What is best way to run 300 VLAN on network using PFSense.



  • What would be the best way to run 300+ VLANS from PFSense.  It looks like PFSense load-up and GUI takes a significant performance hit with larger number of VLANS.

    And, before someone asks - yes, VLANS are required for security and data protection of 200+ small groups of users (WiFi).

    As I can see there are three options? 
    a) Is it feasible for GUI to be fixed to cope with large number VLANS? (Switches cope fairly easily)  Or is this impossible?  What is the issue with it?
    b) To install multiple PFSense VM's and split say 30 VLans per VM instance
    c) Use Layer three switch and deal with VLAN's at switch (PFSense just routing traffic)

    Any thoughts or ideas.

    Roofus


  • Netgate

    @Roofus:

    What would be the best way to run 300+ VLANS from PFSense.  It looks like PFSense load-up and GUI takes a significant performance hit with larger number of VLANS.

    And, before someone asks - yes, VLANS are required for security and data protection of 200+ small groups of users (WiFi).

    As I can see there are three options? 
    a) Is it feasible for GUI to be fixed to cope with large number VLANS? (Switches cope fairly easily)  Or is this impossible?  What is the issue with it?

    I don't think it's VLANs themselves, just the number of interfaces. I've done 100 once as a test and it was fine.

    b) To install multiple PFSense VM's and split say 30 VLans per VM instance

    That sounds like a pain.

    c) Use Layer three switch and deal with VLAN's at switch (PFSense just routing traffic)

    That would do but probably only if you can tell the switch to isolate your VLANs easily. Otherwise you'll probably be dealing with access lists. Probably wouldn't be too bad if you get clever with your supernetting and can block one VLAN from all others using the same rules on every SVI. But that's just the switch. How are you getting them all on Wi-Fi?



  • Thanks Derelict.

    Interesting what you have tried.  Even if we can get 100/150 VLANs on on PFsense instance, that makes a huge difference in admin and setup for us.  Might just try that.

    I do wonder if the interface, or quantity of, is 'solvable' so it does not have such a performance hit.  Even through the console the performance hit is evident - or is it something built into the core that is just too difficult to change?

    I agree splitting pfsense into multiple VM's is a pain.  But if having three VM's, each dealing with 100 VLANs, gets around this performance issue it might be worth it.  But again it seems strange to have three when one should be able to do the job?

    Roofus


  • Netgate

    Have you tried it? If not I would.



  • Could you not configure some form of wireless isolation on the APs to prevent users accessing each other rather than trying to do it with VLANs? I've no idea whether this would work or how it would need to be configured, but have seen it on consumer gear before and am speculating there may be something similar on enterprise grade equipment.


  • Netgate

    "small groups of users" makes that particularly difficult.

    I have yet to see APs that understand private VLANs.



  • i have yet to an AP controller that handles 300vlans without issues ;)


  • Netgate

    300 SSIDs might be an issue but I don't see a problem with 300 VLANs with dynamic VLAN assignment.


  • Rebel Alliance Global Moderator

    If what your looking to do is isolate the wifi users from each other, pretty much any soho wifi does ap/client isolation.. Cisco calls it what Public Secure Packet forwarding or peer-to-peer blocking mode, etc..

    So what exactly is the requirement here.. You have 300+ wifi users?  Is wired in use as well?  what are you using to dynamically assign the vlans?  What AP are in play?

    If pfsense sense has issue with 300 some vlans in the gui, there are always plenty of ways to skin the cat - but have to know the breed of cat to best skin it ;)



  • Hi everyone,

    Some great replies.  I must have not ticked the box about getting notification when someone replies.  I will try to answer some of the questions below.

    "Have you tried it? If not I would."
    We did try something previously, however I think it was for 600 VLANs which made load up times immense and GUI unresponsive - and if you used Console to look at interfaces…wow that was difficult...we scrapped that config.  I want to get some ideas here first and we will try and see what works.

    "Could you not configure some form of wireless isolation on the APs to prevent users accessing each other rather than trying to do it with VLANs?"
    Yep, been there, done that.  However, this is beyond that - We now want to create small groups (via VLAN) for multiple devices in a group (account).

    "I have yet to see APs that understand private VLANs"
    There are many on the market that recognise VLAN's, we have one network using 5 VLANs so definitely can say our APs can (and using PFSense).

    "i have yet to an AP controller that handles 300vlans without issues"
    Good Point.  I don't think this will be an issue as it is not the AP Controller handling the VLAN's (dynamically assigned by our servers ==> AP controller ==> AP).  The AP is told which VLAN to place traffic and Switch and PFsense look after the rest.  Problem is we have never been able to get to this part of testing due to failing at the first hurdle (PFSense), Not sure this is an issue though. I will let you know if we ever manage to get there.

    "If what your looking to do is isolate the wifi users from each other"
    No, we want to isolate groups from each other (One Account with multiple devices in each Account)
    Why?  because we have to for security and data protection. It also helps us to manage the network better.

    "300 SSIDs might be an issue but I don't see a problem with 300 VLANs with dynamic VLAN assignment."
    You are correct about the Dynamic VLAN.  Only two SSID's, traffic over separated VLAN's

    "your looking to do is isolate the WiFi users from each other"
    No. Definitely 300 'Groups'. Groups are to be isolated from each other, hence the VLANs

    "So what exactly is the requirement here.. You have 300+ wifi users?  Is wired in use as well?  what are you using to dynamically assign the vlans?  What AP are in play?"
    We need to create +300 VLANS to containerise (is there such a word?) traffic of +300 groups (accounts).  And the groups MUST be separated.  We have tried , and still use isolation, but isolation at AP no longer fits our customers (many customers) requirements.  AP's can Dynamic VLAN no issue there and our servers allocate the Dynamic VLAN (not the AP controllers).  PFSense would be used to filter and route traffic out + assign IP's within VLANs.

    "If pfsense sense has issue with 300 some vlans in the gui, there are always plenty of ways to skin the cat"
    Keen to learn more my friend!

    I hope I got everything.

    To highlight the key points - isolation not an option (plus we already use this).  VLANs a definite requirement moving forward.  No it is not 300 devices, but groups.  Yes, each groups data needs to be separated from each group, but not WITHIN each group.

    If we contributed to its development, could GUI be 'fixed', is it fixable, it might not be?  What other way could we configure/manage the PFSense to get around this issue?

    Thanks

    Roofus


  • Netgate

    @Roofus:

    "I have yet to see APs that understand private VLANs"
    There are many on the market that recognise VLAN's, we have one network using 5 VLANs so definitely can say our APs can (and using PFSense).

    Private VLANs are different. Google isolated community promiscuous private vlan

    "300 SSIDs might be an issue but I don't see a problem with 300 VLANs with dynamic VLAN assignment."
    You are correct about the Dynamic VLAN.  Only two SSID's, traffic over separated VLAN's

    Yeah that's not a problem. I have never used it. Do the APs intelligently broadcast traffic among users of the same dynamic VLAN and isolate from others? I would guess they do or it would be useless but I've never tested it. What are you using? Ruckus, Aruba, Cisco or ?



  • Hi.

    Not private VLAN, although that would have been interesting.

    We have networks with different AP hardware.  However, the Ruckus will probably be our test bed.

    Roofus



  • If I had a layer 3 switch available (and it sound like you do), I'd use it to handle the VLANs. Put the pfsense inside interface on its own VLAN/subnet and let the layer 3 switch route between the VLANs and pfsens. Use ACLs on the switch to keep the various subnets from talking to each other.



  • Gomez
    That is certainly an option to consider and with some appeal - It would help simplify the firewall rules etc.  Currently we are using Layer 2  switches that support POE + VLAN, so this would be an addition of around £1,000.  Cheaper if we could get PFSense to do it :)

    I do like the idea that a small Layer 3 switch feed multiple Layer 2 switches that span to the different AP units.

    Where would the DHCP come from in this instance as I assume PFSense would not be able to fulfill this role in this case?

    Roofus



  • You should be able to put helper IP addresses (cisco terminology) on the VLAN interfaces in the layer 3 switch that forward DHCP requests to the pfsense box. I assume pfsense could be configured with a scope for each subnet. I've never tried that with pfsense, though.



  • Since you have virtualization available, you might also consider using a virtual router to take the place of the layer 3 switch. I've never used anything other than Cisco routers, so I can't offer specific details, but I'd think it wouldn't be too difficult to create a virtual linux instance, trunk all 300 VLANs to it, set up routing in linux and use iptables for the ACLs.

    I seem to recall that someone has a linux distribution specifically created to be a router.


  • Netgate

    @GomezAddams:

    You should be able to put helper IP addresses (cisco terminology) on the VLAN interfaces in the layer 3 switch that forward DHCP requests to the pfsense box. I assume pfsense could be configured with a scope for each subnet. I've never tried that with pfsense, though.

    Multiple scopes are not supported.



  • Most L3 switches would support DHCP, you can also set a separate small Linux box to run dhcpd and then "ip helper" each VLAN to that IP.



  • If pfsense DHCP won't do multiple scopes, then you need something that will. It sounds like you need either a layer 3 switch that does DHCP, or a virtual router to do your layer 3 routing and hand out IP addresses.

    Even if pfsense could be fixed to handle 300 VLANs, you still need something to run DHCP with a scope for each VLAN/subnet.


  • Netgate

    pfSense will do multiple scopes just fine. It just can't be configured to accept helper requests from multiple subnets on one interface.



  • @Derelict:

    pfSense will do multiple scopes just fine. It just can't be configured to accept helper requests from multiple subnets on one interface.

    Well that's just silly.