I’ve been trying for the past couple of days to get my VLAN setup working properly. I’ve read through the CRS examples page and I’m using a CRS125-24G-1S running v6.27.
I have a 4 server setup. 3 servers running ESXi and one server running FreeNAS. I want to eventually setup the following VLAN configuration:
VLAN 160 - Management network
VLAN 170 - VM Network
VLAN 1000 - DMZ
The whole idea is for the above 3 VLANs to be trunked together on the switch ports. The management network may have some stand alone servers that don’t support tagging so I want anything coming in untagged to be changed to VLAN160. The CRS example page covers this exact scenario but it doesn’t work.
What I’ve done so far:
Setup all the ports I want to participate like this into their own switch. Port 8 is my master and ports 8 through 20 participate in this setup. When I connect a laptop to any of these ports I can ping the FreeNAS server so I’ve verified that this configuration works.
/interface ethernet
set [ find default-name=ether1 ] name=ether1-master-local
set [ find default-name=ether2 ] master-port=ether1-master-local name=ether2-slave-local
set [ find default-name=ether3 ] master-port=ether1-master-local name=ether3-slave-local
set [ find default-name=ether4 ] master-port=ether1-master-local name=ether4-slave-local
set [ find default-name=ether5 ] master-port=ether1-master-local name=ether5-slave-local
set [ find default-name=ether6 ] master-port=ether1-master-local name=ether6-slave-local
set [ find default-name=ether7 ] master-port=ether1-master-local name=ether7-slave-local
set [ find default-name=ether8 ] name=ether8-slave-local
set [ find default-name=ether9 ] master-port=ether8-slave-local name=ether9-slave-local
set [ find default-name=ether10 ] master-port=ether8-slave-local name=ether10-slave-local
set [ find default-name=ether11 ] master-port=ether8-slave-local name=ether11-slave-local
set [ find default-name=ether12 ] master-port=ether8-slave-local name=ether12-slave-local
set [ find default-name=ether13 ] master-port=ether8-slave-local name=ether13-slave-local
set [ find default-name=ether14 ] master-port=ether8-slave-local name=ether14-slave-local
set [ find default-name=ether15 ] master-port=ether8-slave-local name=ether15-slave-local
set [ find default-name=ether16 ] master-port=ether8-slave-local name=ether16-slave-local
set [ find default-name=ether17 ] master-port=ether8-slave-local name=ether17-slave-local
set [ find default-name=ether18 ] master-port=ether8-slave-local name=ether18-slave-local
set [ find default-name=ether19 ] master-port=ether8-slave-local name=ether19-slave-local
set [ find default-name=ether20 ] master-port=ether8-slave-local name=ether20-slave-local
set [ find default-name=ether21 ] name=ether21-slave-local
set [ find default-name=ether22 ] master-port=ether21-slave-local name=ether22-slave-local
set [ find default-name=ether23 ] master-port=ether21-slave-local name=ether23-slave-local
set [ find default-name=ether24 ] master-port=ether21-slave-local name=ether24-slave-local
set [ find default-name=sfp1 ] master-port=ether1-master-local name=sfp1-slave-local
/port
From here I put these ports into VLAN 160 and retested the ping from a laptop to the FreeNAS server. It worked.
/interface ethernet switch vlan
add ports="ether8-slave-local,ether9-slave-local,ether10-slave-local,ether11-slave-local,ether12-slave-local,ether13-slave-local,ether14-slave-local,ether15-slave-local,ether16-slave-local,ether17-slave-local,ether18-slave-local,ether19-slave-local,ether20-slave-local" vlan-id=160
From here I tried to setup the ports to tag the traffic to VLAN 160 and set the ingress untagged ports to VLAN 160. This is where everything falls apart and I can’t ping from the laptop to the FreeNAS server.
/interface ethernet switch egress-vlan-tag
add tagged-ports="ether8-slave-local,ether9-slave-local,ether10-slave-local,ether11-slave-local,ether12-slave-local,ether13-slave-local,ether14-slave-local,ether15-slave-local,ether16-slave-local,ether17-slave-local,ether18-slave-local,ether19-slave-local,ether20-slave-local,switch1-cpu" vlan-id=160
/interface ethernet switch ingress-vlan-translation
add customer-vid=0 customer-vlan-format=untagged-or-tagged new-customer-vid=160 ports="ether8-slave-local,ether9-slave-local,ether10-slave-local,ether11-slave-local,ether12-slave-local,ether13-slave-local,eth\
er14-slave-local,ether15-slave-local,ether16-slave-local,ether17-slave-local,ether18-slave-local,ether19-slave-local,ether20-slave-local" sa-learning=yes service-vlan-format=untagged-or-tagged
I haven’t added in the other VLANs (170 and 1000) yet as I want to get this working first. All I want this device to do at this point is switch. I don’t need the router/firewall functions right now as I have a firewall that I’m doing some testing with. I’ve done all my tests for the switching setup local bypassing the firewall.
Once I get this working the ESXi servers will be passing tagged traffic to the switch but the FreeNAS and occasionally a management laptop will not be passing tagged traffic which is why I need the ingress rule.
Any help would be appreciated. I’ve never had so many issues setting up a simple switching setup so I hope it is something minor that I’m missing due to unfamiliarity with the CRS software.
TIA,
BaconTacos