DHCP Server Setup with a Layer 3 Switch

mki · May 24, 2015, 9:04 PM

Hi all

I'd like to make the following configuration:


                             ------------
                             - pfsense -
                             ------------
                                  | .1
                                  |
                                  | (transit 10.0.0.0/30)
                                  |
                                  | .2
            ------------------------------------------------
            -               layer 3 switch                 -
            ------------------------------------------------
                 | .1                              .1 |
                 |                                    |
                 |                                    |
                 |                                    |
                 |                                    |
                 |                                    |
                 |                                    |
        ------------------                   ------------------
        -     VLAN10     -                   -     VLAN20     -
        -  10.0.10.0/24  -                   -  10.0.20.0/24  -
        ------------------                   ------------------

Is it possible to configure pfSense as a DHCP Server for VLAN10 and VLAN20 (behind transit network), if the Layer 3 Switch would have a dhcp-helper address pointing to pfSense (for each VLAN SVI).

Layer 3 Switch:

ip route 0.0.0.0 0.0.0.0 10.0.0.1
Terminates VLAN10 and VLAN20
interface vlan 10: dhcp-helper 10.0.0.1
interface vlan 20: dhcp-helper 10.0.0.1

I'm also wondering how I have to configure pfSense.

Where do I have to make static routes for VLAN10 and VLAN20
How do I have to configure the Transit-Interface

Thanks
mki

jahonix · May 24, 2015, 10:31 PM

Do you route lots of traffic between VLAN10 and VLAN20?
Otherwise have pfSense do all routing and easy DHCP per interface.
Or are there other demands for L3 not mentioned yet?

johnpoz · May 24, 2015, 11:45 PM

I don't think pfsense can be a dhcp server for a segment it does not have an interface in.. While yes if your moving lots and lots of data between those networks it makes sense to do it that the the switch vs pfsense. But you loose the pfsense great firewall when you have your L3 switch do it.. While some switches have the ability for ACLs etc.. sure not as robust as pfsense.

If you want that sort of setup you need a different dhcp server.

mki · May 25, 2015, 8:32 AM

I'll do a lot of routing between the two VLAN's.

My pfSense is running on an APU Board. Throughput is approx. 300Mbit, that's why I want to use a my Layer 3 Switch.

Do I get One Gigabit throughput with a SG-2440?

johnpoz · May 25, 2015, 12:11 PM

So are you running acls on the switch, how many clients - why don't you just put them on 1 segment?

Again if you want to do it that way - pfsense dhcp can not hand out IPs for a scope it does not have a interface in. You will have to use dhcp off your switch or some other dhcp server on one of your segments and then a helper on the switch.

jahonix · May 25, 2015, 3:58 PM

Sorry, I'm doing way too few L3 setups to be sure … but I think it could/should work this way:

pfSense1 10.0.10.1/24
switch_1 10.0.10.254/24 gw 10.0.10.1
clients_1 10.0.10.xy/24 gw 10.0.10.254

pfSense2 10.0.20.1/24
switch_2 10.0.20.254/24 gw 10.0.20.1
clients_2 10.0.20.xy/24 gw 10.0.20.254

Basically, clients get an IP from DHCP req via pfSense since it listens in this broadcast domain.
Clients' gateway is the switches IP which routes internally to other subnet(s) or its own gateway for other destinations.

Links to pfSense can be physical or virtual on a trunk and shouldn't matter.

Derelict · May 25, 2015, 5:05 PM

That means the switch has to route traffic for the same subnet out the same interface it was received on. Completely unsound. And you'd be gaining nothing. Just set the default gateway to pfSense and turn off Layer 3 in the switch.

Use a DHCP server that can properly handle helper addresses in the switch and answer from the correct scope. ISC is perfectly capable of doing so but not with the config options provided by the pfSense GUI. Windows Server 03/08/12 can do it too.

It's OK if pfSense is not the right tool for some tasks.

mki · May 25, 2015, 7:43 PM

@Derelict:

ISC is perfectly capable of doing so but not with the config options provided by the pfSense GUI.

But if I configure ISC DHCP Server on pfSense over console it should be possible? I'll give it a try :)

Derelict · May 25, 2015, 7:51 PM

No. That's not at all what I said. Your config will be clobbered every time you touch DHCP in the webgui , upgrade, etc.

Use a different server for DHCP. pfSense is not the right tool for this job.

johnpoz · May 25, 2015, 7:53 PM

If you need to route lots of traffic between your 2 vlans - why are you using vlans if your not using acls?

Just put them in 1 network. And if your going to use the switch as L3 then the switch needs the gateways for those segments - with a route pointing towards your pfsense IP in the transit network you had setup. I would either do dhcp off the switch or off dhcp server. Pfsense not meant to be used in this fashion - its not built for it as of yet.

doktornotor · May 25, 2015, 7:54 PM

@Derelict:

Use a DHCP server that can properly handle helper addresses in the switch and answer from the correct scope. ISC is perfectly capable of doing so but not with the config options provided by the pfSense GUI. Windows Server 03/08/12 can do it too.

It's OK if pfSense is not the right tool for some tasks.

The code to provide this has been available and requested to be merged, hmmm… some 18 months ago at least.

https://github.com/pfsense/pfsense/pull/816
https://forum.pfsense.org/index.php?topic=65736.0

jahonix · May 25, 2015, 8:40 PM

@Derelict:

That means the switch has to route traffic for the same subnet out the same interface it was received on.

Don't think so, no.

Derelict · May 25, 2015, 8:50 PM

Yes. When talking about the "same interface" we are talking about the switch's layer 3 interface, not the switch ports themselves..

pfSense1 10.0.10.1/24
switch_1 10.0.10.254/24 gw 10.0.10.1
clients_1 10.0.10.xy/24 gw 10.0.10.254

switch receives traffic from 10.0.10.100 on 10.0.10.254/24
switch "routes" traffic from 10.0.10.254 to 10.0.10.1/24 - same subnet, out the same interface it arrived on.

client 10.0.10.100 could just as easily have 10.0.10.1 as its default gateway and eliminate the extra in/out hop to/from 10.0.10.254 and all the associated problems (ICMP redirects, etc).

jahonix · May 25, 2015, 9:04 PM

@Derelict:

… talking about the switch's layer 3 interface, not the switch ports themselves...

absolutely, yes!

Give me two or 3 days, I have to look it up. There was a way to make it possible.
Quite some time ago I called a CCIE friend to solve a routing problem in an install. He came up with a solution quite close to this thread.
I'll be back! ;-)

Derelict · May 25, 2015, 10:26 PM

For what reason? Just set the hosts' gateways to pfSense.

I'm not saying it's impossible. I'm just saying it's unecessary. Why add the hop and jump though the hoops?

johnpoz · May 26, 2015, 1:23 AM

Huh, the OP clearly stated he has a transit network.. where would the switch be doing any hair pinning

This is how it wold normally be done - see attached. While its nice that there has been some code for pfsense to be dhcp server for other than its own locally attached networks - that is currently not the case.

jahonix · May 26, 2015, 2:21 AM

@Derelict:

For what reason?

For the reason that OP needs line speed routing between VLANs and the ALIX surely isn't capable of doing so.
Otherwise it would be easy, wouldn't it? ;-)

@johnpoz:

Huh, the OP clearly stated he has a transit network..

Which I interpreted as his/her way of solving the problem. It's defined with a /30 netmask.

johnpoz · May 26, 2015, 2:23 AM

You would always use a transit network if your going to have a downstream router.

Solving what problem exactly? There is no problem with using downstream routers.. The problem is pfsense doesn't support dhcp when it doesn't have an interface in that network.

Derelict · May 26, 2015, 6:03 AM

I know OP doesn't have any hairpinning. I'm discouraging the suggestion of hairpinning.

I know pfSense's DHCP doesn't support the config, which is why I suggested another DHCP server.

Everyone seems so hell-bent on getting pfSense to do it (including OP with his outside-GUI config of ISC dhcpd) when it's clearly not the right tool for this job (And that's OK. Really.).

jahonix · May 28, 2015, 11:09 PM

OK, looked it up. It works the way I described it above. I have this running at one site (without pfSense but that's another story).

You could, of course, setup the network with two segments and a trunk port (or two physical connections if enough interfaces available) to pfSense as done regularly and add a route to the other segment in the host's routing table pointing to this L3 switches gateway. Intra-VLAN routing will be done by the switch, the rest is handled by pfSense in a common way.
Or did I miss anything?