Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Setting up a VLAN part 2

    General pfSense Questions
    3
    110
    23202
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ?
      A Former User
      last edited by

      Part 1 is here and it is ugly, but i am linking it as a reference.

      http://forum.pfsense.org/index.php/topic,44488.0.html

      ok, since that thread, i think i need to take a step back and do this in baby steps just to make sure i am doing everything right and not trying to take too much information all at once.

      my pfsense has 3 interfaces, but i only want to use 2 of them (for the purpose of vlans and testing with only a WAN and LAN interface).

      Physical Interfaces:

      re0- WAN
      re2- LAN

      Virtual Interfaces:
      wifi- vlan 100 on re2 (vlan100)

      wifi interface settings:

      type- static
      ip- 10.10.10.1

      Services- DHCP Server

      10.10.10.10-10.10.10.50

      everything else is blank (the dhcp server settings mirror my LAN DHCP server settings and LAN is working w/o any issues, so i left it at that).

      now for the HP vlan switch settings….default state with 5 ports being used on the existing 192.168.1.x network (LAN).

      there is 1 default VLAN in the HP switch

      VLAN Name- Default Vlan
      VLAN 1

      U,U,U,U,U,U,U,U

      thats it.

      now, before i talk about brining in a wifi AP, my goal is to set this up with a spare laptop plugged into port 2 of my HP switch and run that off of VLAN 100 from pfsense. and i should add that port 6 on the HP switch plugs into a 16 port netgear switch (not managed) on my network.  i want all PCs on the netgear switch to run on the 192.168.1.x network as well as the few devices i have in the HP switch taking up spots.  my only open ports in the vlan HP switch are 1,2,6, everything else is in use.

      1, is that possible?
      2, would i set it up as follow:

      Vlan 1 (HP switch)

      TEUUUUUU (port 1 is pfsense re2 interface, port 2 is vlan PC/device).

      Vlan 100 (HP switch)

      TUEEEEEE (port 1 is pfsense re2 interface, port 2 is vlan PC/device).

      i hope whoever attempts to help me isnt lost, if so i can try to break it down.

      EDIT

      does the NIC in the laptop and the netgear switch (running the rest of my network) have to be VLAN ready?

      meaning, even though the ports they are plugged into on the HP switch might be configured to run on on the proper VLAN, does the NIC and switch still need to have VLAN capabilities?

      if that is the case, maybe i have been setting up the HP switch right all along (above) and was lacking the rest of the VLAN equipment.

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        That first thread is epic!  ;)

        Yes that is possible but you are using the same interface for tagged and untagged traffic which can cause problems and should be avoided if possible. Why don't you want to use the 3rd interface?

        The switch setup looks correct though I'm not familiar with thosse switches.

        The laptop and unmanaged switch do not have to deal with VLANs at all so will be fine. The VLAN tags are stripped or added at the HP switch port.

        Steve

        1 Reply Last reply Reply Quote 0
        • ?
          A Former User
          last edited by

          @stephenw10:

          That first thread is epic!  ;)

          Yes that is possible but you are using the same interface for tagged and untagged traffic which can cause problems and should be avoided if possible. Why don't you want to use the 3rd interface?

          The switch setup looks correct though I'm not familiar with thosse switches.

          The laptop and unmanaged switch do not have to deal with VLANs at all so will be fine. The VLAN tags are stripped or added at the HP switch port.

          Steve

          i'd like to try to get it running with 1 port mainly because i think i can teach myself something doing it on 1 port.

          also, i read about people on here that have multiple vlans (20, 30, 40) and i know while that might not be a common scenario, they still have to be doing it with few (if not one) physical interfaces.

          thoughts?  should i give up on this (i dont like giving up) and focus on opt1?

          is it possible that they are building multiple vlans but keeping it on a opt1/secondary interface (away from the main LAN)?  if so, that would make sense.

          thanks.

          edit- yeah that thread was epic.  i went back and re-read alot of it, setup my switch and pfsense as marcelloc stated in one post (which did make sense to me, yesterday) and i still wasnt having any luck.  i can post it, but it wont matter at this point.

          1 Reply Last reply Reply Quote 0
          • M
            Metu69salemi
            last edited by

            Was the case that you have your LAN in vlan1 and WIFI in VLAN100 and in same interface?
            if so then your settings on switch should be

            
            VLAN 1: U N and the rest U
            VLAN 100: T U and the rest N
            
            Legend:
            U = Untagged
            T = Tagged
            N = no access or similar
            
            
            1 Reply Last reply Reply Quote 0
            • ?
              A Former User
              last edited by

              @Metu69salemi:

              Was the case that you have your LAN in vlan1 and WIFI in VLAN100 and in same interface?
              if so then your settings on switch should be

              
              VLAN 1: U N and the rest U
              VLAN 100: T U and the rest N
              
              Legend:
              U = Untagged
              T = Tagged
              N = no access or similar
              
              

              yes, exactly.

              i will try to set it up like this and report back.

              EDIT- my switch (netgear, not vlan ready) is in port 6 of the vlan switch.  how should i handle that? U for vlan 1 and N for vlan 100?

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                You can certainly do this with one interface and run just about as many vlans on it as you want.
                You should avoid tagged and non-tagged traffic if you can but it may well work just fine if you can't. Since you're just experimenting it's not a problem so go for it.
                That said what I would do is put your LAN traffic on a VLAN also so that all your traffic is tagged. The difficulty with doing this that if you get the config wrong you can end up locked out of your box and it quickly becomes frustrating when you keep having to start over.
                Why not setup your extra interface just as a management interface. Make sure you can always get back into the box via that.

                There is some confusion here regarding VLAN1. The is the default VLAN which I believe is actually just untagged? (at least outside of the switch) To avoid this always use high numbers, like VLAN100 you are already using.

                Steve

                1 Reply Last reply Reply Quote 0
                • ?
                  A Former User
                  last edited by

                  vlan 1 is just the default vlan of the hp switch.

                  i am still getting confused with the tagged/untagged.  everytime i think i have it and try to see if what i get matches up with what is said on here, i am always opposite.

                  when i am all done with this, i want my HP vlan switch to be accessible via the IP it has, now, which is 192.168.1.20, i dont need to be able to access it from the vlan network (but that is another question at another time).

                  what i am wanting to do/test is to have 1 cable connecting my pfsense and the hp vlan switch and over that 1 cable i want to have 192 and 10 traffic.  then, assuming the hp switch is setup properly, i want to do the following

                  port1- pfsense LAN
                  port2- test laptop or wifi router (statically assigned 10.10.10.2 for access at a later time) 10.10.10.x network (vlan 100)
                  port3- cant use (trunked/bond)
                  port4- cant use (trunked/bond)
                  port5- connects to a PC i want to keep on the 192.168.1.x network
                  port6- connects to my 16 port netgear switch that has additional 192.168.1.x devices
                  port7- open (no need for vlan100 access)
                  port8- open (no need for vlan100 access)

                  1 Reply Last reply Reply Quote 0
                  • M
                    Metu69salemi
                    last edited by

                    @tomdlgns:

                    @Metu69salemi:

                    Was the case that you have your LAN in vlan1 and WIFI in VLAN100 and in same interface?
                    if so then your settings on switch should be

                    
                    VLAN 1: U N and the rest U
                    VLAN 100: T U and the rest N
                    
                    Legend:
                    U = Untagged
                    T = Tagged
                    N = no access or similar
                    
                    

                    yes, exactly.

                    i will try to set it up like this and report back.

                    EDIT- my switch (netgear, not vlan ready) is in port 6 of the vlan switch.  how should i handle that? U for vlan 1 and N for vlan 100?

                    Yes like that, if you have switch which doesn't have vlan capability, then you connect that port like any computer.

                    
                    Port 1: vlan1 untagged, vlan100 tagged <-- best method would be tagged/tagged, but then you should use stephens method
                    port 2: vlan2 no access, vlan100 untagged
                    port 3: ? 
                    port 4: ?
                    port 5: vlan1 untagged, vlan100 no access
                    port 6: vlan1 untagged, vlan100 no access
                    port 7: ?
                    port 8: ?
                    
                    
                    1 Reply Last reply Reply Quote 0
                    • ?
                      A Former User
                      last edited by

                      @Metu69salemi:

                      @tomdlgns:

                      @Metu69salemi:

                      Was the case that you have your LAN in vlan1 and WIFI in VLAN100 and in same interface?
                      if so then your settings on switch should be

                      
                      VLAN 1: U N and the rest U
                      VLAN 100: T U and the rest N
                      
                      Legend:
                      U = Untagged
                      T = Tagged
                      N = no access or similar
                      
                      

                      yes, exactly.

                      i will try to set it up like this and report back.

                      EDIT- my switch (netgear, not vlan ready) is in port 6 of the vlan switch.  how should i handle that? U for vlan 1 and N for vlan 100?

                      Yes like that, if you have switch which doesn't have vlan capability, then you connect that port like any computer.

                      
                      Port 1: vlan1 untagged, vlan100 tagged <-- best method would be tagged/tagged, but then you should use stephens method
                      port 2: vlan2 no access, vlan100 untagged
                      port 3: ? 
                      port 4: ?
                      port 5: vlan1 untagged, vlan100 no access
                      port 6: vlan1 untagged, vlan100 no access
                      port 7: ?
                      port 8: ?
                      
                      

                      whoa, where is vlan2 from?

                      edit- typo, right? that should say vlan1, i assume.

                      1 Reply Last reply Reply Quote 0
                      • ?
                        A Former User
                        last edited by

                        N for no access is the same as E for Exclude i would imagine.

                        my HP uses T, U, E

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Yes N==E.  ;)

                          Just take it one step at a time. Varify that each step is doing what you think it should. Most config problems are caused by trying to implement a hundred functions at once and then, when it doesn't work, having no idea which one caused the trouble.

                          Steve

                          1 Reply Last reply Reply Quote 0
                          • M
                            Metu69salemi
                            last edited by

                            You're right it was a typo. And N just meaned that anyway there is no connection between, so it doesn't matter what is the language of your switch

                            1 Reply Last reply Reply Quote 0
                            • ?
                              A Former User
                              last edited by

                              ok, i set it up as posted but still not getting a 10.10.10.x ip on the spare/test laptop (plugged into port 2 on hp switch).

                              here is what the switch and pfsense look like

                              1 Reply Last reply Reply Quote 0
                              • ?
                                A Former User
                                last edited by

                                one thing to note, the 192 network is working with this setup.

                                when i did this last night, i couldnt get 192 or 10 to work, so i am getting somewhere with the tagging/untagging/excluding.

                                i should also note that both yesterday and today (prior to messing with this) the pfsense lan cable re2 plugged in directly to my netgear.

                                once i started setting this up, i made sure to unplug re2 from my netgear switch into port 1 of the hp switch (vlan switch) just in case someone thought that wasnt happening.

                                thanks

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Hmm, that's not right. Set the participation as Metu69salemi suggetsed earlier.

                                  
                                  Port      1 2 3 4 5 6
                                  VLAN1     U E * * U U
                                  VLAN100   T U * * E E
                                  
                                  

                                  If that doesn't work try:

                                  
                                  Port      1 2 3 4 5 6
                                  VLAN1     T E * * U U
                                  VLAN100   T U * * E E
                                  
                                  

                                  Steve

                                  1 Reply Last reply Reply Quote 0
                                  • ?
                                    A Former User
                                    last edited by

                                    @stephenw10:

                                    Hmm, that's not right. Set the participation as Metu69salemi suggetsed earlier.

                                    
                                    Port      1 2 3 4 5 6
                                    VLAN1     U E * * U U
                                    VLAN100   T U * * E E
                                    
                                    

                                    If that doesn't work try:

                                    
                                    Port      1 2 3 4 5 6
                                    VLAN1     T E * * U U
                                    VLAN100   T U * * E E
                                    
                                    

                                    Steve

                                    ok, the first config doesnt give my laptop an IP, but 192 network can go online

                                    with the second config…i get no ip to my laptop and 192 network cant go online.

                                    EDIT- if my pfsense settings look ok, then i can stop looking there.  do you guys want pics of the DHCP server settings?  i set it up the same as 192 DHCP settings, so anything plugged into port 2 of my vlan switch should get an IP address from 10.10.10.x from pfsense.

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Ok stick with the first config then.
                                      You may as well post your DHCP config, it might help.

                                      What exactly are you using ports 3 and 4 for?

                                      Have you added firewall rules for the vlan interface? I assumed you had. DHCP should work anyway.

                                      The confusing thing here, for me, is that a packet tagged with vlan ID 1 is not the same as an untagged packet.
                                      It shouldn't be this difficult so something is obviously wrong somewhere!

                                      Steve

                                      1 Reply Last reply Reply Quote 0
                                      • ?
                                        A Former User
                                        last edited by

                                        @stephenw10:

                                        Ok stick with the first config then.
                                        You may as well post your DHCP config, it might help.

                                        What exactly are you using ports 3 and 4 for?

                                        Have you added firewall rules for the vlan interface? I assumed you had. DHCP should work anyway.

                                        The confusing thing here, for me, is that a packet tagged with vlan ID 1 is not the same as an untagged packet.
                                        It shouldn't be this difficult so something is obviously wrong somewhere!

                                        Steve

                                        ports 3/4 are trunked/bonded to my NAS.  just trying to get the most i can with two cat5 cables.  the nas also has a 'bond' with the two nic ports.

                                        here is the DHCP screen shot for 10.10.10.x and i have not written any firewall rules, i agree with you in that it should still assign it an IP address.

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          Metu69salemi
                                          last edited by

                                          can you show your rules of wifi interface?

                                          and still i'd like to use that

                                          
                                          port:        1 2 3 4 5 6 7 8 
                                          vlan1:       U E U U U U U U
                                          vlan100:     T U E E E E E E
                                          
                                          

                                          or then go the later solution(port 1 tagged in both vlans), but you'll have to setup management on other nic and networks in other nic

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            This could be the reason the tagged and untagged traffic should not be on the same interface.  ::)
                                            I have not experienced how problems would show up.

                                            Steve

                                            Edit: Reading 'the definitive guide' for inspiration I see that this could be a problem related to the NIC not supporting the increased frame size required by the VLAN tag.
                                            In particular it mentions that Realtek interfaces may not support it even if they report doing so. Though that is for rl(4) rather than re(4).

                                            1 Reply Last reply Reply Quote 0
                                            • ?
                                              A Former User
                                              last edited by

                                              @Metu69salemi:

                                              can you show your rules of wifi interface?

                                              and still i'd like to use that

                                              
                                              port:        1 2 3 4 5 6 7 8 
                                              vlan1:       U E U U U U U U
                                              vlan100:     T U E E E E E E
                                              
                                              

                                              or then go the later solution(port 1 tagged in both vlans), but you'll have to setup management on other nic and networks in other nic

                                              ok, i will take a look at that setup and report back.

                                              also, unless some default rules were put in place, i didnt create any rules, but i will post a screen of that and add in some common/default rules to see if that does it.

                                              1 Reply Last reply Reply Quote 0
                                              • ?
                                                A Former User
                                                last edited by

                                                @stephenw10:

                                                This could be the reason the tagged and untagged traffic should not be on the same interface.  ::)
                                                I have not experienced how problems would show up.

                                                Steve

                                                Edit: Reading 'the definitive guide' for inspiration I see that this could be a problem related to the NIC not supporting the increased frame size required by the VLAN tag.
                                                In particular it mentions that Realtek interfaces may not support it even if they report doing so. Though that is for rl(4) rather than re(4).

                                                if the above config doesnt work, i am going to stop trying to do it with 1 NIC and will bring in the second nic.

                                                1 Reply Last reply Reply Quote 0
                                                • stephenw10S
                                                  stephenw10 Netgate Administrator
                                                  last edited by

                                                  Here is what I would do:
                                                  Disable trunking/bonding for now, it's just adding a further complication and you can add it back once you figure out VLANs. (what VLANs did you set on the trunk in the switch?)

                                                  Setup the second interface so that you have access to the webgui even if everything on the first interface gets locked out.

                                                  Unassign the first interface so that it's not sending untagged packets. Create a VLAN on it, VLAN100 say, and then try to configure the switch to work with it.

                                                  Add more VLANs once that's working.

                                                  Steve

                                                  1 Reply Last reply Reply Quote 0
                                                  • ?
                                                    A Former User
                                                    last edited by

                                                    @stephenw10:

                                                    Here is what I would do:
                                                    Disable trunking/bonding for now, it's just adding a further complication and you can add it back once you figure out VLANs. (what VLANs did you set on the trunk in the switch?)

                                                    Setup the second interface so that you have access to the webgui even if everything on the first interface gets locked out.

                                                    Unassign the first interface so that it's not sending untagged packets. Create a VLAN on it, VLAN100 say, and then try to configure the switch to work with it.

                                                    Add more VLANs once that's working.

                                                    Steve

                                                    everything you mentioned is my problem (tagging/untagging).

                                                    since i get confused, i wont know if i am doing it right.

                                                    not sure how to setup management to be accessible from both vlans?

                                                    also, you can see how the trunk was configured in the pics above.  i dont think there are issues with that, worst case scenario (if i set it up wrong) i wont be able to access my NAS, not critical.

                                                    1 Reply Last reply Reply Quote 0
                                                    • stephenw10S
                                                      stephenw10 Netgate Administrator
                                                      last edited by

                                                      I meant the second interface on the pfSense box so you don't get locked out of pfSense.

                                                      It looks like you're doing everything right. At this point you have not been able to see any VLAN activity in any way, at an time, yes?
                                                      It seems likely that your pfSense box is not sending VLAN frames for some reason. Could be a config issue, it could be that your NIC is interfering etc.

                                                      Once you are able to access the pfSense gui via a different interface you can safely play with these settings and not get locked out.

                                                      Steve

                                                      1 Reply Last reply Reply Quote 0
                                                      • ?
                                                        A Former User
                                                        last edited by

                                                        @stephenw10:

                                                        I meant the second interface on the pfSense box so you don't get locked out of pfSense.

                                                        It looks like you're doing everything right. At this point you have not been able to see any VLAN activity in any way, at an time, yes?
                                                        It seems likely that your pfSense box is not sending VLAN frames for some reason. Could be a config issue, it could be that your NIC is interfering etc.

                                                        Once you are able to access the pfSense gui via a different interface you can safely play with these settings and not get locked out.

                                                        Steve

                                                        gotcha…yeah, i might just give up on trying to do it with 1 nic/1 cable mainly because i forgot about the compatibility issue, even if it is setup right, i might be using a nic card that isnt compatible.

                                                        thanks for the help to all up to this point.

                                                        1 Reply Last reply Reply Quote 0
                                                        • ?
                                                          A Former User
                                                          last edited by

                                                          ok, i decided to not try it with 1 NIC….

                                                          i get the second nic setup and assign vlan100 to run on re1.

                                                          i know pfsense sees the NIC because i see it in the GUI.

                                                          my HP sees RE1 because the green LEDs come on and i see it highlight in the hp GUI.

                                                          however, i dont see the link activity LEDs on the NIC turn on.  maybe i have a bad NIC?  i'd have to see if i have another one somewhere.

                                                          anyway....

                                                          how should i be tagging/untagging/excluding ports?

                                                          i tried a few combindations and i still get 169.254 as the IP on my laptop.

                                                          keep in mind, i need to add an additional port to vlan100 on the hp switch because the only port i was using before, port 2 was for testing my laptop, is now being used to connect to the pfsense NIC.

                                                          i decided to use ports 7 and 8 as my vlan100 ports

                                                          ports that should be on vlan 1- 1,2,3/4,5,6 (3/4 is the trunk/bond, but i can easily assign that to a vlan1 via the tag/untagg screen.

                                                          ports that should be on vlan 100- 7,8

                                                          let me take a stab...

                                                          vlan1-    UUUUUUTT
                                                          vlan100- EEEEEEUU

                                                          1 Reply Last reply Reply Quote 0
                                                          • ?
                                                            A Former User
                                                            last edited by

                                                            yeah, something is wrong with the nic in the pfsense box (re1).

                                                            i bypassed the hp switch and went directly into my laptop and it goes on….off....on....off....on....off

                                                            however, we can still talk about tagging/untagging for when i do find a another NIC.

                                                            edit- found a good/compatible NIC card.  plugged it in, plugged in m laptop and i have green LEDs, re1, back online.

                                                            now for the u/t/e portion.

                                                            1 Reply Last reply Reply Quote 0
                                                            • ?
                                                              A Former User
                                                              last edited by

                                                              or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface.  might as well try that before bringing in the switch, right?

                                                              EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses.  i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x).  unchecked it, saved, new device instantly got an IP address (192.168.1.x).

                                                              1 Reply Last reply Reply Quote 0
                                                              • M
                                                                Metu69salemi
                                                                last edited by

                                                                i've dropped out what happened, did you setup another nic which is handling two vlans? or did you setup interface only handling one vlan

                                                                1 Reply Last reply Reply Quote 0
                                                                • stephenw10S
                                                                  stephenw10 Netgate Administrator
                                                                  last edited by

                                                                  @tomdlgns:

                                                                  or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface.  might as well try that before bringing in the switch, right?

                                                                  Nope.
                                                                  Your laptop will not see the vlan tagged packets at all, it's NIC will just discard them. You need the switch to read in the tagged packets, route them to the correct port and remove the tags so that you laptop see standard untagged packets.

                                                                  @tomdlgns:

                                                                  EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses.  i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x).  unchecked it, saved, new device instantly got an IP address (192.168.1.x).

                                                                  No idea what's happening there, that is strange.

                                                                  Steve

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • ?
                                                                    A Former User
                                                                    last edited by

                                                                    @Metu69salemi:

                                                                    i've dropped out what happened, did you setup another nic which is handling two vlans? or did you setup interface only handling one vlan

                                                                    yes, i have a second NIC installed with vlan100 and dhcp server is enabled.

                                                                    1 Reply Last reply Reply Quote 0
                                                                    • ?
                                                                      A Former User
                                                                      last edited by

                                                                      @stephenw10:

                                                                      @tomdlgns:

                                                                      or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface.  might as well try that before bringing in the switch, right?

                                                                      Nope.
                                                                      Your laptop will not see the vlan tagged packets at all, it's NIC will just discard them. You need the switch to read in the tagged packets, route them to the correct port and remove the tags so that you laptop see standard untagged packets.

                                                                      @tomdlgns:

                                                                      EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses.  i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x).  unchecked it, saved, new device instantly got an IP address (192.168.1.x).

                                                                      No idea what's happening there, that is strange.

                                                                      Steve

                                                                      ok, makes sense.

                                                                      since i was just plugged into my laptop that could be why it wasnt working, i understand that i need to bring the switch in.  i just assumed since the laptop was connected directly to the second nic with vlan100 assigned to it in pfsense, that i would have no need for a switch.  however, it makes perfect sense that i need the vlan switch.

                                                                      with all that said, i'd like to get the vlan tagging correct now with two nics

                                                                      vlan1 on the hp switch should be ports

                                                                      1,2,3,4,5,6

                                                                      vlan 100 on the hp switch should be ports

                                                                      7,8

                                                                      vlan1-    U U U U U U T T
                                                                      vlan100- E E E E E E U U

                                                                      is that close?

                                                                      edit-

                                                                      ports 1-6 would be 192.168.1.x network

                                                                      ports 7/8 would be 10.10.10.x network
                                                                      port 7 is patch cable to vlan100 nic (second NIC) on pfsense box
                                                                      port 8 is patch cable to a wifi router with DHCP disabled (pfsense will do that) or a direct laptop.

                                                                      1 Reply Last reply Reply Quote 0
                                                                      • stephenw10S
                                                                        stephenw10 Netgate Administrator
                                                                        last edited by

                                                                        VLAN1 is probably going to stop working here because hopefully you will stop sending any untagged packets to the switch from pfSense.

                                                                        Configure the switch:

                                                                        
                                                                        port:        1 2 3 4 5 6 7 8 
                                                                        vlan1:       U U U U U U E E
                                                                        vlan100:     T E E E E E U U
                                                                        
                                                                        

                                                                        Unassign re1 from LAN to stop is sending untagged packets. This will lock you out of the pfSense box if you haven't got access from re2.

                                                                        Steve

                                                                        1 Reply Last reply Reply Quote 0
                                                                        • ?
                                                                          A Former User
                                                                          last edited by

                                                                          @stephenw10:

                                                                          VLAN1 is probably going to stop working here because hopefully you will stop sending any untagged packets to the switch from pfSense.

                                                                          Configure the switch:

                                                                          
                                                                          port:        1 2 3 4 5 6 7 8 
                                                                          vlan1:       U U U U U U E E
                                                                          vlan100:     T E E E E E U U
                                                                          
                                                                          

                                                                          Unassign re1 from LAN to stop is sending untagged packets. This will lock you out of the pfSense box if you haven't got access from re2.

                                                                          Steve

                                                                          vlan 1 is going to stop working?  what does that mean?  i would still like all 192. computers to work.

                                                                          by tagging port 1 in vlan100 is that what 'unassing re1 from LAN to stop sending untagged packets' is?

                                                                          i will wait for a reply before i set it up that way.

                                                                          1 Reply Last reply Reply Quote 0
                                                                          • M
                                                                            Metu69salemi
                                                                            last edited by

                                                                            create a new vlan say 10 or something else than 1 or 100
                                                                            Use only your current lan interface as management interface and both two vlan's to the same nic where you have vlan currently.
                                                                            so your network would be
                                                                            nic(lan): 192.168.1.1 /24 for management, you could also use something else subnet area
                                                                            vlan10 (on another nic): this would be your current lan, so whatever you like to use, but notice, that this vlan and above management subnet wouldn't work if they have same subnets
                                                                            vlan100 (on same nic as vlan10): this would be same as currently

                                                                            then add current configs to switch
                                                                            vlan10:  T U U U U U E E
                                                                            vlan100: T E E E E E U U
                                                                            remember to connect port 1 to pfsense

                                                                            1 Reply Last reply Reply Quote 0
                                                                            • ?
                                                                              A Former User
                                                                              last edited by

                                                                              @Metu69salemi:

                                                                              create a new vlan say 10 or something else than 1 or 100
                                                                              Use only your current lan interface as management interface and both two vlan's to the same nic where you have vlan currently.
                                                                              so your network would be
                                                                              nic(lan): 192.168.1.1 /24 for management, you could also use something else subnet area
                                                                              vlan10 (on another nic): this would be your current lan, so whatever you like to use, but notice, that this vlan and above management subnet wouldn't work if they have same subnets
                                                                              vlan100 (on same nic as vlan10): this would be same as currently

                                                                              then add current configs to switch
                                                                              vlan10:   T U U U U U E E
                                                                              vlan100: T E E E E E U U
                                                                              remember to connect port 1 to pfsense

                                                                              ok, what does vlan1 look like in the hp switch?

                                                                              i think you just confused me more.

                                                                              1 Reply Last reply Reply Quote 0
                                                                              • M
                                                                                Metu69salemi
                                                                                last edited by

                                                                                in this topology it doesn't exist
                                                                                It is only "console" access to the firewall

                                                                                1 Reply Last reply Reply Quote 0
                                                                                • ?
                                                                                  A Former User
                                                                                  last edited by

                                                                                  @Metu69salemi:

                                                                                  in this topology it doesn't exist
                                                                                  It is only "console" access to the firewall

                                                                                  let me rephrase.

                                                                                  that is ok if it is there and i dont use it, but i will have it in my switch.  after reading the post, it seems as if my switch needs to look like this

                                                                                  vlan1
                                                                                  vlan10
                                                                                  vlan100

                                                                                  maybe we should start with pfsense, do i have that configured properly?

                                                                                  re0- WAN
                                                                                  re1- vlan100 (10.10.10.1) dhcp enabled
                                                                                  re2- LAN (192.168.1.1) dhcp enabled

                                                                                  –------------------
                                                                                  pfsense LAN goes into HP port 1 (vlan?) 192.168.1.x


                                                                                  pfsense vlan100 goes into HP port 7 (vlan100 on hp switch) 10.10.10.x and port 8 needs to be on vlan100 as well.

                                                                                  EDIT-

                                                                                  does the pfsense NIC even need to be a VLAN?  if i am using a seperate NIC, shouldnt i be able to assign it to 10.10.10.x and deal with VLANs in the HP switch to segregate 10 traffic vs 192 traffic?

                                                                                  1 Reply Last reply Reply Quote 0
                                                                                  • ?
                                                                                    A Former User
                                                                                    last edited by

                                                                                    did you guys give up on me?

                                                                                    ;D

                                                                                    1 Reply Last reply Reply Quote 0
                                                                                    • First post
                                                                                      Last post