Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VLAN Setup questions

    General pfSense Questions
    4
    12
    7.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Y
      yaboc
      last edited by

      Hi,

      I recently build a pfsense box with two NICs (em0 - wan and em1 - lan) to help with our VOIP QoS issue.

      The setup is pfsense -> managed switch -> phones -> PCs

      By default pfsense creates LAN interface with 192.168.1.1

      i created additional VLANS (VOICE - 67 and DATA - 66) and assigned them to em1 - lan interface as well as enabled DHCP on them.

      created 67 and 66 VLANS the managed switch (FS728TP). i'm just playing with only two ports to check if i get the desired result.

      port 28 going to pfsense box is checked as TAGGED on both VLANS.

      port 2 (my test port) is checked TAGGED on VLAN 67 VOICE (i also use this tag in phones configuration so it can tag the packets with the right VLAN id) and UNTAGGED on VLAN 66 DATA. Also setting up PVID for that port to 66 gives me the desired result so when phone is connected to switch it gets 67.0/24 dhcp address and pc connected to the phone gets 66.0/24 dhcp address.

      Is my understanding right that when the packets are passed as UNTAGGED to VLAN 66 DATA the ports sets the default packet header to VLAN 66 and that basically assigns everything else behind it (in my case PC) to VLAN 66 ?

      Also i have a handfull of network printers, is it okay to leave them on DATA VLAN or is it advisable to create separate VLAN for them?

      In this thread

      http://forum.pfsense.org/index.php?topic=34739.0

      GruensFroeschli says

      _Don't mix untagged and tagged traffic on the same parent interface.

      Leave WAN on vr1
      Delete LAN on vr0
      –> Create DATA as vlan on vr0
      --> create VOICE as vlan on vr0

      Then connect the vr0 interface to the switch.
      Configure the VLANs on the switch as tagged on the port going to the pfSense._

      What does he mean by mixing UNTAGGED AND TAGGED traffic? And also why should one delete the LAN ? Thanks in advance for any information.

      1 Reply Last reply Reply Quote 0
      • P
        podilarius
        last edited by

        I think the setup should be:
        port 28 - tagged on both VLANS
        port 2 - tagged on both VLANs

        This way the VLAN tag from the phone is respected all the way to the switch and then to pfSense.
        If I recall correctly, a untagged port in a VLAN is like an access port (can only be on one VLAN).
        tagged ports passes the tag on. see the last post in the topic you sent. Most likely your phones are acting as switches and are already tagging packets (as mine does).

        But this of course depends on the managed switch maker and model. If you sent that, we can get the terminology correct.

        i would leave the printers in the data vlan … most phones do not need to print.

        1 Reply Last reply Reply Quote 0
        • Y
          yaboc
          last edited by

          thanks podilarius ill try that tomorrow

          why would port 2 be tagged on both VLANs?

          The PCs packets won't be tagged with the VLAN TAG only Phones configuration have the tag (67 VOICE) specified.
          so PVID is set on port 2 to 66 to put any device with no tag specified to VLAN 66 DATA.

          i sort of followed the logic in this write up which is sort of easy to understand

          http://www.alexwilliams.ca/blog/2009/01/17/segmenting-your-corporate-network-with-vlans/

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            As it says in the link blog post I would expect to have to port tagged on 67 and untagged on 66. Just check that you can't use the phone to strip the VLAN66 tags. As though it were a managed switch. This would allow you to send both VLANs tagged to the phone which would be 'nicer' in my opinion.

            The reason that it is a bad idea to mix tagged and untagged traffic on a pfSense interface is that some NICs/drivers cause problems doing this. For an example of this see this epic thread. No VLAN traffic would pass as long as untagged traffic was being sent. However em(4) NICs are generally much more compliant. You may have no problems but be aware of it if issues arise.

            Steve

            1 Reply Last reply Reply Quote 0
            • P
              podilarius
              last edited by

              Some phones tag the packets from the PC attached to them. If yours does not, then I would imagine you would be correct on your setup where you have port 2 as tagged on vlan 67 and untagged traffic to vlan 66 with the pvid to 66. If you are getting the desired results, then you already have your answers as to what your switch, phones, and NICs are capable of. The only reason to delete LAN is to remove access to the internet from the default VLAN. You can actually reasign LAN to your data VLAN if you like (in 2.1 at least).

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                A reason to delete LAN, in that particular case, is that it was a non VLAN interface on a NIC also carrying VLANs. Hence mixing tagged and non-tagged traffic.

                Steve

                1 Reply Last reply Reply Quote 0
                • Y
                  yaboc
                  last edited by

                  i got this somehow working but im still unsure why it works the way it's set up

                  this is what i have that's working using these settings

                  pfsense 2.1BETA - NETGEAR FS728TP

                  LAN             10.18.65.1
                  DATA VLAN   10.18.66.1
                  VOICE VLAN  10.18.67.1

                  now pfsense is accessed via 10.18.65.1 and switch 10.18.65.2.

                  you guys are saying i can merge or delete LAN so i won't be mixing traffic. how would i assign pfsense to DATA VLAN range ?
                  also it seems that LAN has automatically rules created to access all VLANs, another reason to geet rid of LAN ?

                  pfsense goes to port28 on managed switch which is tagged with both (66 and 67 VLANS)

                  port2 is TAGGED on VLAN 67 (voice) and UNTAGGED on VLAN 66 (data) and then PVID is set to 66 (data) on that port.

                  the above setup works with phone getting VOICE ip and pc getting DATA ip.

                  I'm still trying to see how it would be possible to set it up with port being tagged on both VLANs.
                  When i tried that PC connected to the phone was getting ip from the LAN subnet.

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    @yaboc:

                    you guys are saying i can merge or delete LAN so i won't be mixing traffic. how would i assign pfsense to DATA VLAN range ?

                    I'm saying that is the recommended practice but if it's working OK for you then test it for while.

                    @yaboc:

                    also it seems that LAN has automatically rules created to access all VLANs, another reason to geet rid of LAN ?

                    LAN has some rules aplied by default, 'Lan to any' and 'anti lockout rule'. You can just delete these rules if they don't fit your firewall setup.

                    @yaboc:

                    pfsense goes to port28 on managed switch which is tagged with both (66 and 67 VLANS)

                    port2 is TAGGED on VLAN 67 (voice) and UNTAGGED on VLAN 66 (data) and then PVID is set to 66 (data) on that port.

                    the above setup works with phone getting VOICE ip and pc getting DATA ip.

                    I'm unsure how PVID comes into play here but otherwise that's what I would expect.

                    @yaboc:

                    I'm still trying to see how it would be possible to set it up with port being tagged on both VLANs.
                    When i tried that PC connected to the phone was getting ip from the LAN subnet.

                    To have the port tagged on both VLANs you phone has to be able to strip the tag from packets going to the PC and replace it on returning packets.
                    To prevent the PC getting a LAN IP you should set port 2 to exclude the default vlan.

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • Y
                      yaboc
                      last edited by

                      I'm unsure how PVID comes into play here but otherwise that's what I would expect.

                      when i tried UNTAGGED on 66 without PVID set up, the PC was getting IP from the DEFAULT LAN and not DATA VLAN, so PVID of 66 forces it to go to 66 VLAN ?

                      To have the port tagged on both VLANs you phone has to be able to strip the tag from packets going to the PC and replace it on returning packets.
                      To prevent the PC getting a LAN IP you should set port 2 to exclude the default vlan.

                      the phones in question are Grandstream GXP2120, they only seem to have setting for Vlan Tagging, nothing else besides that in the config page, so i guess they don't support tag stripping.

                      1 Reply Last reply Reply Quote 0
                      • C
                        cmb
                        last edited by

                        PVID determines what VLAN any untagged frames coming into that switch port end up on. You'll virtually always want that set the same as whichever VLAN the port is an untagged member of.

                        1 Reply Last reply Reply Quote 0
                        • Y
                          yaboc
                          last edited by

                          awesome i found this thread that explains a lot about my setup and even similar hardware

                          http://forum.pfsense.org/index.php?topic=14918.0

                          only thing i'm trying to see now is how to delete lan and replace it with vlan and make pfsense and switch accessible from it as per original post and quote

                          _GruensFroeschli says

                          Don't mix untagged and tagged traffic on the same parent interface.

                          Leave WAN on vr1
                          Delete LAN on vr0
                          –> Create DATA as vlan on vr0
                          --> create VOICE as vlan on vr0

                          Then connect the vr0 interface to the switch.
                          Configure the VLANs on the switch as tagged on the port going to the pfSense._

                          how would i reassign it to a vlan or just simply delete it and only keep vlans. i tried to del lan and it locked me out. everything works ok but i guess i want to stick to the proper setup.

                          1 Reply Last reply Reply Quote 0
                          • Y
                            yaboc
                            last edited by

                            btw thanks for all the info guys. i'm learning a lot thanks to You! i hope this thread and any info / links here will help others!

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post