DHCP Server Setup with a Layer 3 Switch



  • Hi all

    I'd like to make the following configuration:

    
                                 ------------
                                 - pfsense -
                                 ------------
                                      | .1
                                      |
                                      | (transit 10.0.0.0/30)
                                      |
                                      | .2
                ------------------------------------------------
                -               layer 3 switch                 -
                ------------------------------------------------
                     | .1                              .1 |
                     |                                    |
                     |                                    |
                     |                                    |
                     |                                    |
                     |                                    |
                     |                                    |
            ------------------                   ------------------
            -     VLAN10     -                   -     VLAN20     -
            -  10.0.10.0/24  -                   -  10.0.20.0/24  -
            ------------------                   ------------------
    
    

    Is it possible to configure pfSense as a DHCP Server for VLAN10 and VLAN20 (behind transit network), if the Layer 3 Switch would have a dhcp-helper address pointing to pfSense (for each VLAN SVI).

    Layer 3 Switch:

    • ip route 0.0.0.0 0.0.0.0 10.0.0.1

    • Terminates VLAN10 and VLAN20

    • interface vlan 10: dhcp-helper 10.0.0.1

    • interface vlan 20: dhcp-helper 10.0.0.1

    I'm also wondering how I have to configure pfSense.

    • Where do I have to make static routes for VLAN10 and VLAN20

    • How do I have to configure the Transit-Interface

    Thanks
    mki



  • Do you route lots of traffic between VLAN10 and VLAN20?
    Otherwise have pfSense do all routing and easy DHCP per interface.
    Or are there other demands for L3 not mentioned yet?


  • Rebel Alliance Global Moderator

    I don't think pfsense can be a dhcp server for a segment it does not have an interface in..  While yes if your moving lots and lots of data between those networks it makes sense to do it that the the switch vs pfsense.  But you loose the pfsense great firewall when you have your L3 switch do it..  While some switches have the ability for ACLs etc.. sure not as robust as pfsense.

    If you want that sort of setup you need a different dhcp server.



  • I'll do a lot of routing between the two VLAN's.

    My pfSense is running on an APU Board. Throughput is approx. 300Mbit, that's why I want to use a my Layer 3 Switch.

    Do I get One Gigabit throughput with a SG-2440?


  • Rebel Alliance Global Moderator

    So are you running acls on the switch, how many clients - why don't you just put them on 1 segment?

    Again if you want to do it that way - pfsense dhcp can not hand out IPs for a scope it does not have a interface in.  You will have to use dhcp off your switch or some other dhcp server on one of your segments and then a helper on the switch.



  • Sorry, I'm doing way too few L3 setups to be sure … but I think it could/should work this way:

    pfSense1  10.0.10.1/24
    switch_1  10.0.10.254/24  gw 10.0.10.1
    clients_1  10.0.10.xy/24  gw 10.0.10.254

    pfSense2  10.0.20.1/24
    switch_2  10.0.20.254/24  gw 10.0.20.1
    clients_2  10.0.20.xy/24  gw 10.0.20.254

    Basically, clients get an IP from DHCP req via pfSense since it listens in this broadcast domain.
    Clients' gateway is the switches IP which routes internally to other subnet(s) or its own gateway for other destinations.

    Links to pfSense can be physical or virtual on a trunk and shouldn't matter.


  • Netgate

    That means the switch has to route traffic for the same subnet out the same interface it was received on.  Completely unsound.  And you'd be gaining nothing.  Just set the default gateway to pfSense and turn off Layer 3 in the switch.

    Use a DHCP server that can properly handle helper addresses in the switch and answer from the correct scope.  ISC is perfectly capable of doing so but not with the config options provided by the pfSense GUI.  Windows Server 03/08/12 can do it too.

    It's OK if pfSense is not the right tool for some tasks.



  • @Derelict:

    ISC is perfectly capable of doing so but not with the config options provided by the pfSense GUI.

    But if I configure ISC DHCP Server on pfSense over console it should be possible? I'll give it a try :)


  • Netgate

    No.  That's not at all what I said.  Your config will be clobbered every time you touch DHCP in the webgui , upgrade, etc.

    Use a different server for DHCP.  pfSense is not the right tool for this job.


  • Rebel Alliance Global Moderator

    If you need to route lots of traffic between your 2 vlans - why are you using vlans if your not using acls?

    Just put them in 1 network.  And if your going to use the switch as L3 then the switch needs the gateways for those segments - with a route pointing towards your pfsense IP in the transit network you had setup.  I would either do dhcp off the switch or off dhcp server. Pfsense not meant to be used in this fashion - its not built for it as of yet.


  • Banned

    @Derelict:

    Use a DHCP server that can properly handle helper addresses in the switch and answer from the correct scope.  ISC is perfectly capable of doing so but not with the config options provided by the pfSense GUI.  Windows Server 03/08/12 can do it too.

    It's OK if pfSense is not the right tool for some tasks.

    The code to provide this has been available and requested to be merged, hmmm… some 18 months ago at least.

    https://github.com/pfsense/pfsense/pull/816
    https://forum.pfsense.org/index.php?topic=65736.0



  • @Derelict:

    That means the switch has to route traffic for the same subnet out the same interface it was received on.

    Don't think so, no.


  • Netgate

    Yes.  When talking about the "same interface" we are talking about the switch's layer 3 interface, not the switch ports themselves..

    pfSense1  10.0.10.1/24
    switch_1  10.0.10.254/24  gw 10.0.10.1
    clients_1  10.0.10.xy/24  gw 10.0.10.254

    switch receives traffic from 10.0.10.100 on 10.0.10.254/24
    switch "routes" traffic from 10.0.10.254 to 10.0.10.1/24 - same subnet, out the same interface it arrived on.

    client 10.0.10.100 could just as easily have 10.0.10.1 as its default gateway and eliminate the extra in/out hop to/from 10.0.10.254 and all the associated problems (ICMP redirects, etc).



  • @Derelict:

    … talking about the switch's layer 3 interface, not the switch ports themselves...

    absolutely, yes!

    Give me two or 3 days, I have to look it up. There was a way to make it possible.
    Quite some time ago I called a CCIE friend to solve a routing problem in an install. He came up with a solution quite close to this thread.
    I'll be back!  ;-)


  • Netgate

    For what reason?  Just set the hosts' gateways to pfSense.

    I'm not saying it's impossible.  I'm just saying it's unecessary.  Why add the hop and jump though the hoops?


  • Rebel Alliance Global Moderator

    Huh, the OP clearly stated he has a transit network.. where would the switch be doing any hair pinning

    This is how it wold normally be done - see attached.  While its nice that there has been some code for pfsense to be dhcp server for other than its own locally attached networks - that is currently not the case.




  • @Derelict:

    For what reason?

    For the reason that OP needs line speed routing between VLANs and the ALIX surely isn't capable of doing so.
    Otherwise it would be easy, wouldn't it?  ;-)

    @johnpoz:

    Huh, the OP clearly stated he has a transit network..

    Which I interpreted as his/her way of solving the problem. It's defined with a /30 netmask.


  • Rebel Alliance Global Moderator

    You would always use a transit network if your going to have a downstream router.

    Solving what problem exactly?  There is no problem with using downstream routers.. The problem is pfsense doesn't support dhcp when it doesn't have an interface in that network.


  • Netgate

    I know OP doesn't have any hairpinning.  I'm discouraging the suggestion of hairpinning.

    I know pfSense's DHCP doesn't support the config, which is why I suggested another DHCP server.

    Everyone seems so hell-bent on getting pfSense to do it (including OP with his outside-GUI config of ISC dhcpd) when it's clearly not the right tool for this job (And that's OK. Really.).



  • OK, looked it up. It works the way I described it above. I have this running at one site (without pfSense but that's another story).

    You could, of course, setup the network with two segments and a trunk port (or two physical connections if enough interfaces available) to pfSense as done regularly and add a route to the other segment in the host's routing table pointing to this L3 switches gateway. Intra-VLAN routing will be done by the switch, the rest is handled by pfSense in a common way.
    Or did I miss anything?


  • Rebel Alliance Global Moderator

    And why put host routes on all your boxes??  When all you have to do is use a transit network to connect your downstream router to your edge router and your done..



  • Intention was to have pfSense handle DHCP etc to VLAN1 and VLAN2 as well. Cannot be done with one transit network, right?


  • Rebel Alliance Global Moderator

    No it can not be dhcp unless it has an IP in the interface.. So run a different dhcp server ;)

    host routing on every host he has, so he can run dhcp on pfsense seem like a really bad trade off to me.. Especially since I have never seen a L3 switch that didn't have dhcp as a feature..  So just run it at the switch..

    If he is a AD shop he should be running dhcp on his AD anyway, etc..  What advantage is there to running it on pfsense in a scenario that is not supported, so you going to have to put host routes on every box or your hairpinning.

    There are always multiple ways to skin the cat, doesn't mean some of them are good ideas ;)



  • This setup is so basic that we seem to lose the big picture.
    One APU, one L3 switch with 2 segments. DHCP (and probably DNS etc as well) for both segments.
    This probably is the most basic +1 setup all of us can imagine.

    Now add inter-VLAN routing at the L3 switch to it and we cannot come up with a solution that does not need additional hardware? Come on!


  • Banned

    @jahonix:

    Now add inter-VLAN routing at the L3 switch to it and we cannot come up with a solution that does not need additional hardware? Come on!

    People have already come with a solution. That solution has turned into bitrot for absolutely inexplicable reason.

    Patch has conflicts and cannot be merged. Can you please re-submit and I'll take care of testing and get it merged. Sorry for the long delay

    No shit, Sherlock. After 1,5 year it can no longer be automatically merged? Shocking. No, seriously. It was already resubmitted once and once again ignored for another 6 months. You suppose people will keep resubmitting every half year, they don't have better things to do with their time for sure.


  • Rebel Alliance Global Moderator

    What extra hardware?  The L3 switch I am quite sure can hand out some dhcp addresses ;)

    As to why this is not a current feature of pfsense I would guess its not a really needed feature by the majority of the user base..  Normally you would have pfsense do your intervlan routing - this also added feature of full firewall features that many L3 switches would lack.

    Would it be nice feature - sure it would come in handy for this sort of scenario.

    If your so large that that your wanting to handle intervlan at a L3 switch, then your prob so large that your already running a dhcp server be it AD or not, etc.  Which again reduces the actual need of pfsense being able to handle this specific sort of scenario.

    Kind of a special case if you ask me, large enough network that you need multiple vlans but no firewall between them and so much traffic between them that your pfsense box does not handle it well, etc.  So you want to do it at L3 switch - but you still want to run dhcp on your edge router/firewall?

    I would think the best solution for this OP is just use 1 segment so just doing L2 and pfsense can be his dhcp server, etc.  But he has not given details to why he need 2 segments or even if doing any ACLs at the switch between them, etc.  Would really need a lot of devices to have vlans to shrink your broadcast domains, etc.d

    I don't think the devs or even the users expect pfsense to be all things for all scenarios.. In a scenario where your running down stream L3 switches and pfsense is your edge I don't really think pfsense being your dhcp server is a huge userbase..


  • Netgate

    pfSense, as it is now, does not do this.  To come up with cockamamie schemes involving putting static routes on hosts just to use the pfSense DHCP server is just ludicrous.

    As has been mentioned, the switch probably does DHCP on its L3 VIFs.



  • @johnpoz:

    What extra hardware?  The L3 switch I am quite sure can hand out some dhcp addresses ;)

    As to why this is not a current feature of pfsense I would guess its not a really needed feature by the majority of the user base..  Normally you would have pfsense do your intervlan routing - this also added feature of full firewall features that many L3 switches would lack.

    Would it be nice feature - sure it would come in handy for this sort of scenario.

    If your so large that that your wanting to handle intervlan at a L3 switch, then your prob so large that your already running a dhcp server be it AD or not, etc.  Which again reduces the actual need of pfsense being able to handle this specific sort of scenario.

    Kind of a special case if you ask me, large enough network that you need multiple vlans but no firewall between them and so much traffic between them that your pfsense box does not handle it well, etc.  So you want to do it at L3 switch - but you still want to run dhcp on your edge router/firewall?

    I would think the best solution for this OP is just use 1 segment so just doing L2 and pfsense can be his dhcp server, etc.  But he has not given details to why he need 2 segments or even if doing any ACLs at the switch between them, etc.  Would really need a lot of devices to have vlans to shrink your broadcast domains, etc.d

    I don't think the devs or even the users expect pfsense to be all things for all scenarios.. In a scenario where your running down stream L3 switches and pfsense is your edge I don't really think pfsense being your dhcp server is a huge userbase..

    I was looking for hte same working with some l3 switches. it will be an option at pfsense at some point.
    =)