So I have an Aruba 2530 switch with a couple of SFP slots, an incoming fiber connection and a modem that only has RJ45. There's limited space and I want to use as little boxes as possible.

Is there some way that I could use an SFP in the switch, send that to the router and then have the rest of the ports be interconnected and used internally on the LAN? Like making a separate trunk? I haven't dealt with exactly this variant before and it would be interesting to know the answer.

The incoming connection should have a VLAN 101 and 102 which has to be preserved in order to get IPTV to function correctly, and has an upstream DHCP server. The router uses pfSense.

Sorry in advance for the MSpaint sketch, I didn't have anything else on this computer.

Child-like topology

1 Answer 1


The "incoming fiber connection" needs to be something you can get an SFP module for, e.g. 1000BASE-LX(10) or 1000BASE-BX10 - check with your ISP what type is required. Connecting GPON (1000BASE-PX10-D) directly to a 2530 is not possible. Also, check your contract where the demarkation port is. If it's the copper port on the "modem" you need to leave that in.

You can create the desired VLANs on the switch and trunk them tagged to the "Outside" port. I'm using port 28 for "Outside" and 24 for the router trunk.

  VLAN 101 name WAN_V101
  VLAN 101 tagged 24,28
  VLAN 102 name WAN_V102
  VLAN 102 tagged 24,28

On the router you need to create tagged subinterfaces that can then use the "media converted" fiber connection with the same, tagged VLANs. From the perspective of the router, there's no difference in connecting it to Outside directly or via the switch.

If you're tight with ports you can trunk the "LAN" VLAN to the router port as well ("router on a stick") instead of running a dedicated connection like in your diagram (if you're using the default VLAN that's vlan 1 tagged 24).

If you use spanning tree, you should disable/filter BPDUs from the Outside interface.

spanning-tree 28 bpdu-filter tcn-guard
  • Hey Zac and thank you so much for your time. The ISP has already provided an SFP for use in their supplied router, I’m going to try to use that. Thanks for the tip about GPON, fortunately it’s a true dedicated line. I’m gonna try to do as you suggest and configure it as a ‘router on a stick’. In that case, would I simply make the same VLAN as you suggested, but for all ports? May 21, 2021 at 15:47
  • By default, the 2530 series accepts HPE/Aruba-branded SFP modules only. You need to use allow-unsupported-transceiver and firmware 16.02 or later. I'll add the RoaS tagging to the answer.
    – Zac67
    May 21, 2021 at 15:57
  • Thanks for that advice as well. I think I technically have it working, but it appears there is some form of MAC address limitation that prevents me from replacing a bridged router with either a media converter or directly on the switch. I don’t get any IP from the DHCP server using the two latter. Are you aware of any methods to spoof MAC address on the Aruba switches? May 23, 2021 at 15:11
  • The switch is transparent and doesn't use a MAC address here. If the MAC address is the problem you'll need to put the ONT's address (the "modem's") on the router's interface. Depending on the ISP setup, it's also possible that they're using PPPoE which will require authentication details.
    – Zac67
    May 23, 2021 at 15:50
  • Allright. So the L2 switch and media converter should not matter, only the MAC address of the device requesting the DHCP address? The ONT as you call it is bridged and works as a media converter, but I guess it technically is not equivalent to one. Currently I’m running some kind of ASUS router since my pfSense based router is still stuck in customs, but it did have options for this. It has options to spoof the Mac and I did try it to no avail. Other people are reporting that it should work connecting the SFP directly to media converters or appliances like ubiquiti dream machine. May 23, 2021 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.