Pfsense and vlan on same subnet

  • I'm working with a cisco SG300-52 and its set on L3 mode.

    My pfsense LAN interface is set on:

    on the cisco switch I have few VLANs configured, and the Cisco is also the default GW and the DHCP for the VLANs.

    VLAN1    GW         DHCP Range
    VLAN2    GW   
    VLAN3   GW 

    Is this a problem to have both the Firewall (  and a VLAN port (  operate on the same subnet even though they do not conflict with the IP?
    ideally I would like to have the pfsense box LAN set to and the switch vlans and on …

  • Based on the information you've given here, I can't see anything specifically wrong with this. The only possible issue I can see is what route outbound your Cisco is using. Your VLANs are set to use the Cisco as their default gateway, but you haven't provided the routing table information for the switch. Presumably you can route traffic across each of the VLANs, but you would need to set the default route on the Cisco to point to your pfsense box, assuming this is your main firewall out to the internet.

  • LAYER 8 Global Moderator

    Yeah if your going to have a downstream router, the connectivity to your upstream router should be via a transit network.  You need to also let pfsense know about these downstream networks and how to get to them via the IP of the cisco in the transit network.

  • Thanks guys for the replies. I appreciate the help.

    I ended up disabling the DHCP Pools on the Cisco SG300 L3 switch and created/serve DHCP Pools on the pfsense box.

    I left intact the "IPv4 Interfaces" I created for my all my VLANs on the Cisco SG300

    The pfsense machine has two WAN interfaces, set on static IP info received from ISP.
    The Pfsense machine LAN IP interface is set on and I have added the following VLAN interfaces:


    so now a device connected to relevant switch port will look like

    VLAN1   (pfsense web) Subnet  GW     (Cisco still accessible via
    VLAN2   (pfsense web) Subnet  GW     (Cisco still accessible via    
    VLAN10 (pfsense web) Subnet  GW  (Cisco still accessible via
    VLAN20 (pfsense web) Subnet  GW  (Cisco still accessible via
    VLAN30 (pfsense web) Subnet  GW  (Cisco still accessible via

    I can see the traffic in my firewall logs and my NAT rules for couple tested devices worked fine after adding the NAT/firewall rules.

    So my other questions are:

    1. Do I still need the Cisco switch in L3 mode as now I have the pfsense as the VLANs Gateway? (and I assume it is suppose now to handle VLANs routing as the GW?)
    2. Should I change the switch back to L2 with my setup?
    3. Will I still be able to assign on the switch which physical ports belong to which VLAN in L2 mode?  (this is a 52 port switch I would need to use multi subnets on it.)

  • LAYER 8 Global Moderator

    If you are not routing traffic through pfsense, then there is really little reason for L3 mode on your cisco..

Log in to reply