Hey all. So I have just replaced my old Cisco 2921 with a little pfSense build on a desktop box with an added 4 port NIC card. All just GB connections, so nothing fancy there. I thought it would just be a case of remove and replace. That didn't seem to work though.
Firstly, my entire network lives on an Aruba S2500 with VLANs segregated off for various things, my home lab runs on VLAN10, IP Cams on VLAN11, my DMZ on VLAN13, and then the WiFi (Aruba access points, no fancy config - though I would like to be able to put different WiFi networks on different VLANs eventually, right now they're just sitting on access ports with no trunking) and desktops on VLAN15, and finally VLAN1000 (VLAN1 was already taken
) for the subnet that my router lives on.
I have a pretty straightforward subnet config, 192.168.(VLAN#).X/24 so lab on 192.168.10.X, etc. The router was at 192.168.0.2 (all of the .1 IPs are assigned to the Aruba VLAN interfaces) and the Aruba was set up with a default route of 192.168.0.2 to pass traffic to the router. DHCP was handled with an IP Helper pointing to my domain controller, and each subnet had the appropriate .1 gateway for that subnet configured. This all worked out swimmingly.
When I hooked up the pfSense box though, everything did not "just work." As a workaround, and to get the internet working again before the wife got home from work, I've basically turned on DHCP in pfSense, moved the WiFi access points, her PC's switch port, and my desktop to VLAN1000. First I had to add a LAN gateway for 192.168.0.0/24 pointing to 192.168.0.1 in pfSense to be able to even access the web console (before I moved everything to VLAN1000), and then I added a domain override to the DNS resolver for my local domain and an access list to allow 192.168.0.0/16 to do DNS lookups (though since the only thing connecting to pfSense is VLAN1000, don't know if the access list part was required) so that everything can still work (mainly the shared storage on my TrueNAS server for the windows file shares that my wife would be looking for).
Now I really want to get everything back onto the correct VLANs, but I'm not entirely sure where to start.
Right now, none of my lab systems can access the internet, even though the default route on the switch still points to the same IP (not sure if I mentioned that I just gave pfSense the same IP that the cisco was using) but nothing is routing. So I'd like to start by resolving that...
Should I create all the VLANs in pfSense, and then turn the port that it's connecting to into a trunk port? (I didn't do this previously with the router)
---
And once that is all done, I want to enable failover - maybe I'll start another thread for that after I get this working though - I have a Comcast internet gateway in bridge mode, and they gave me free Verizon LTE as a backup - I had the failover working on the Cisco using route maps, but I could never get failover and NAT working at the same time (so I had two configs that I had to switch between, basically making it a manual failover whenever I lose Comcast service) - I don't really expect incoming traffic from the LTE backup (though I do have Dynamic DNS, so it *could* maybe), but at least when it's on Comcast I like to have NAT into my DMZ to connect to my Horizon gateway and access my desktop remotely without having to change the config to make failover work.
Firstly, my entire network lives on an Aruba S2500 with VLANs segregated off for various things, my home lab runs on VLAN10, IP Cams on VLAN11, my DMZ on VLAN13, and then the WiFi (Aruba access points, no fancy config - though I would like to be able to put different WiFi networks on different VLANs eventually, right now they're just sitting on access ports with no trunking) and desktops on VLAN15, and finally VLAN1000 (VLAN1 was already taken
) for the subnet that my router lives on.I have a pretty straightforward subnet config, 192.168.(VLAN#).X/24 so lab on 192.168.10.X, etc. The router was at 192.168.0.2 (all of the .1 IPs are assigned to the Aruba VLAN interfaces) and the Aruba was set up with a default route of 192.168.0.2 to pass traffic to the router. DHCP was handled with an IP Helper pointing to my domain controller, and each subnet had the appropriate .1 gateway for that subnet configured. This all worked out swimmingly.
When I hooked up the pfSense box though, everything did not "just work." As a workaround, and to get the internet working again before the wife got home from work, I've basically turned on DHCP in pfSense, moved the WiFi access points, her PC's switch port, and my desktop to VLAN1000. First I had to add a LAN gateway for 192.168.0.0/24 pointing to 192.168.0.1 in pfSense to be able to even access the web console (before I moved everything to VLAN1000), and then I added a domain override to the DNS resolver for my local domain and an access list to allow 192.168.0.0/16 to do DNS lookups (though since the only thing connecting to pfSense is VLAN1000, don't know if the access list part was required) so that everything can still work (mainly the shared storage on my TrueNAS server for the windows file shares that my wife would be looking for).
Now I really want to get everything back onto the correct VLANs, but I'm not entirely sure where to start.
Right now, none of my lab systems can access the internet, even though the default route on the switch still points to the same IP (not sure if I mentioned that I just gave pfSense the same IP that the cisco was using) but nothing is routing. So I'd like to start by resolving that...
Should I create all the VLANs in pfSense, and then turn the port that it's connecting to into a trunk port? (I didn't do this previously with the router)
---
And once that is all done, I want to enable failover - maybe I'll start another thread for that after I get this working though - I have a Comcast internet gateway in bridge mode, and they gave me free Verizon LTE as a backup - I had the failover working on the Cisco using route maps, but I could never get failover and NAT working at the same time (so I had two configs that I had to switch between, basically making it a manual failover whenever I lose Comcast service) - I don't really expect incoming traffic from the LTE backup (though I do have Dynamic DNS, so it *could* maybe), but at least when it's on Comcast I like to have NAT into my DMZ to connect to my Horizon gateway and access my desktop remotely without having to change the config to make failover work.
