Setting up a VLAN part 2

A Former User · Jun 29, 2012, 2:12 PM

can you show your rules of wifi interface?

and still i'd like to use that
port:        1 2 3 4 5 6 7 8 
vlan1:       U E U U U U U U
vlan100:     T U E E E E E E
or then go the later solution(port 1 tagged in both vlans), but you'll have to setup management on other nic and networks in other nic

ok, i will take a look at that setup and report back.

also, unless some default rules were put in place, i didnt create any rules, but i will post a screen of that and add in some common/default rules to see if that does it.

A Former User · Jun 29, 2012, 2:11 PM

@stephenw10:

This could be the reason the tagged and untagged traffic should not be on the same interface. ::)
I have not experienced how problems would show up.

Steve

Edit: Reading 'the definitive guide' for inspiration I see that this could be a problem related to the NIC not supporting the increased frame size required by the VLAN tag.
In particular it mentions that Realtek interfaces may not support it even if they report doing so. Though that is for rl(4) rather than re(4).

if the above config doesnt work, i am going to stop trying to do it with 1 NIC and will bring in the second nic.

stephenw10 · Jun 29, 2012, 2:34 PM

Here is what I would do:
Disable trunking/bonding for now, it's just adding a further complication and you can add it back once you figure out VLANs. (what VLANs did you set on the trunk in the switch?)

Setup the second interface so that you have access to the webgui even if everything on the first interface gets locked out.

Unassign the first interface so that it's not sending untagged packets. Create a VLAN on it, VLAN100 say, and then try to configure the switch to work with it.

Add more VLANs once that's working.

Steve

A Former User · Jun 29, 2012, 2:45 PM

@stephenw10:

Here is what I would do:
Disable trunking/bonding for now, it's just adding a further complication and you can add it back once you figure out VLANs. (what VLANs did you set on the trunk in the switch?)

Setup the second interface so that you have access to the webgui even if everything on the first interface gets locked out.

Unassign the first interface so that it's not sending untagged packets. Create a VLAN on it, VLAN100 say, and then try to configure the switch to work with it.

Add more VLANs once that's working.

Steve

everything you mentioned is my problem (tagging/untagging).

since i get confused, i wont know if i am doing it right.

not sure how to setup management to be accessible from both vlans?

also, you can see how the trunk was configured in the pics above. i dont think there are issues with that, worst case scenario (if i set it up wrong) i wont be able to access my NAS, not critical.

stephenw10 · Jun 29, 2012, 3:02 PM

I meant the second interface on the pfSense box so you don't get locked out of pfSense.

It looks like you're doing everything right. At this point you have not been able to see any VLAN activity in any way, at an time, yes?
It seems likely that your pfSense box is not sending VLAN frames for some reason. Could be a config issue, it could be that your NIC is interfering etc.

Once you are able to access the pfSense gui via a different interface you can safely play with these settings and not get locked out.

Steve

A Former User · Jun 29, 2012, 3:10 PM

@stephenw10:

I meant the second interface on the pfSense box so you don't get locked out of pfSense.

It looks like you're doing everything right. At this point you have not been able to see any VLAN activity in any way, at an time, yes?
It seems likely that your pfSense box is not sending VLAN frames for some reason. Could be a config issue, it could be that your NIC is interfering etc.

Once you are able to access the pfSense gui via a different interface you can safely play with these settings and not get locked out.

Steve

gotcha…yeah, i might just give up on trying to do it with 1 nic/1 cable mainly because i forgot about the compatibility issue, even if it is setup right, i might be using a nic card that isnt compatible.

thanks for the help to all up to this point.

A Former User · Jun 30, 2012, 3:11 PM

ok, i decided to not try it with 1 NIC….

i get the second nic setup and assign vlan100 to run on re1.

i know pfsense sees the NIC because i see it in the GUI.

my HP sees RE1 because the green LEDs come on and i see it highlight in the hp GUI.

however, i dont see the link activity LEDs on the NIC turn on. maybe i have a bad NIC? i'd have to see if i have another one somewhere.

anyway....

how should i be tagging/untagging/excluding ports?

i tried a few combindations and i still get 169.254 as the IP on my laptop.

keep in mind, i need to add an additional port to vlan100 on the hp switch because the only port i was using before, port 2 was for testing my laptop, is now being used to connect to the pfsense NIC.

i decided to use ports 7 and 8 as my vlan100 ports

ports that should be on vlan 1- 1,2,3/4,5,6 (3/4 is the trunk/bond, but i can easily assign that to a vlan1 via the tag/untagg screen.

ports that should be on vlan 100- 7,8

let me take a stab...

vlan1- UUUUUUTT
vlan100- EEEEEEUU

A Former User · Jun 29, 2012, 11:43 PM

yeah, something is wrong with the nic in the pfsense box (re1).

i bypassed the hp switch and went directly into my laptop and it goes on….off....on....off....on....off

however, we can still talk about tagging/untagging for when i do find a another NIC.

edit- found a good/compatible NIC card. plugged it in, plugged in m laptop and i have green LEDs, re1, back online.

now for the u/t/e portion.

A Former User · Jun 30, 2012, 1:55 AM

or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface. might as well try that before bringing in the switch, right?

EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses. i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x). unchecked it, saved, new device instantly got an IP address (192.168.1.x).

Metu69salemi · Jun 30, 2012, 9:01 AM

i've dropped out what happened, did you setup another nic which is handling two vlans? or did you setup interface only handling one vlan

stephenw10 · Jun 30, 2012, 11:01 AM

@tomdlgns:

or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface. might as well try that before bringing in the switch, right?

Nope.
Your laptop will not see the vlan tagged packets at all, it's NIC will just discard them. You need the switch to read in the tagged packets, route them to the correct port and remove the tags so that you laptop see standard untagged packets.

@tomdlgns:

EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses. i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x). unchecked it, saved, new device instantly got an IP address (192.168.1.x).

No idea what's happening there, that is strange.

Steve

A Former User · Jun 30, 2012, 3:05 PM

@Metu69salemi:

i've dropped out what happened, did you setup another nic which is handling two vlans? or did you setup interface only handling one vlan

yes, i have a second NIC installed with vlan100 and dhcp server is enabled.

A Former User · Jun 30, 2012, 3:30 PM

@stephenw10:

@tomdlgns:

or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface. might as well try that before bringing in the switch, right?

Nope.
Your laptop will not see the vlan tagged packets at all, it's NIC will just discard them. You need the switch to read in the tagged packets, route them to the correct port and remove the tags so that you laptop see standard untagged packets.

@tomdlgns:

EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses. i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x). unchecked it, saved, new device instantly got an IP address (192.168.1.x).

No idea what's happening there, that is strange.

Steve

ok, makes sense.

since i was just plugged into my laptop that could be why it wasnt working, i understand that i need to bring the switch in. i just assumed since the laptop was connected directly to the second nic with vlan100 assigned to it in pfsense, that i would have no need for a switch. however, it makes perfect sense that i need the vlan switch.

with all that said, i'd like to get the vlan tagging correct now with two nics

vlan1 on the hp switch should be ports

1,2,3,4,5,6

vlan 100 on the hp switch should be ports

7,8

vlan1- U U U U U U T T
vlan100- E E E E E E U U

is that close?

edit-

ports 1-6 would be 192.168.1.x network

ports 7/8 would be 10.10.10.x network
port 7 is patch cable to vlan100 nic (second NIC) on pfsense box
port 8 is patch cable to a wifi router with DHCP disabled (pfsense will do that) or a direct laptop.

stephenw10 · Jun 30, 2012, 3:34 PM

VLAN1 is probably going to stop working here because hopefully you will stop sending any untagged packets to the switch from pfSense.

Configure the switch:


port:        1 2 3 4 5 6 7 8 
vlan1:       U U U U U U E E
vlan100:     T E E E E E U U

Unassign re1 from LAN to stop is sending untagged packets. This will lock you out of the pfSense box if you haven't got access from re2.

Steve

A Former User · Jun 30, 2012, 3:48 PM

@stephenw10:

VLAN1 is probably going to stop working here because hopefully you will stop sending any untagged packets to the switch from pfSense.

Configure the switch:
port:        1 2 3 4 5 6 7 8 
vlan1:       U U U U U U E E
vlan100:     T E E E E E U U
Unassign re1 from LAN to stop is sending untagged packets. This will lock you out of the pfSense box if you haven't got access from re2.

Steve

vlan 1 is going to stop working? what does that mean? i would still like all 192. computers to work.

by tagging port 1 in vlan100 is that what 'unassing re1 from LAN to stop sending untagged packets' is?

i will wait for a reply before i set it up that way.

Metu69salemi · Jun 30, 2012, 4:05 PM

create a new vlan say 10 or something else than 1 or 100
Use only your current lan interface as management interface and both two vlan's to the same nic where you have vlan currently.
so your network would be
nic(lan): 192.168.1.1 /24 for management, you could also use something else subnet area
vlan10 (on another nic): this would be your current lan, so whatever you like to use, but notice, that this vlan and above management subnet wouldn't work if they have same subnets
vlan100 (on same nic as vlan10): this would be same as currently

then add current configs to switch
vlan10: T U U U U U E E
vlan100: T E E E E E U U
remember to connect port 1 to pfsense

A Former User · Jun 30, 2012, 4:19 PM

@Metu69salemi:

create a new vlan say 10 or something else than 1 or 100
Use only your current lan interface as management interface and both two vlan's to the same nic where you have vlan currently.
so your network would be
nic(lan): 192.168.1.1 /24 for management, you could also use something else subnet area
vlan10 (on another nic): this would be your current lan, so whatever you like to use, but notice, that this vlan and above management subnet wouldn't work if they have same subnets
vlan100 (on same nic as vlan10): this would be same as currently

then add current configs to switch
vlan10: T U U U U U E E
vlan100: T E E E E E U U
remember to connect port 1 to pfsense

ok, what does vlan1 look like in the hp switch?

i think you just confused me more.

Metu69salemi · Jun 30, 2012, 5:05 PM

in this topology it doesn't exist
It is only "console" access to the firewall

A Former User · Jun 30, 2012, 5:58 PM

@Metu69salemi:

in this topology it doesn't exist
It is only "console" access to the firewall

let me rephrase.

that is ok if it is there and i dont use it, but i will have it in my switch. after reading the post, it seems as if my switch needs to look like this

vlan1
vlan10
vlan100

maybe we should start with pfsense, do i have that configured properly?

re0- WAN
re1- vlan100 (10.10.10.1) dhcp enabled
re2- LAN (192.168.1.1) dhcp enabled

–------------------
pfsense LAN goes into HP port 1 (vlan?) 192.168.1.x

pfsense vlan100 goes into HP port 7 (vlan100 on hp switch) 10.10.10.x and port 8 needs to be on vlan100 as well.

EDIT-

does the pfsense NIC even need to be a VLAN? if i am using a seperate NIC, shouldnt i be able to assign it to 10.10.10.x and deal with VLANs in the HP switch to segregate 10 traffic vs 192 traffic?

A Former User · Jul 1, 2012, 11:02 PM

did you guys give up on me?

;D