How To Setup VLANs With pfsense & UniFi 2023

  Рет қаралды 206,158

Lawrence Systems

Lawrence Systems

Күн бұрын

Пікірлер: 176
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
Configuring pfsense Firewall Rules For Home kzbin.info/www/bejne/mJvVYaWjbpiojKM 2020 Getting started with pfsense 2.4 Tutorial: Network Setup, VLANs, Features & Packages kzbin.info/www/bejne/nKTHnmirmMR_qbc The Best Diagramming Tool "Diagrams.net" kzbin.info/www/bejne/o6GpYpxvqMt4gJI en.wikipedia.org/wiki/IEEE_802.1Q ⏱ Timestamps ⏱ 00:00 VLANs With pfsense & UniFI 02:00 IEEE 8021.Q VLAN 101 Basics 05:54 pfsenwse UniFi Network Setup 08:50 Defining VLANs in pfsense 10:17 Defining VLANs in UniFi 14:27 Using VLAN to create switched networks
@twitchcoolbob66
@twitchcoolbob66 Жыл бұрын
So, as someone who might be getting fiber in soon. This all works the same if you have fiber in for WAN and then use fiber to connect to the switch for lan? Also, having this set all wouldn't cause some stuff to go to igb2?
@randleqgod
@randleqgod 2 жыл бұрын
I started using PFsense last year and haven’t looked back. That appliance is a straight up beast. I love the policy routing capabilities.
@benjaminrathjen152
@benjaminrathjen152 2 жыл бұрын
Thanks very helpful, could you go over radius authentication with PFsense and Unifi? Much appreciated
@dakodacat
@dakodacat 2 жыл бұрын
I am literally going through the process of setting up PfSense & a self-hosted Unifi Controller right now for my home network. This is exactly what I was looking for; What a coincidence!!
@npham1198
@npham1198 2 жыл бұрын
Also get into the security aspect of vlans, such as creating a "blackhole" vlan on the switch trunk/uplink, etc!
@danimoosakhan
@danimoosakhan 2 жыл бұрын
VLAN tagging is little confusing when u are first starting out. But once u understand the true concept, it becomes your bread and butter. One of the most important thing to understand is how switch is treating Tagged and untagged traffic. If u only assign one vlan to the switch port, that vlan is native/untagged on that port only. There can only be ONE native/untagged vlan on a port meaning u can’t have more than one untagged vlan on one port. In a corporate world for security reasons, u only tag certain vlans on port that are needed on that port, this means u don’t just tag ALL vlans like UniFi does. Tagging ALL vlans on all ports does make your job easier but at the cost of compromising security. I would only do this if the link is between the switches and both switch needs to have access to same vlans.
@jackwilson4863
@jackwilson4863 Жыл бұрын
And you should tag all vlans to the port connected to a router that would assign a subnet to each vlan for inter vlan routing. Unless you’ve got a L3 switch.
@MegaMaskedrider
@MegaMaskedrider Жыл бұрын
Yeah i´m just at the point of having absolutely no clue anymore with opnsense and unifiy config... xD
@UKprl
@UKprl 2 жыл бұрын
This is pretty useful as a way of introducing how VLANs are handled in pfSense and UniFi and what happens when you connect them together (on a trunk port). There are a couple of caveats though. Firstly at 14:27, be aware, because of the port profile ALL that the traffic for VLAN 10 is also being sent tagged to igb2, (which pfSense will have to discard) as well as being native traffic on igb1. If you want to exclude VLAN 10 from igb2 you need to create a port profile that contains only the desired VLANs (tagged and optionally for native) to match what you have setup on pfSense on the trunk. Secondly, pfSense themselves recommend you do not setup a network on the parent interface (i.e. native frames) when using vlans, for reasons (relating to how the NICs actually process the tagged and native traffic arriving on the same physical interface to assign to the logical interface in pfSense). Because of this when using UniFi with pfSense and without a UniFi gateway, I don't use the default network they call Corporate at all, and setup a VLAN explicitly to handle management traffic. This means the switch ports facing UniFi access points are given a port profile that is not ALL, but send the new management VLAN natively and tag for all the other SSIDs. This has the added benefit of not flooding broadcast frames to a Wi-Fi access points for VLANs for which there is no Wi-Fi SSID (e.g. wired-only VLANs).
@UKprl
@UKprl 2 жыл бұрын
Related to this is why I also don't use VLAN 1 on any of the switches. When Ubiquiti designed UniFi they reserved VLAN 1 for internal use. (Effectively it is also assigned it to that Corporate network, but in a way that is not obvious when using the UI). They also prevented you using tagged VLAN 1 for any SSID because of this design choice. This had a nasty side effect of making it difficult to convert any installation from flat unmanaged switching to UniFi without replacing all the switches right away, because VLAN 1 (and management) would effectively be exposed natively on all legacy switch ports as well as trunk links if doing a phased deployment. Actually VLAN 1 frames are not anything special and you should be able to use any VLAN ID from 1 through 4094 (0 and 4095 are the reserved IDs). However other vendors are also known for assigning special uses to VLAN 1 so you might be better off avoiding it completely when scaling out and including switches from more than one vendor, unless you know exactly how it is treated.
@propeto13
@propeto13 2 жыл бұрын
Tom, thank you for your insight. I created a 4 port 'lagg0' in/on pfsense. On the switch 'cisco' i configured a 4 port 'port-channel' and trunk all traffic.
@devoid42
@devoid42 2 жыл бұрын
I have a very similar setup but I defined my connections between my pfsense and the switch as a LAG(LACP) group(using 3 ports), and pass tagged traffic between the switch and the pfsense. Which gives me the ability to utilize more bandwidth on one vlan, while still having availability for a smaller vlan when it needs it.
@alexsinbb
@alexsinbb 2 жыл бұрын
Is that what I'm describing in my post? Is that the name for it, LAG (LACP)? I also have 3 ports on my router plugged to the same switch.
@dogphilosopher0
@dogphilosopher0 2 жыл бұрын
Where was this video yesterday when I was setting up VLANs with my PFSense and UniFi Equipment? In all seriousness, thank you so much for this!
@Oldmandoom95
@Oldmandoom95 2 жыл бұрын
I swear you're psychic with these releases... The past 5 videos have all been stuff I've been working on as you release them! Excellent tutorial as always Lawrence
@franciscos.5839
@franciscos.5839 2 жыл бұрын
at 13:20 I agree with you...they need to fix this asap it was so annoying to trying configure a port I was looking everywhere and sure enough I had to scroll to see the VLANS.
@EduardKondratyuk
@EduardKondratyuk 2 жыл бұрын
Set up my pfsense box last week, getting my ubiquity switch soon, perfect timing on video. Thanks for these informative tutorials!
@rjy8960
@rjy8960 2 жыл бұрын
6:35 - The internet pictorial :) Nice nod to the IT Crowd! Everything I know about pfsense has been from watching your channel, Tom. Thank you!
@DanAllen1
@DanAllen1 2 жыл бұрын
Thanks so much for doing this. I just made the jump from USG to pfSense and this is perfect timing.
@terryrodbourn2793
@terryrodbourn2793 Ай бұрын
All I know what did as Network Engineering for 35 years I crated VLANs in routers setting up battle tents in both the 2nd Gulf War and other places it become routine for me in Cisco routers!
@mujahidjaleel
@mujahidjaleel 2 жыл бұрын
What if I don't have a USG or any switch plugged in between the pfSense and the UniFi AP? I have a proxmox server with extra nics running a virtual pfsense edge router. How would one go about setting up multiple vlans to multiple SSIDs?
@SyberPrepper
@SyberPrepper 2 жыл бұрын
Very helpful Tom. I just got a new USW Pro 24 PoE switch and was needing to know how it works with PFsense or OPNsense. Thank you.
@mattparksey
@mattparksey 5 ай бұрын
Thank you for this video. I've been using the basic setup for a while. I've been having issues with the AP stability as the uptime never supasses 1 day. I notice when I turn on a second SSID, the load on my AP goes from 0.03 to above 1.00. I'm now testing a USW-Lite-8-POE in place of my dlink managed, but still experiencing the increased load.
@richardkeating2760
@richardkeating2760 2 жыл бұрын
Thanks Tom. I think my pfSense is a different model than yours. My igb2 is only 100Mb. I was having a problem with setting up my VLAN on Unify/pfSense and watched your video 3 times. I could see DHCP Discover and Offer coming into pfSense VLAN port but no Request or Ack. Boot/reboot and finally decided although port shows lights changed the cable and voila, all working. Thanks for making it clear so at least I knew I had it right.
@mattclifton76
@mattclifton76 2 жыл бұрын
Will this type of setup work with the dream machine pro?
@Elliot9874
@Elliot9874 2 жыл бұрын
Perfect timing. I am building my Pfsense tonight. Thank you Tom!
@udoloske
@udoloske Жыл бұрын
Hello Tom, first of all thank you for your very informative videos. I currently have a UDM-Pro, a US16-150W switch, a U6-Pro, an AP-AC-Pro and an AP-AC-M. My networks consist of the main Lan, a guest network, an IoT network and a camera network, but only one NVR from another manufacturer is connected to it. But I would like to use a pfsense in the future, but I'm not sure whether I should use the pfsense in addition to my UDMP, or replace the UDMP completely with the pfsense. What would be your recommendation in this case? Many greetings from Germany
@TechySpeaking
@TechySpeaking 2 жыл бұрын
Well, that was more confusing than I had originally hoped, trying to get my VLAN from pfSense to Unifi. Turns out I was overconfiguring it. Thanks for the helpful video Tom!
@ChrisSchwarck
@ChrisSchwarck Жыл бұрын
Having a fun time trying to figure out if VLANS will work with my set up. Main host is ESXi 6.7.0 Update 3, with a PFSense vm as my main router, and the Unifi Network Controller hosted on another vm as a docker container (on the same ESX box). So far, no luck. PFSense is showing no traffic on the VLAN. Checked the VLAN tags, etc., as provided in this video, so I think somewhere in all of the virtualization, something is not VLAN aware.
@KirkSakamoto
@KirkSakamoto 3 ай бұрын
What are you running the Unifi controller on? Is it a cloud key or hosting in the cloud. I have a similar setup but having a problem of how to attach and access the unifi controller. Any help would really be appreciated. Thanks.
@mikemartin101
@mikemartin101 Жыл бұрын
In the second configuration, where you've fed in NSFW_NET into a separate port, do you need to then set the other ports to specific networks? If they're setup for all, wouldn't they somehow get the NSFW_NET traffic too?
@Ussie284
@Ussie284 2 жыл бұрын
Thank you so much for this content. It has increased my enjoyment (and ease) with building and expanding home projects.
@AnIdiotAboard_
@AnIdiotAboard_ 2 жыл бұрын
Could have done with this a few weeks ago. Installed Starlink for a mobile home community, every van was cabled (not a massive site 20 users) Each van on its own vlan, with a Catalyst 10G switch to PFSence. Getting PFSence to play nice vlans was a propper BALLACHE, still its done, they all get there 8meg garanteed and they all get upto 200mbps burst. Not bad really when you think about it $75 install for each van coveres the hardware cost, and $100 a month split 20 ways = $5
@therealdjflip
@therealdjflip 2 жыл бұрын
Getting back into PFSense, so this is very helpful, as in the process of ordering a dream machine
@corneaccount9778
@corneaccount9778 4 ай бұрын
Option 2 does not work for ssids:Unify ap port 7 default lan on a tplink switxh and port 9 from switch to opt por, port 9 untagged vlan 10 and port 7 ap tagged in vlan 10 because of the ssid vlan 10 must go through? Must the uplink port to lan pfsense also be tagged in vlan 10 on tp link switch?
@nerdegem
@nerdegem 10 ай бұрын
In case anyone needs this, if you're using VMWare ESXi with pfSense, you have to set the vLan to 4095 (trunked) on the VMWare Port Group. This is different behaviour to my experience with the Ubiquti edge switch where the vLan PGs were set to 0 and the traffic still flowed.
@clayton5586
@clayton5586 2 жыл бұрын
Could you cover pfsense along with ubiquiti layer3 switching?
@TheAncientSpirit
@TheAncientSpirit 2 жыл бұрын
At 14:00 Tom set port 1 port profile CAM_LAN (id 60) does that mean that port 1 is now what is usually refered as "access" port for VLAN60 or is it "trunk"? How would you set e.g. port 2 as trunk that would route only VLANs 3 and 4?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
PORT 1 Is set to CAM_LAN (id 60) which means it ONLY connects to that network and NO other networks come from that port.
@sebastianzak9563
@sebastianzak9563 8 ай бұрын
Lawrence, will you make new Video with Unifi 8.1.113 version ?
@RobertTaylorRTC
@RobertTaylorRTC 2 жыл бұрын
Tom - Your videos are one of the best sources of information regarding networking with pfSense and Unifi. I truly appreciate your efforts. In this video where you selected the second native NIC from pfsense, I totally get that segregation on the Unifi side. However, on the first "all" vlan feed from pfsense - wouldn't that also include the vlan 60 group traffic into that vlan 50 traffic mix? I get vlan 50 would not go into vlan 60 but since vlan 50 is "all", it includes all the vlans defined on Unifi. At least on my Unifi contoller shows it this way. If my object is to truly separate the traffic, wouldn't I need to redefine the native vlan to exclude vlan 60?
@MrMackster01
@MrMackster01 2 жыл бұрын
Great video! thank you! Dumb question- where would the UDM pro go in this scenario? i have a UDMP accepting my internet /WAN traffic and then connecting to a Unifi Switch! Any suggestions would be appreciated
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
kzbin.info/www/bejne/hZ7QY6OHiq-CZtE
@CampRusso
@CampRusso 4 ай бұрын
🤔 what if I want to replace my USG 3P with pfsense? I also have a self-hosted controller plus USWpro24 and UAP AC Pro. I'm only using the default vlan. I have only the basic settings. Should I just create a new site in Unifi and move over the switch/ap?
@edwinkm2016
@edwinkm2016 2 жыл бұрын
Hi Tom. Still confused about default and native vlans. Also experience with vlan hopping? My setup works but I am not sure if it is really secure.
@samsampier7147
@samsampier7147 2 жыл бұрын
Not Tom, but native vlans are just untagged vlans on a particular trunk. Default VLAN is simple a VLAN created at the factory for you. Most vendors use VLAN 1 as default. VLAN hopping is a thing. Secure systems use a unused VLAN for the native vlan (something easy to remember like 999).
@edwinkm2016
@edwinkm2016 2 жыл бұрын
@@samsampier7147 if I understand correctly. My important lan is now without vlan. All less privileged networks are vlans on this same interface. Are there risks people can jump to this untagged network?
@williamp6800
@williamp6800 2 жыл бұрын
@@edwinkm2016 VLANs are not inherently less privileged. By default, VLANS only inherently provide logical separation of connections. The rules you apply (or don’t apply) to each VLAN determine the degree of separation, and thus security, between VLANS. For example, if you created VLANs in pfSense but did not apply any rules, you could jump between all the VLANs without any restriction. Just type in the IP address and you’re there. And because pfSense implements “best practice” defaults, none of the VLANs would be able to access the Internet. They would function only within your local network. You need to add a rule and explicitly give Internet access to a VLAN. As for default and native VLANs and the tagging that goes with them, that still confuses me so I can’t help you there. After I rebuild my pfSense installation this week, I might be able to add something on that.
@Chris-on5bt
@Chris-on5bt Жыл бұрын
My dude, you know exactly what I need in life, thank you!
@duncan-mcrae
@duncan-mcrae 2 жыл бұрын
How would you integrate a Synology NAS that was used to stream to a TV and store work stuff on when you have the iot on a NSFW lan?
@guilhermeb7615
@guilhermeb7615 Жыл бұрын
How you can connect Unifi to manage a remote network? I've trying setting up a VPN but doesn't seem to have an option to tell Unifi to look for that particular LAN... thanks
@Foiliagegaming
@Foiliagegaming 2 жыл бұрын
Thank you guys for all the great and educational content. I was wondering if there would be a reason that you wouldn't use one of the 10Gb ports for trunking.
@Nvious1
@Nvious1 2 жыл бұрын
Could you do a follow-on video that will do pfsense - unifi dynamic vlan using radius authentication (user / MAC) with a single SSID? I would like to keep my wifi with a single SSID, but be able to send things like IoT (via MAC) into a vlan.
@PJBhm
@PJBhm Жыл бұрын
So, port 16 and port 24 are trunk ports. Am I right ? thanks !
@RKGraves
@RKGraves 5 ай бұрын
Excellent Tutorial - Thank You!
@markGibby
@markGibby 5 ай бұрын
ok i got the vlan setup on unify and pfsense but you didnt cover how to configure the ip or anything.. what IP does it get and how do you set that?
@per-mortenevensen941
@per-mortenevensen941 2 жыл бұрын
I have a netgate 1100 an use bouth opt and lan ports from it to 2 different switches, vlans 10,20,30,40 out as trunk on both ports. Is that any problems?
@shetuamin
@shetuamin 2 жыл бұрын
Can you make a video for block udp flooding port 1900 form smart tv?
@JeppoTheWrecker
@JeppoTheWrecker 2 жыл бұрын
Hi Tom, I have an idea for a video for you. I have a Unifi VLANed network with pfsense and a cloudkey controller. I wanted to extend the number of network points at a remote location on the network with another switch and all the connections are on the iot network, the cloudkey is on the main network. The switches I choose were the flex minis, as cheep and available. But how to get them to communicate. Happy to discuss with more detail.
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
I have a video on that topic and the cloudkey is not ideal due to it's limitations of how many devices. kzbin.info/www/bejne/n6G0coacbcibd9E
@AnterosLive
@AnterosLive Жыл бұрын
Is it possible to make a USG4Pro work WITH pfsense? I do like the unifi environment and wish it was easier to use both.
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS Жыл бұрын
Not sure why you would want to but you could double NAT them
@simritathwal4020
@simritathwal4020 2 жыл бұрын
So I have a scenario that I don't know the specific terms for. I have two networks, both without unifi routers but utilizing unifi switches after the router. Network 1 is Bridge Network (192.168.1.x) and Network 2 is Building Specific Network (192.168.30.x). My goal is to use one switch and give specific ports bridge network and the rest non-bridge network instead of having a separate switch for each network. Would I have to create the vlan within my router (Fortigate) and as well as on my unifi controller or do I just do it on the unifi controller? How do I go about this?
@JohnSmithIam
@JohnSmithIam 2 жыл бұрын
Do you have a recommendation for a home network using a managed Unifi switch?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
Yes, use the UnFi switch that fits your budget and use case.
@FSUGrad1999
@FSUGrad1999 2 жыл бұрын
Hey @Lawrence Systems, I'm trying to make the switch to pfsense from a USG-3p. After I get all my networks and VLANs defined in the pfsense box, I'm assuming I need to go into Unifi controller and change all my networks to be VLAN only. Is there anything else I might be missing? PS. IPv6 is very easy to disable in UniFi Controller, but I'm not sure how to do it correctly in pfsense. Any chance you could touch on that in a future video? Thanks for all you do great stuff.
@maxmustermann9858
@maxmustermann9858 Жыл бұрын
So is it possible to define 4 networks in the pfsense and and have two VLANs over one Interface and the other 2 over the other? So by that I mean is it possible to have multiple tagged VLANs over a interface on but not all? My use case: I have a pfsense and a UniFi switch in the main house. From there I connect multiple access points „VLAN 1“, security cams „VLAN 100“ also I make a connection to the garage where I have an extra switch which only needs an uplink to the main switch for VLAN 100 the Cam network and an extra VLAN 110 for the door access. So is this possible to have two VLANs tied to one port but not the main VLAN 1?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS Жыл бұрын
That should work
@j2theay
@j2theay 2 жыл бұрын
Tom are you typically deploying pfsense/UniFi with layer 3 switches?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
Yes
@steffenskovmoller
@steffenskovmoller 2 жыл бұрын
Thanks for the video Tom. Maybe a video, about dynamic assigned vlan based on radius login.
@andrewagredano9968
@andrewagredano9968 2 жыл бұрын
It it possible to run a UniFI 6LR to pfsense without a switch. Just a simple design. I ask because I cant seem to set it up myself. I currently have a old AP-AC-Pro what I want to switch out but cant seem to figure it out. Any clue as to where im failing
@pf755
@pf755 2 жыл бұрын
Following the minute 14min30 of the video, When I set the port to the "new" unifi network, the AP connected to it refreshes and loses its adoption. Not able to adopt it again. “adoption failed, please again. if the issue persists, we recommend factory-reseting the device”. Any idea?
@donnielewis186
@donnielewis186 2 жыл бұрын
Any tips for VLAN and Fortigate? Also what software are you using for the diagrams? It could be useful in teaching my team!
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
I don't use Fortigate and Diagrams.net kzbin.info/www/bejne/o6GpYpxvqMt4gJI
@geovanivaleriosanchezelgio1397
@geovanivaleriosanchezelgio1397 2 жыл бұрын
cual es el modelo de unifi que hace capa 3 para hacer ruteo estatico vs pfsense ?
@matthewjohnson1511
@matthewjohnson1511 2 жыл бұрын
What do you have your “ Management Network” set to? I have experienced much grief without a true understanding sometimes of how I made something work with using Sophos as you do Pfsense and multi site self hosted controller. The “management network” has caused me several all nighters. Ugh.
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
default
@matthewjohnson1511
@matthewjohnson1511 2 жыл бұрын
On a 20-30 site controller that has physically different locations in different cities do you keep the default for the Management Network? I was trying to pass a VLAN from non Unifi Firewall for Management VLAN for each site that matched the IP scheme for the site. Maybe that’s wrong 🤷‍♂️?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
@@matthewjohnson1511 Put the UniFi devices on the default / native network and all the other networks in VLAN.
@ajugland
@ajugland 2 жыл бұрын
How do you setup Unifi Dream Machine for gaming. Possible to make one VLAN and open all ports? Looks like its blocking voice in fortnite
@Vadinaka
@Vadinaka 2 жыл бұрын
Sorry Tom for my question. I am a huge fan of your work and long time follower. I am about to buy a new screen. May I ask the references of the one behind you please?
@kyopan23
@kyopan23 Жыл бұрын
Can I just define VLAN 10 in pfsense on the second example?
@Gevs90
@Gevs90 Жыл бұрын
Hi, thanks for video. Can I use the scenario without USG ? I mean, if I host Unifi network application on my own server, can I set on single port multiple VLANs ?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS Жыл бұрын
I did not use a USG in this video, so yes
@Gevs90
@Gevs90 Жыл бұрын
@@LAWRENCESYSTEMS thank you 😊
@zomgoose
@zomgoose Жыл бұрын
My understanding is ALL is a Trunk Port in Ubiquiti. Setup a trunk port if you are using another brand of switch.
@zubair5244
@zubair5244 6 ай бұрын
is it possible to connect more than 400 users concurrently with unifi dream machine actually when we connect here machine got jammed therefore another unifi dream machine is installed but we may need to connect more than 1000 users which is not possible with our UDM pro controller because it is not supported
@TheAxtn8r
@TheAxtn8r 2 жыл бұрын
Thanks for the video Tom! How does UniFi handle VLANs between switches? Say I had a port on one switch with a profile that trunks VLAN 2, 4, and 6 going to another separate UniFi switches port with the same profile, would the traffic going between the switches be tagged so that the second switch could transmit data to ports with profiles for the individual VLANs?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
The connection between switches needs to be set to ALL on both switches.
@ramachandrankrishnamoorthy95
@ramachandrankrishnamoorthy95 Жыл бұрын
Hi Sir, This video is really helpful for us to understand how we connect PFSense with Ubiquiti Layer 3 Switch. However, is it possible to use Cisco ASA instead of PFSense?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS Жыл бұрын
Yes
@ramachandrankrishnamoorthy95
@ramachandrankrishnamoorthy95 Жыл бұрын
@@LAWRENCESYSTEMS Thanks. Should I follow the same procedure for ASA as well. Correct?
@Brother-Luke
@Brother-Luke 2 жыл бұрын
Thanks for all your videos Tom. They are very helpful and well presented. I was wondering, what software do you use to build your network diagrams?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
The Best Diagramming Tool "Diagrams.net" kzbin.info/www/bejne/o6GpYpxvqMt4gJI
@StevePatak
@StevePatak 2 жыл бұрын
Hmmm...I was just thinking about why I didn't actually define all my VLANs in Unifi when I first got my system set-up. I don't have a good reason other thank Unifi sees all the VLANs and I can set each port as needed. Should I bother explicitly defining them within Unifi?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
If you don't need them, then don't set them up.
@StevePatak
@StevePatak 2 жыл бұрын
@@LAWRENCESYSTEMS I guess my question is, and maybe I missed it in the video, is there anything gained by defining them? Does it improve anything?
@Acinuter
@Acinuter 2 жыл бұрын
Hi Tom, thanks for the video. I have a follow up question / clarification needed. For the 'advanced' scenario with the NSFW vlan. As I understood, main uplink port from Unify switch is set as ALL - meaning it will route ALL vlans to the pfsense, regardless of the vlans setup, right? And traffic from Marcus PC will arrive with its vlan tag on Unify switch, and the idea is that it will get routed to pfsense ONLY via a secondary unify port setup on the same vlan. Question: what prevents the "main" upling to catch that route - as it is configured as ALL, so it could route all vlans to pfsense.
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
When a port is set to ALL it makes ALL VLAN data come to that port and it is up to the device to use or disregard that data. In the case of most computers they only use the native network data.
@aednichols
@aednichols 2 жыл бұрын
@@LAWRENCESYSTEMS thanks, this was an important missing piece for me!
@Justin-lt3jt
@Justin-lt3jt 2 жыл бұрын
For someone not concerned with saturating pfsense interface ports (internet speed is way less than gigabit), is there still value/reason for the dedicated opt switched networks? Besides for fun.
@williamp6800
@williamp6800 2 жыл бұрын
There are two issues. One is saturation of the WAN interface which is limited by your ISP connection. The other issue is saturation of your LAN. If local traffic within your network is exceeding 1GB, using a separate physical interface will physically separate some the local network traffic. If the traffic doesn’t need to move between the two physical interfaces, performance would improve.
@ncurses
@ncurses 2 жыл бұрын
nice vids! one question though. do pfsense have a webserver "virtual hosting" capability. like in sophos?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
It has HAProxy support.
@Saturn2888
@Saturn2888 6 күн бұрын
I still am confused with VLANs. It's more about the firewall and inter-VLAN networking. THat's the stuff I need to know. If I separate off smart home devices, how do I make it so they only have Internet access and can't access each other but also allow multicast from Home Assistant or my phone into that VLAN?
@ALAN-gn4ud
@ALAN-gn4ud 9 ай бұрын
Is there a reason like certain WiFi devices just won’t work on a vlan network, like a ring doorbell won’t connect to the vlan ssid but works fine on untagged default ssid. Other things work like laptops and iPhones. The doorbell tries to get an iPad and I can see where the firewall assigns one but it won’t work
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 9 ай бұрын
They all should work provide you have the network configured properly.
@ALAN-gn4ud
@ALAN-gn4ud 9 ай бұрын
@@LAWRENCESYSTEMS you’d think. Even tried configuring an access port on a C1000 switch and connecting a dumb access port just to that switch, same thing
@ramosel
@ramosel 2 жыл бұрын
Tom, do you do any work with OpenWRT? I've been looking for this type of information using pfSense and the new OpenWRT VLAN filtering to accomplish this same work.
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
Nope, I don't use OpenWRT
@ramosel
@ramosel 2 жыл бұрын
@@LAWRENCESYSTEMS Thanks, understandable.
@iainmcmullen414
@iainmcmullen414 2 жыл бұрын
I'd love to see something on QoS of VLANs with pfSense and UniFi. We've been able to define the VLAN priority within pfSense, however it doesn't look like we can define the priority within UniFi.
@daleweaver777
@daleweaver777 2 жыл бұрын
Tom, do you feel UTM devices like Watchguard with their security subscription are worth it? Or would you prefer to use pfSense and then increase endpoint secruity software like Huntress?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
The endpoint is where all the bad things happen so that is the first place to focus.
@daleweaver777
@daleweaver777 2 жыл бұрын
@@LAWRENCESYSTEMS thanks for the reply. That is what I was thinking. Also so much traffic is HTTPS now days and I don't have the Watchguard setup to be able to decrypt to inspect and then re-encrypt. So I'm not getting a lot of the benefits from an edge device doing everything. Probably better to use the money towards better endpoint security.
@speedup070605
@speedup070605 2 жыл бұрын
Thank you for very informative video. Love your work mate. Also do you have any poll that we can vote for your next video or we just drop in the comments?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
My forums are the best place forums.lawrencesystems.com/c/site-feedback/3
@jamescater66
@jamescater66 2 жыл бұрын
Do you need to set up an "All Except NSFW" profile for the main trunk so that VLAN 10 traffic doesn't get sent back down the main trunk (only to be thrown away by the router)
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
I don't need to.
@alexsinbb
@alexsinbb 2 жыл бұрын
Is it possible to set VLANs only at the UniFi switch level using dedicated untagged ports so that my LAN IOT traffic doesn’t hairpin at IGB1 thus halving the bandwidth. I assume in this scenario that the bandwidth of the switch is > 1Gbps total which is the case for most UniFi Switches.
@alexsinbb
@alexsinbb 2 жыл бұрын
​@SuperWhisk There are still two physical connections going to the router. Example IGB1-LAN, IGB2-IOT with separate ethernet cables going to separate ports on the Unifi Switch. The switch port receiving IGB1-LAN is Profile "LAN". The switch port receiving IGB2-IOT is set to the Unifi defined Native Network for IOT (20) which has been configured as VLAN 20 in the Unifi side (not the pfSense side). In this fashion, traffic between LAN and IOT can reach 1Gbps instead of 500Gbps when you use VLANs on the same router port. Unifi will tag all the IOT traffic as VLAN20 and then both subnets can talk over the same switch. Traffic between LAN and IOT will leave the switch and run through both wires and both IGB1-2 ports. Otherwise in the classic use of VLANs on the same IGB1 as described in this video, the traffic between subnets is limited to the speed of the single router port hair pinning on itself. Yes I have rules between subnets to allow specific media high bandwidth traffic. In my scenario, the media server is on LAN, but all the media consuming devices are on IOT.
@berndeckenfels
@berndeckenfels 2 жыл бұрын
Does Unifi also allow tunnels to controllers for level 3 roaming with vxlan or wlc-tunnel CAPWAP?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
Not that I am aware of.
@bossman762x39
@bossman762x39 Жыл бұрын
can this be done with a udm pro for unifi and a netgate 4100 for pfsense? right now i am using a udm pro in a fully unifi network but i want to jump into pfsense, i like both. i want to get into pfsense for HA and the firewall and to get familiar with it as a whole. can i keep both with these devices?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS Жыл бұрын
Yes, but I don't think it's a great idea kzbin.info/www/bejne/hZ7QY6OHiq-CZtEsi=PTQuj4hxQUIOVJmk
@WarpedFlayme
@WarpedFlayme 2 жыл бұрын
So with a Unifi switch, is it accurate to say that the a port with a single-network profile set produces untagged packets while a port with a multi-network profile (such as "All") produces tagged packets?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
The UniFi switch does not produce the VLAN packets but it does parse the data going to the ports based on them.
@WarpedFlayme
@WarpedFlayme 2 жыл бұрын
@@LAWRENCESYSTEMS Sorry, by "produce", I just meant "comes out of", not "generates". I know the end devices are generating the data that is being shuttled about.
@big-g4785
@big-g4785 2 жыл бұрын
Could you go a step further explaining how you could define SSID's bound to VLAN's that then via Radius or other auto switch based on the MAC address of the end user WiFi devices. Simplified 4 VLANS bound to 4 SSID's (VL10-VL20-VL30-VL40), based on a clients MAC Address it would automatically connect to the correct VLAN irrelevant of which SSID they choose. Use case: VL10 is for Ops Engineers or External Maintenance, VL20 is for General Office Workers, VL30 is for RnD Department & VL40 is for Guests, based on the MAC of the devices they use they would automatically be put onto the correct SSID regardless of which SSID [Maintenance; Office; RnD; Guest] they selected.
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
MAC addresses are easily changed so this is not a good way to attest to which devices should be on which network.
@bl0chi
@bl0chi 2 жыл бұрын
Is it possible to mix untagged, and tagged vlans on Unify Switch but not "All", only few ?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
You can do custom port profiles to choose what tags to use for specific VLANs
@liberty-vf4bi
@liberty-vf4bi 2 жыл бұрын
Where do you get the custom images you use in the diagrams?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
Google image search.
@liberty-vf4bi
@liberty-vf4bi 2 жыл бұрын
@@LAWRENCESYSTEMS 😄 Yes, Ok. But these are just normal images. How do you then get the "custom connectors" and opacity (no white space) seen in most of the images used in your diagrams?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
@@liberty-vf4bi Those are built in ones
@SteeleDaMan
@SteeleDaMan 2 жыл бұрын
Please do a similar video but for Tp link Omada! I have an Omada switch and WAP with pfsense and I can’t get vlans set up and I’m not sure why
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
Not likely but their interface is very close to UniFi.
@deejayblacklight
@deejayblacklight Жыл бұрын
The all Setting is not present any more. and one cable between pfsense and unifi switch doesnt work for me any more. Any hints on there?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS Жыл бұрын
It no longer says "ALL" its just the default LAN network.
@AnonymousB460
@AnonymousB460 Жыл бұрын
Do you have one for pfsense and omada?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS Жыл бұрын
No, but Omada is a close to UniFi in they way it works so the same should work.
@gwensley
@gwensley 2 жыл бұрын
Is it possible to do vlan with just a pfsense box and a Nano HD AP (or any unifi AP)? I cannot get the vlan to pull the right IP from DHCP server.
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
If you are not using a switch in between, then yes.
@mujahidjaleel
@mujahidjaleel 2 жыл бұрын
@@LAWRENCESYSTEMS Can you do video on that?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
@@mujahidjaleel You just set the VLANs in pfsense and plug the AP directly in to the port.
@mujahidjaleel
@mujahidjaleel 2 жыл бұрын
@@LAWRENCESYSTEMS Ok, took me a bit of time and I got it to work. VLANs were already set in pfsense. It's just that the VLANs had to be reconfigured on the proxmox where the UniFi Controller container is running. The UniFi AP management network should be on the default network for it to adopt the AP, preferably on a untagged vlan/network.
@rjdp3
@rjdp3 2 жыл бұрын
Thanks Law, you rule 😎
@FPol-if6bm
@FPol-if6bm 2 жыл бұрын
what is the difference between vlan only, and just select vlan in the network?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
As I said in the video, VLAN only does not define the networks in the UnFi routing equipment.
@nigelgeek
@nigelgeek 2 жыл бұрын
what do you do if you don't use a unifi switch but have pfsense and unifi APs?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
Depends on the switch but many require that you build the VLANs in the switch
@nigelgeek
@nigelgeek 2 жыл бұрын
@@LAWRENCESYSTEMS i will have a look. Also the computers on my network can't talk to each other without internet. Could it be a vlan issue?
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
hard to say, we have fourms that may help forums.lawrencesystems.com/
@itxgod3946
@itxgod3946 8 ай бұрын
I ran into problems :( My Unifi APs are connected to an unmanaged POE switch, which I believe is preventing my vlan experiment.
@vm4463
@vm4463 2 жыл бұрын
Good content, keep it coming.
@GregE9981
@GregE9981 2 жыл бұрын
I would have setup vLANS on a LAGG once it got to multiple physical interfaces out of the pfSense. Plus it adds a little tolerance to the network if one of the cables or physical interface went down, traffic would still flow. just my 2 cents.
@RJGamer-zb4lb
@RJGamer-zb4lb 2 жыл бұрын
do you need a unifi switch to use unifi Access Point? i was thinking about plugging it into a switch(or it's a hub. not sure) and have it go into the pfsense router. directly. i do know need to look for a poe device to power the access point. for a home network.
@LAWRENCESYSTEMS
@LAWRENCESYSTEMS 2 жыл бұрын
No, but If you want to use VLANs you just need any switch that properly supports VLANs.
DO NOT design your network like this!! // FREE CCNA // EP 6
19:36
NetworkChuck
Рет қаралды 3,4 МЛН
小丑女COCO的审判。#天使 #小丑 #超人不会飞
00:53
超人不会飞
Рет қаралды 16 МЛН
When you have a very capricious child 😂😘👍
00:16
Like Asiya
Рет қаралды 18 МЛН
Cat mode and a glass of water #family #humor #fun
00:22
Kotiki_Z
Рет қаралды 42 МЛН
Chain Game Strong ⛓️
00:21
Anwar Jibawi
Рет қаралды 41 МЛН
UniFi Basics: Start the Right Way Without Breaking the Bank!
14:52
Crosstalk Solutions
Рет қаралды 351 М.
pfSense vs UniFi Firewall: May 2024 Edition
23:30
Lawrence Systems
Рет қаралды 103 М.
Setting up VLANs in pfSense
13:32
Raid Owl
Рет қаралды 79 М.
pfsense: Blocking Threats With pfblockerNG Lists
18:30
Lawrence Systems
Рет қаралды 111 М.
Basic Setup and Configuring pfsense Firewall Rules For Home
17:27
Lawrence Systems
Рет қаралды 389 М.
Unifi for Newbies - Setting up VLANs and WiFi
40:51
Ethernet Blueprint
Рет қаралды 40 М.
小丑女COCO的审判。#天使 #小丑 #超人不会飞
00:53
超人不会飞
Рет қаралды 16 МЛН