 PM

@stephenw10:

That first thread is epic! ;)

Yes that is possible but you are using the same interface for tagged and untagged traffic which can cause problems and should be avoided if possible. Why don't you want to use the 3rd interface?

The switch setup looks correct though I'm not familiar with thosse switches.

The laptop and unmanaged switch do not have to deal with VLANs at all so will be fine. The VLAN tags are stripped or added at the HP switch port.

Steve

i'd like to try to get it running with 1 port mainly because i think i can teach myself something doing it on 1 port.

also, i read about people on here that have multiple vlans (20, 30, 40) and i know while that might not be a common scenario, they still have to be doing it with few (if not one) physical interfaces.

thoughts? should i give up on this (i dont like giving up) and focus on opt1?

is it possible that they are building multiple vlans but keeping it on a opt1/secondary interface (away from the main LAN)? if so, that would make sense.

thanks.

edit- yeah that thread was epic. i went back and re-read alot of it, setup my switch and pfsense as marcelloc stated in one post (which did make sense to me, yesterday) and i still wasnt having any luck. i can post it, but it wont matter at this point.

Metu69salemi · Jun 28, 2012, 5:00 PM

Was the case that you have your LAN in vlan1 and WIFI in VLAN100 and in same interface?
if so then your settings on switch should be


VLAN 1: U N and the rest U
VLAN 100: T U and the rest N

Legend:
U = Untagged
T = Tagged
N = no access or similar

A Former User · Jun 28, 2012, 5:45 PM

@Metu69salemi:

Was the case that you have your LAN in vlan1 and WIFI in VLAN100 and in same interface?
if so then your settings on switch should be
VLAN 1: U N and the rest U
VLAN 100: T U and the rest N

Legend:
U = Untagged
T = Tagged
N = no access or similar

yes, exactly.

i will try to set it up like this and report back.

EDIT- my switch (netgear, not vlan ready) is in port 6 of the vlan switch. how should i handle that? U for vlan 1 and N for vlan 100?

stephenw10 · Jun 28, 2012, 5:47 PM

You can certainly do this with one interface and run just about as many vlans on it as you want.
You should avoid tagged and non-tagged traffic if you can but it may well work just fine if you can't. Since you're just experimenting it's not a problem so go for it.
That said what I would do is put your LAN traffic on a VLAN also so that all your traffic is tagged. The difficulty with doing this that if you get the config wrong you can end up locked out of your box and it quickly becomes frustrating when you keep having to start over.
Why not setup your extra interface just as a management interface. Make sure you can always get back into the box via that.

There is some confusion here regarding VLAN1. The is the default VLAN which I believe is actually just untagged? (at least outside of the switch) To avoid this always use high numbers, like VLAN100 you are already using.

Steve

A Former User · Jun 28, 2012, 6:05 PM

vlan 1 is just the default vlan of the hp switch.

i am still getting confused with the tagged/untagged. everytime i think i have it and try to see if what i get matches up with what is said on here, i am always opposite.

when i am all done with this, i want my HP vlan switch to be accessible via the IP it has, now, which is 192.168.1.20, i dont need to be able to access it from the vlan network (but that is another question at another time).

what i am wanting to do/test is to have 1 cable connecting my pfsense and the hp vlan switch and over that 1 cable i want to have 192 and 10 traffic. then, assuming the hp switch is setup properly, i want to do the following

port1- pfsense LAN
port2- test laptop or wifi router (statically assigned 10.10.10.2 for access at a later time) 10.10.10.x network (vlan 100)
port3- cant use (trunked/bond)
port4- cant use (trunked/bond)
port5- connects to a PC i want to keep on the 192.168.1.x network
port6- connects to my 16 port netgear switch that has additional 192.168.1.x devices
port7- open (no need for vlan100 access)
port8- open (no need for vlan100 access)

Metu69salemi · Jun 28, 2012, 7:05 PM

@tomdlgns:

@Metu69salemi:
Was the case that you have your LAN in vlan1 and WIFI in VLAN100 and in same interface?
if so then your settings on switch should be
VLAN 1: U N and the rest U
VLAN 100: T U and the rest N

Legend:
U = Untagged
T = Tagged
N = no access or similar
yes, exactly.

i will try to set it up like this and report back.

EDIT- my switch (netgear, not vlan ready) is in port 6 of the vlan switch. how should i handle that? U for vlan 1 and N for vlan 100?

Yes like that, if you have switch which doesn't have vlan capability, then you connect that port like any computer.


Port 1: vlan1 untagged, vlan100 tagged <-- best method would be tagged/tagged, but then you should use stephens method
port 2: vlan2 no access, vlan100 untagged
port 3: ? 
port 4: ?
port 5: vlan1 untagged, vlan100 no access
port 6: vlan1 untagged, vlan100 no access
port 7: ?
port 8: ?

A Former User · Jun 28, 2012, 7:19 PM

@Metu69salemi:

@tomdlgns:
@Metu69salemi:
Was the case that you have your LAN in vlan1 and WIFI in VLAN100 and in same interface?
if so then your settings on switch should be
VLAN 1: U N and the rest U
VLAN 100: T U and the rest N

Legend:
U = Untagged
T = Tagged
N = no access or similar
yes, exactly.

i will try to set it up like this and report back.

EDIT- my switch (netgear, not vlan ready) is in port 6 of the vlan switch. how should i handle that? U for vlan 1 and N for vlan 100?
Yes like that, if you have switch which doesn't have vlan capability, then you connect that port like any computer.
Port 1: vlan1 untagged, vlan100 tagged <-- best method would be tagged/tagged, but then you should use stephens method
port 2: vlan2 no access, vlan100 untagged
port 3: ? 
port 4: ?
port 5: vlan1 untagged, vlan100 no access
port 6: vlan1 untagged, vlan100 no access
port 7: ?
port 8: ?

whoa, where is vlan2 from?

edit- typo, right? that should say vlan1, i assume.

A Former User · Jun 28, 2012, 7:30 PM

N for no access is the same as E for Exclude i would imagine.

my HP uses T, U, E

stephenw10 · Jun 28, 2012, 8:21 PM

Yes N==E. ;)

Just take it one step at a time. Varify that each step is doing what you think it should. Most config problems are caused by trying to implement a hundred functions at once and then, when it doesn't work, having no idea which one caused the trouble.

Steve

Metu69salemi · Jun 28, 2012, 9:35 PM

You're right it was a typo. And N just meaned that anyway there is no connection between, so it doesn't matter what is the language of your switch

A Former User · Jun 28, 2012, 10:52 PM

ok, i set it up as posted but still not getting a 10.10.10.x ip on the spare/test laptop (plugged into port 2 on hp switch).

here is what the switch and pfsense look like

A Former User · Jun 28, 2012, 10:55 PM

one thing to note, the 192 network is working with this setup.

when i did this last night, i couldnt get 192 or 10 to work, so i am getting somewhere with the tagging/untagging/excluding.

i should also note that both yesterday and today (prior to messing with this) the pfsense lan cable re2 plugged in directly to my netgear.

once i started setting this up, i made sure to unplug re2 from my netgear switch into port 1 of the hp switch (vlan switch) just in case someone thought that wasnt happening.

thanks

stephenw10 · Jun 28, 2012, 11:47 PM

Hmm, that's not right. Set the participation as Metu69salemi suggetsed earlier.


Port      1 2 3 4 5 6
VLAN1     U E * * U U
VLAN100   T U * * E E

If that doesn't work try:


Port      1 2 3 4 5 6
VLAN1     T E * * U U
VLAN100   T U * * E E

Steve

A Former User · Jun 29, 2012, 12:00 AM

@stephenw10:

Hmm, that's not right. Set the participation as Metu69salemi suggetsed earlier.
Port      1 2 3 4 5 6
VLAN1     U E * * U U
VLAN100   T U * * E E
If that doesn't work try:
Port      1 2 3 4 5 6
VLAN1     T E * * U U
VLAN100   T U * * E E
Steve

ok, the first config doesnt give my laptop an IP, but 192 network can go online

with the second config…i get no ip to my laptop and 192 network cant go online.

EDIT- if my pfsense settings look ok, then i can stop looking there. do you guys want pics of the DHCP server settings? i set it up the same as 192 DHCP settings, so anything plugged into port 2 of my vlan switch should get an IP address from 10.10.10.x from pfsense.

stephenw10 · Jun 29, 2012, 12:36 AM

Ok stick with the first config then.
You may as well post your DHCP config, it might help.

What exactly are you using ports 3 and 4 for?

Have you added firewall rules for the vlan interface? I assumed you had. DHCP should work anyway.

The confusing thing here, for me, is that a packet tagged with vlan ID 1 is not the same as an untagged packet.
It shouldn't be this difficult so something is obviously wrong somewhere!

Steve

A Former User · Jun 29, 2012, 12:49 AM

@stephenw10:

Ok stick with the first config then.
You may as well post your DHCP config, it might help.

What exactly are you using ports 3 and 4 for?

Have you added firewall rules for the vlan interface? I assumed you had. DHCP should work anyway.

The confusing thing here, for me, is that a packet tagged with vlan ID 1 is not the same as an untagged packet.
It shouldn't be this difficult so something is obviously wrong somewhere!

Steve

ports 3/4 are trunked/bonded to my NAS. just trying to get the most i can with two cat5 cables. the nas also has a 'bond' with the two nic ports.

here is the DHCP screen shot for 10.10.10.x and i have not written any firewall rules, i agree with you in that it should still assign it an IP address.

Metu69salemi · Jun 29, 2012, 3:46 AM

can you show your rules of wifi interface?

and still i'd like to use that


port:        1 2 3 4 5 6 7 8 
vlan1:       U E U U U U U U
vlan100:     T U E E E E E E

or then go the later solution(port 1 tagged in both vlans), but you'll have to setup management on other nic and networks in other nic

stephenw10 · Jun 29, 2012, 2:05 PM

This could be the reason the tagged and untagged traffic should not be on the same interface. ::)
I have not experienced how problems would show up.

Steve

Edit: Reading 'the definitive guide' for inspiration I see that this could be a problem related to the NIC not supporting the increased frame size required by the VLAN tag.
In particular it mentions that Realtek interfaces may not support it even if they report doing so. Though that is for rl(4) rather than re(4).