I have been struggling with this issue for a few days now. please bear with me, I am not a expert in networking.

I am trying to setup ESXI lab with network segmentation based on Vlans defined in pfSense and a Cisco SG300 switch in L3 mode to which I also have an Airport extreme BS attached, which will have a private and guest network setup.

A good picture is worth 1000 words, hence I have tried my best to illustrate the design that I have in my mind.


  • Airport extreme doesn't have routing features.

Can you please review and advice on how to best realize this setup?

Highlevel design http://cosni.in/homelab/1.png Physical connections http://cosni.in/homelab/2.png http://cosni.in/homelab/3.png

I would like to support the following scenarios with this setup.

Requiremnt 1 http://cosni.in/homelab/4.png Requirement 2 http://cosni.in/homelab/5.png Requirement 3 http://cosni.in/homelab/6.png

1 Answer 1


Here are a few points regarding the presented configuration and assuming you have shared your complete VLAN footprint regarding the physical and virtual switching.

Any additional information would be helpful.

  1. pfSense

    • Configure a public VLAN in the Physical Switch
    • Configure a public virtual switch within the ESXi host
  2. Apple Airport Config

    • Configure a VLAN for
    • Configure a route to pass through the private pfSense interface
    • Validate quad 0 route on pfSense for Internet access
    • Ensure there is only one route for the guest network. Allowing anonymous users into a the environment, I assume, is against the organizations security policy
    • Configure VLAN in physical switch for for the private wireless. Ensure this VLAN can access resources in other VLAN's for services such as DNS, etc.
  3. Network Modem attached to GE10

    • Add appropriate VLAN's to physical switch
    • Ensure GE10 has appropriate routes

Primary questions regarding access revolve around routing. The Cisco SG-300 has a limited command set and is NOT a full IOS Cisco product. All of the routing can be done via the https interface of the device.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.