Aruba S2500 vlan, jumbo frames and router on stick questions

[sadpanda]

I am in the process of transitioning to this switch and have a few questions.

I have converted stack ports to regular ports, set all interfaces to mtu 9216, setup vlans and assigned ports. Aside from answers to questions below, is this good to go or do I need to apply profiles?


RE: Jumbo frames, while setting up vlans I noticed vlan configuration also has mtu. Per documentation -

Description: Specifies the size of the jumbo frames in bytes​

Range: 64-7168​

Default 1514​

However, the switch does not jive -

(ArubaS2500-24P-US) (vlan "10") #?​

aruba-vpn-pool-profile Apply Aruba VPN Pool profile to interface​

clone Copy data from another vlan​

ddns-profile Apply DDNS profile to interface​

description Interface description​

dhcp-relay-profile Apply DHCP relay profile to interface​

igmp-profile Apply IGMP profile to interface​

ip Interface internet protocol commands​

ipv6 Interface internet protocol v6 commands​

metric Set metric on interface between 0 and 65535​

mtu Set MTU on interface between 1400 and 1570​

no Delete Command​

ospf-profile Apply OSPF profile to interface​

pim-profile Apply PIM profile to interface​

probe-profile Apply probe profile to interface​

session-processing Enable session processing on this interface​

shutdown Enable or disable interface​

vrrp-profile Apply VRRP profile to interface​

​

Is this switch limited to 1570 mtu on vlan tagged traffic? I'm on OS 7.4.1.4 build 54199 which I believe is most current.



Final question: I found this serve the home thread (seems same guy also asked the question on netgate and spiceworks forums) and its more or less exactly what I am looking for BUUUUT it seems responses to this setup ranged from 'yer being dumb, it wont work' on netgate to 'meh pf shouldnt allow it but if it works it works' on spiceworks.

I would like to KISS and have as much admin handled by pf box (dhcp, dns resolver, blockerNG) while still getting line rate transfer on LAN. I saw many suggestions to run Kea dhcp but learning curve seems steep for novice / non-pro. Before I transitioned to pf box I was running openwrt and a pihole which also handled dhcp... Would this be an alternative?

Thanks.

 

[DavidWJohnston]

I can answer your last question:

You should not use pfSense for DHCP and simultaneously use a L3 switch for inter-VLAN routing the way you are wanting to. This is because it will result in asymmetric routing. Return traffic coming back from the Internet will not go through the L3 switch, instead it will be routed directly to the endpoint by the pfSense. But, it will "work", it's just asymmetric routing makes it hard to troubleshoot problems later.

The crux of the issue is you cannot create a static route to a subnet where the pfSense already has an interface, and you need to create an interface in each VLAN for DHCP to work. pfSense does not have the ability to handle inbound DHCP coming from a relay. Actually the underlying daemon/service probably does, but the GUI does not allow you to configure it like that.

The way I do this, is I have a 100G Celestica DX010 which is configured as a DHCP relay, and I have MS Windows Server taking care of DHCP. This tutorial is for SONiC L3 switches, but it has a decent explanation of DHCP relays: https://support.edge-core.com/hc/en-us/articles/900000198943--Enterprise-SONiC-DHCP-Relay

I answered a similar question a few months back, here: https://forums.servethehome.com/index.php?threads/noob-question-on-l3-switch-routing.39875/

For the MTU question, I don't know anything about Aruba but maybe try it and see what happens. Configure jumbos properly, then do some ping -f -l 9000 and see if they get through.

 

[sadpanda]

ok learned a lot the past few days. Thanks for not flaming me re:mtu

Seems defaulting to standard MTU is the norm for switches as soon as vlan is enabled to prevent drops/rejects

Also learned this switch automatically allows all intervlan traffic once a vlan device is created so ACL rules for each interface would be required to lock down/control

7.4.x user guide lists the various types of ACL (Ethertype, MAC, Standard, Extended and Stateless) but from my searching it appears stateless rules operate at line speed, extended (and potentially others) run on CPU which seems to incur a performance hit

DHCP relay and server seem pretty straight forward but the rules are above my abilities/time right now.