DHCP Server Setup with a Layer 3 Switch

jahonix · May 25, 2015, 3:58 PM

Sorry, I'm doing way too few L3 setups to be sure … but I think it could/should work this way:

pfSense1 10.0.10.1/24
switch_1 10.0.10.254/24 gw 10.0.10.1
clients_1 10.0.10.xy/24 gw 10.0.10.254

pfSense2 10.0.20.1/24
switch_2 10.0.20.254/24 gw 10.0.20.1
clients_2 10.0.20.xy/24 gw 10.0.20.254

Basically, clients get an IP from DHCP req via pfSense since it listens in this broadcast domain.
Clients' gateway is the switches IP which routes internally to other subnet(s) or its own gateway for other destinations.

Links to pfSense can be physical or virtual on a trunk and shouldn't matter.

Derelict · May 25, 2015, 5:05 PM

That means the switch has to route traffic for the same subnet out the same interface it was received on. Completely unsound. And you'd be gaining nothing. Just set the default gateway to pfSense and turn off Layer 3 in the switch.

Use a DHCP server that can properly handle helper addresses in the switch and answer from the correct scope. ISC is perfectly capable of doing so but not with the config options provided by the pfSense GUI. Windows Server 03/08/12 can do it too.

It's OK if pfSense is not the right tool for some tasks.

mki · May 25, 2015, 7:43 PM

@Derelict:

ISC is perfectly capable of doing so but not with the config options provided by the pfSense GUI.

But if I configure ISC DHCP Server on pfSense over console it should be possible? I'll give it a try :)

Derelict · May 25, 2015, 7:51 PM

No. That's not at all what I said. Your config will be clobbered every time you touch DHCP in the webgui , upgrade, etc.

Use a different server for DHCP. pfSense is not the right tool for this job.

johnpoz · May 25, 2015, 7:53 PM

If you need to route lots of traffic between your 2 vlans - why are you using vlans if your not using acls?

Just put them in 1 network. And if your going to use the switch as L3 then the switch needs the gateways for those segments - with a route pointing towards your pfsense IP in the transit network you had setup. I would either do dhcp off the switch or off dhcp server. Pfsense not meant to be used in this fashion - its not built for it as of yet.

doktornotor · May 25, 2015, 7:54 PM

@Derelict:

Use a DHCP server that can properly handle helper addresses in the switch and answer from the correct scope. ISC is perfectly capable of doing so but not with the config options provided by the pfSense GUI. Windows Server 03/08/12 can do it too.

It's OK if pfSense is not the right tool for some tasks.

The code to provide this has been available and requested to be merged, hmmm… some 18 months ago at least.

https://github.com/pfsense/pfsense/pull/816
https://forum.pfsense.org/index.php?topic=65736.0

jahonix · May 25, 2015, 8:40 PM

@Derelict:

That means the switch has to route traffic for the same subnet out the same interface it was received on.

Don't think so, no.

Derelict · May 25, 2015, 8:50 PM

Yes. When talking about the "same interface" we are talking about the switch's layer 3 interface, not the switch ports themselves..

pfSense1 10.0.10.1/24
switch_1 10.0.10.254/24 gw 10.0.10.1
clients_1 10.0.10.xy/24 gw 10.0.10.254

switch receives traffic from 10.0.10.100 on 10.0.10.254/24
switch "routes" traffic from 10.0.10.254 to 10.0.10.1/24 - same subnet, out the same interface it arrived on.

client 10.0.10.100 could just as easily have 10.0.10.1 as its default gateway and eliminate the extra in/out hop to/from 10.0.10.254 and all the associated problems (ICMP redirects, etc).

jahonix · May 25, 2015, 9:04 PM

@Derelict:

… talking about the switch's layer 3 interface, not the switch ports themselves...

absolutely, yes!

Give me two or 3 days, I have to look it up. There was a way to make it possible.
Quite some time ago I called a CCIE friend to solve a routing problem in an install. He came up with a solution quite close to this thread.
I'll be back! ;-)

Derelict · May 25, 2015, 10:26 PM

For what reason? Just set the hosts' gateways to pfSense.

I'm not saying it's impossible. I'm just saying it's unecessary. Why add the hop and jump though the hoops?

johnpoz · May 26, 2015, 1:23 AM

Huh, the OP clearly stated he has a transit network.. where would the switch be doing any hair pinning

This is how it wold normally be done - see attached. While its nice that there has been some code for pfsense to be dhcp server for other than its own locally attached networks - that is currently not the case.

jahonix · May 26, 2015, 2:21 AM

@Derelict:

For what reason?

For the reason that OP needs line speed routing between VLANs and the ALIX surely isn't capable of doing so.
Otherwise it would be easy, wouldn't it? ;-)

@johnpoz:

Huh, the OP clearly stated he has a transit network..

Which I interpreted as his/her way of solving the problem. It's defined with a /30 netmask.

johnpoz · May 26, 2015, 2:23 AM

You would always use a transit network if your going to have a downstream router.

Solving what problem exactly? There is no problem with using downstream routers.. The problem is pfsense doesn't support dhcp when it doesn't have an interface in that network.

Derelict · May 26, 2015, 6:03 AM

I know OP doesn't have any hairpinning. I'm discouraging the suggestion of hairpinning.

I know pfSense's DHCP doesn't support the config, which is why I suggested another DHCP server.

Everyone seems so hell-bent on getting pfSense to do it (including OP with his outside-GUI config of ISC dhcpd) when it's clearly not the right tool for this job (And that's OK. Really.).

jahonix · May 28, 2015, 11:09 PM

OK, looked it up. It works the way I described it above. I have this running at one site (without pfSense but that's another story).

You could, of course, setup the network with two segments and a trunk port (or two physical connections if enough interfaces available) to pfSense as done regularly and add a route to the other segment in the host's routing table pointing to this L3 switches gateway. Intra-VLAN routing will be done by the switch, the rest is handled by pfSense in a common way.
Or did I miss anything?

johnpoz · May 29, 2015, 10:31 AM

And why put host routes on all your boxes?? When all you have to do is use a transit network to connect your downstream router to your edge router and your done..

jahonix · May 29, 2015, 10:33 AM

Intention was to have pfSense handle DHCP etc to VLAN1 and VLAN2 as well. Cannot be done with one transit network, right?

johnpoz · May 29, 2015, 10:37 AM

No it can not be dhcp unless it has an IP in the interface.. So run a different dhcp server ;)

host routing on every host he has, so he can run dhcp on pfsense seem like a really bad trade off to me.. Especially since I have never seen a L3 switch that didn't have dhcp as a feature.. So just run it at the switch..

If he is a AD shop he should be running dhcp on his AD anyway, etc.. What advantage is there to running it on pfsense in a scenario that is not supported, so you going to have to put host routes on every box or your hairpinning.

There are always multiple ways to skin the cat, doesn't mean some of them are good ideas ;)

jahonix · May 29, 2015, 11:20 AM

This setup is so basic that we seem to lose the big picture.
One APU, one L3 switch with 2 segments. DHCP (and probably DNS etc as well) for both segments.
This probably is the most basic +1 setup all of us can imagine.

Now add inter-VLAN routing at the L3 switch to it and we cannot come up with a solution that does not need additional hardware? Come on!

doktornotor · May 29, 2015, 11:36 AM

@jahonix:

Now add inter-VLAN routing at the L3 switch to it and we cannot come up with a solution that does not need additional hardware? Come on!

People have already come with a solution. That solution has turned into bitrot for absolutely inexplicable reason.

Patch has conflicts and cannot be merged. Can you please re-submit and I'll take care of testing and get it merged. Sorry for the long delay

No shit, Sherlock. After 1,5 year it can no longer be automatically merged? Shocking. No, seriously. It was already resubmitted once and once again ignored for another 6 months. You suppose people will keep resubmitting every half year, they don't have better things to do with their time for sure.