Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Adding VLANs to LAN - VLAN 0 Necessary?

    Routing and Multi WAN
    2
    5
    1.7k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mevans336
      last edited by

      I am planning to create 2 VLANs on my switches, 10 and 11, which will be children of the LAN interface. Right now, the LAN interface (and several servers on my switches) use the "default" VLAN for communication.

      If I add VLAN 10, 11, and set my switch ports to pass all untagged, plus 10 and 11 tagged (I can have my hypervisor add the necessary VLAN tags) will I lose the ability for the LAN interface to accept untagged traffic?

      I'd like to do something like this on the physical LAN interface:

      Default LAN Untagged = existing 192.168.1.1
      VLAN 10 Tagged = new subnet of 10.1.0.0/24
      VLAN 11 Tagged = new subnet of 10.2.0.0/24

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Yes you can do that.

        I try to avoid mixing tagged and untagged traffic on a port.

        You have to configure your switch port properly.  Switches like cheaper D-Links typically let you set one VLAN as untagged and others as tagged for a port.  Some higher-end switches make you set a specific mode (general on cisco, dual-mode on brocade, for example) to allow mixing of tagged and untagged ports.

        Untagged traffic received by the switch gets placed on the port's Primary VLAN ID (PVID).  Traffic for the PVID that is sent by the port is stripped of its VLAN ID and transmitted untagged.

        Oh.  And the untagged default VLAN is ID 1, not 0.

        Also, I would create another VLAN other than the default and use that as the untagged PVID.  When I start tagging traffic I pretend the default (ID 1) VLAN does not exist.  Any traffic on it should be ignored.  This brings a lot of benefits (You can tag it across a VLAN trunk link, for example, or to ESXi, etc.)  It can be treated as a "real" VLAN even though pfSense just sees it as untagged.  It's a little more work when you take the switch out of the box but it pays off later.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • M
          mevans336
          last edited by

          Thanks!

          Fortunately we have 10Gbps Powerconnect 8164 switches. I called Dell and they told me exactly how to configure the port to pass both untagged as well as 10 and 11 as tagged.

          And you're right on both counts - it's VLAN 1 but Hyper-V calls it 0, go figure. I have to change the port from access mode into general mode also.

          With what you've told me and what Dell has told me, I feel much more comfortable making the change, thank you!

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            I still wouldn't use VLAN 1, but it's your network.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • M
              mevans336
              last edited by

              @Derelict:

              I still wouldn't use VLAN 1, but it's your network.

              Unfortunately, we have too many moving pieces for me to change that too. We have some expansion plans in the works which will provide me an exact copy of my existing infrastructure and when we configure that, I will take your advice.

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.