Important
Netgate is offering COVID-19 aid for pfSense software users, learn more.
Configuring the Switch Ports¶
See also
For an overview of how the switch ports are set up, see Switch Ports Overview.
Switch Section¶
From the pfSense webGUI, there is a menu option called Switches under the Interfaces drop-down. This section contains switch specific configuration options.
Selecting Switches from the drop-down will bring up the Switch page with four sections:
Interfaces Section¶
There is also relevant configurations under Interfaces -> Assignments.
Interface Assignments¶
Under Interface Assignments, notice LAGG0 (UPLINK) is displayed as an available port but is not enabled in the list of interfaces. This is because the default configuration is only expecting VLAN tagged traffic so the VLAN child interface 4090 and 4091 are enabled instead.
VLANs¶
Under VLANs, the default WAN and LAN VLAN can be seen. Additional VLAN networks that will be used by the switch should be defined here with lagg0 as the parent interface.
Any additional VLAN interface added to the switch should also be added, enabled, and configured under Interface Assignments. Firewall rules will also be needed for new interfaces added.
LAGGs¶
Under LAGGs, the default lagg0 containing ix2 and ix3 can be seen. The lagg0 interface should not be modified.
Switch Configuration Examples¶
Dedicated LAN switch¶
In this scenario, SFP+ port ix0 will be configured as the WAN interface. ETH1-8 will be configured as a LAN switch.
For this specific example, I’ll perform the WAN interface reassignment over console. Re-assigning the WAN can be done from the webGUI as well.
This is what the default interface assignments look like on a XG-7100 without an addon NIC:
In this example, ix0 will be WAN, so select option 1 to re-assign WAN from lagg0.4090 to ix0:
No additional VLANs are needed for this, so enter n to continue.
Input ix0 as the new WAN interface name:
Input the same default LAN interface of lagg0.4091 for the LAN
interface name and press Enter to complete the interface reassignment:
The interface assignments should show like this now:
At this point SFP+ port ix0 is now configured as the WAN interface. The LAN interface is still configured the same as the default. Next, the switch will need to be updated so that ETH1 (previously WAN) acts the same as ETH2-8. This will be done from the webGUI.
From the webGUI, pull up the Switch VLAN configuration under Interfaces -> Switches -> VLANs:
VLAN 4090 is no longer needed since WAN is dedicated to ix0 now. You can
either select 
on the row containing 4090 to delete this
entry, or click 
to remove port 1 as a member:
For this example, I simply removed VLAN 4090 from the switch with .
Now edit the VLAN 4091 entry to include Member 1 as shown below:
Next, update the PVID for ETH1 so that it uses VLAN 4091 rather than the old VLAN 4090. To do this, click on the Ports tab and click on the 4090 Port VID to modify it:
Then click on Save:
At this point, everything should be configured properly. ETH1-8 will act as a
single LAN switch. One final step that should be performed is to remove the old
VLAN 4090 from pfSense. So far VLAN 4090 was only removed from the switch. To
remove the old VLAN, go to Interfaces -> Assignments -> VLANs and use
on the 4090 row to remove this VLAN interface:
Two LAN switches¶
In this scenario, the LAN switch from the previous example will be split into two LAN switches.
A new LAN network should be created in pfSense first. Similar to the existing LAN interface, another VLAN interface should be used so the switch can segment traffic appropriately.
Create a new VLAN with lagg0 as the parent under Interfaces -> Assignments -> VLANs:
Once the VLAN has been created, it should look something like this:
Add, enable, and configure the VLAN interface under Interfaces Assignments:
Also create any necessary firewall rules under Firewall -> Rules.
Now that pfSense knows of this new VLAN network, configure the switch so that ETH1-4 use the new network. To do this, go to Interfaces -> Switches -> VLANs and click the Add Tag button. Input the VLAN tag for the new network (same as the VLAN ID configured in the previous steps) and add ETH1-4 and PORT9-10 (uplinks) as members. Be sure 9 and 10 are marked as tagged:
Once this is done, delete the untagged members 1,2,3,4 from VLAN group 2 and click the Save button. The final result should look like this:
Lastly, update the Port VIDs to use the new 4081 VLAN rather than 4091 on ETH1-4 and click Save:
Now ETH1-4 act as a switch for the VLAN 4081 LAN and ETH5-8 act as a switch for the VLAN 4091 LAN.
Trunking VLAN tagged traffic¶
For expanding on the previous example, let’s assume there is a management VLAN of 4000 where devices are already tagged on this VLAN prior to hitting pfSense. Devices on this VLAN may come through on ETH8 but there may also be untagged client traffic.
First, create the management VLAN of 4000 in pfSense using the same steps in the previous example (up to the switch configuration part). Next, add the VLAN to the switch under Interfaces -> Switches -> VLANs. ETH8 and PORT9-10 should be added as members and all three will be marked as tagged:
Once it’s added, the final result should look like this:
Untagged traffic on ETH8 will be assigned a VLAN ID of 4091. ETH8 and the uplinks will also accept traffic that has already been tagged with a VLAN ID of 4000 as well.