I Need some guidance on getting my lab networking configured. Any support is appreciated.

My Lab consists of:

2 cisco switches: 2960s(access layer 2) and 3750X(ip routing/layer 3) 
Xenserver with PFsense 6 eth ports

4 Vlans on the cisco switch configured:

vlan1   svi 
vlan100 svi
vlan200 svi
vlan600 svi (transit network L3 to Pfsense)

I am working on setting up Intervlan routing, but cant see the vlan interfaces in PFsense...

Would I need a trunkport with 801.q, a /30 vlan, or a routed non-switchport connected to PFsense LAN/OPT?

Im following this guide but not able see VLan interfaces or establish communication with the Firewall and switch.


Thanks for your time.

  • How is the switch connected to the firewall?
    – Ron Trunk
    Jul 19, 2020 at 20:24
  • @RonTrunk I have tested two ways..One using a non switch port from the switch to the PFsense LAN port. Another way was using a switch access port with a /30 subnet for a transit network
    – BocajNET
    Jul 20, 2020 at 5:28
  • We need a simple diagram to know how you have connected your 4 devices.
    – Ron Trunk
    Jul 20, 2020 at 11:56
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Nov 19, 2022 at 23:30

2 Answers 2

  1. In case if you are using Cisco3850 or any other layer3 switch

You can create svi in layer3 switch and connect firewall inside interfàce(LAN) to layer3 switch (no-switchport interface ) Configure firewall inside interface with ip address and switch interface leave as it is For example Switch(config)# int f0/1 Switch(config)#no shutdown /*This interface ip will be vlan1 ip that is this switch interface will connect to firewall LAN interface

Have a default route in layer3 switch

In layer3 switch

Ip route (pointing towards firewall inside interface gateway

In firewall add route

ip route 192.168.68 .1

ip route Ip route Ip route

Remaining configuration as usual in firewall configuration.....natting , default route in firewall pointing towards isp gateway for internet access and for reverse traffic for incoming traffic

In layer3 switch

Svi configurations , DHCP pool configuration if required , access-list configuration to restrict traffic among vlans , spanning -tree configuration..

. 2) In case if your are using C2960 layer2 switch

If your are using c2960 switch then this switch is layer2 switch you should create subinterface in firewall and connect switch 2960 and configure switch port as trunk connectiing firewall . ....


I think the first thing you need to define is your desired design.

The link in the original question describes a migration from a design where the PFSense firewall has the duty of both routing between internal and external networks, as well as access control between them to a design where the firewall no longer has the duty of routing traffic between the internal networks and only passes traffic between its LAN and WAN networks and therefor only controls access between LAN and WAN networks and vice versa. Traffic between the VLANs on the LAN or Internal networks will be uncontrolled or, at best, controlled by the layer 3 switch which will be the new gateway for the various internal networks (VLANs in this case).

If that is the desired design (the firewall loses control and routing duties for traffic between the internal networks) then by all means, plow ahead.

If you wish to keep control of traffic between networks, such as if you have a couple of guest or low security networks and a couple of more private or sensitive networks you want to keep separate from the others, then you want to keep the routing duties and access control on the firewall and you will need to spec the firewall so it can handle those duties. Basically it will be setup with this basic configuration:


And the switch will either have a trunk link (802.1Q encapsulated link carrying frames tagged for multiple VLANs) to the firewall or you could have multiple individual links from the switch to the firewall, one each for each VLAN you want to connect through the firewall.

If you want the layer 3 switch to act as gateway instead of the firewall, and you want to remove the access control between the internal networks, then the general best design for that is to have a small transit network between the firewall and the layer 3 switch (a /29 network of IPv4 addresses, for example) and static route configuration on the firewall so the firewall knows how the IP address blocks in use on the internal networks are reachable.

Say you have broken up in /24 networks on your internal networks (each one a VLAN). You could use for the transit network between the firewall and the layer 3 switch.

Simply configure the firewall so it has an interface on its LAN zone or whatever you call it with IP address and configure a port on the layer 3 switch (or an SVI if you prefer and an accompanying VLAN with a port set to access mode for that VLAN) and connect a cable from that port to the firewall on the selected port. Configure the appropriate port/interface on the switch to use IP address and you now have a network between them. Configure the switch for 'ip routing' and give the switch a default route 'ip route' and your switch now knows to send traffic for any network that is not directly connected to its interfaces to the firewall.

Make sure the firewall has NAT rules and outbound access rules to allow to have NAT applied and allow outbound access to the internet.

Make sure the firewall has a static route entry for to be routed to

Configure the remaining VLAN configuration you desire on the layer 3 switch so you have an SVI for each VLAN ('interface vlan 10', 'ip address', 'no shut' etc.) and assign the desired VLAN to the desired switch ports for access mode or whatever is needed to get the connectivity you want.

Assign your user devices with IP addresses for the appropriate networks to match the VLAN they are connected to ( with gateway etc.) and they should have connectivity to the internet. If not, start troubleshooting to make sure they can ping their gateway (the layer 3 switch), and the gateway of that gateway (the firewall at or etc.) and so on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.