intervlan routing with PfSense

Question

I Need some guidance on getting my lab networking configured. Any support is appreciated.

My Lab consists of:

2 cisco switches: 2960s(access layer 2) and 3750X(ip routing/layer 3) 
Xenserver with PFsense 6 eth ports

4 Vlans on the cisco switch configured:

vlan1   svi 192.168.68.0/24 
vlan100 svi 192.168.1.0/24
vlan200 svi 192.168.2.0/24
vlan600 svi 192.168.6.0/30 (transit network L3 to Pfsense)

I am working on setting up Intervlan routing, but cant see the vlan interfaces in PFsense...

Would I need a trunkport with 801.q, a /30 vlan, or a routed non-switchport connected to PFsense LAN/OPT?

Im following this guide but not able see VLan interfaces or establish communication with the Firewall and switch.

https://greigmitchell.co.uk/2019/08/configuring-intervlan-routing-with-a-layer-3-switch-and-pfsense/

Thanks for your time.

Answer 1

1. In case if you are using Cisco3850 or any other layer3 switch

You can create svi in layer3 switch and connect firewall inside interfàce(LAN) to layer3 switch (no-switchport interface ) Configure firewall inside interface with ip address 192.168.68.2 and switch interface leave as it is For example Switch(config)# int f0/1 Switch(config)#no shutdown /*This interface ip will be vlan1 ip that is 192.168.68.1 this switch interface will connect to firewall LAN interface 192.168.68.2

Have a default route in layer3 switch

In layer3 switch

Ip route 0.0.0.0 0.0.0.0 192.168.68.2 (pointing towards firewall inside interface gateway

In firewall add route

ip route 192.168.68.0 255.255.255.0 192.168.68 .1

ip route 192.168.1.0. 255.255.255.0 192.168.68.1 Ip route 192.168.2.0 255.255.255.0 192.168.68.1 Ip route 192.168.6.0 255.255.255.248 192.168.68.1

Remaining configuration as usual in firewall configuration.....natting , default route in firewall pointing towards isp gateway for internet access and for reverse traffic for incoming traffic

In layer3 switch

Svi configurations , DHCP pool configuration if required , access-list configuration to restrict traffic among vlans , spanning -tree configuration..

. 2) In case if your are using C2960 layer2 switch

If your are using c2960 switch then this switch is layer2 switch you should create subinterface in firewall and connect switch 2960 and configure switch port as trunk connectiing firewall . ....

Answer 2

I think the first thing you need to define is your desired design.

The link in the original question describes a migration from a design where the PFSense firewall has the duty of both routing between internal and external networks, as well as access control between them to a design where the firewall no longer has the duty of routing traffic between the internal networks and only passes traffic between its LAN and WAN networks and therefor only controls access between LAN and WAN networks and vice versa. Traffic between the VLANs on the LAN or Internal networks will be uncontrolled or, at best, controlled by the layer 3 switch which will be the new gateway for the various internal networks (VLANs in this case).

If that is the desired design (the firewall loses control and routing duties for traffic between the internal networks) then by all means, plow ahead.

If you wish to keep control of traffic between networks, such as if you have a couple of guest or low security networks and a couple of more private or sensitive networks you want to keep separate from the others, then you want to keep the routing duties and access control on the firewall and you will need to spec the firewall so it can handle those duties. Basically it will be setup with this basic configuration:

https://www.wundertech.net/how-to-setup-vlans-in-pfsense/

And the switch will either have a trunk link (802.1Q encapsulated link carrying frames tagged for multiple VLANs) to the firewall or you could have multiple individual links from the switch to the firewall, one each for each VLAN you want to connect through the firewall.

If you want the layer 3 switch to act as gateway instead of the firewall, and you want to remove the access control between the internal networks, then the general best design for that is to have a small transit network between the firewall and the layer 3 switch (a /29 network of IPv4 addresses, for example) and static route configuration on the firewall so the firewall knows how the IP address blocks in use on the internal networks are reachable.

Say you have 10.10.0.0/20 broken up in /24 networks on your internal networks (each one a VLAN). You could use 172.20.30.0/29 for the transit network between the firewall and the layer 3 switch.

Simply configure the firewall so it has an interface on its LAN zone or whatever you call it with IP address 172.20.30.1/29 and configure a port on the layer 3 switch (or an SVI if you prefer and an accompanying VLAN with a port set to access mode for that VLAN) and connect a cable from that port to the firewall on the selected port. Configure the appropriate port/interface on the switch to use IP address 172.20.30.2/29 and you now have a network between them. Configure the switch for 'ip routing' and give the switch a default route 'ip route 0.0.0.0 0.0.0.0 172.20.30.1' and your switch now knows to send traffic for any network that is not directly connected to its interfaces to the firewall.

Make sure the firewall has NAT rules and outbound access rules to allow 10.10.0.0/20 to have NAT applied and allow outbound access to the internet.

Make sure the firewall has a static route entry for 10.10.0.0/20 to be routed to 172.20.30.2

Configure the remaining VLAN configuration you desire on the layer 3 switch so you have an SVI for each VLAN ('interface vlan 10', 'ip address 10.10.0.1 255.255.255.0', 'no shut' etc.) and assign the desired VLAN to the desired switch ports for access mode or whatever is needed to get the connectivity you want.

Assign your user devices with IP addresses for the appropriate networks to match the VLAN they are connected to (10.10.0.10/24 with gateway 10.10.0.1 etc.) and they should have connectivity to the internet. If not, start troubleshooting to make sure they can ping their gateway (the layer 3 switch), and the gateway of that gateway (the firewall at 172.20.30.1 or 172.20.30.2 etc.) and so on.