Messages

1

General Discussion / Re: Need help with 802.1x Configuration

« on: April 12, 2024, 08:25:05 pm »

"Should not" I get, but this is my home network so I'm not too worried about some rogue person physically attaching to a port in default vlan.  In addition, I'm running (not so ) smart TP-Link switches and can't put the management IP in anything but the default VLAN, so I'm kinda stuck with it anyway ¯\_(ツ)_/¯

Any insight on what to look for on the OPNSense?

2

General Discussion / Need help with 802.1x Configuration

« on: April 12, 2024, 06:03:40 pm »

Greetings.

Was running my LAN directly on the "LANInterface" associated with igc0 (in my case).  Standard stuff, no VLAN tags, nothing.  Works great.  Now want to add a tagged vlan to the mix, in this case a VLAN interface (vlan0.5) also associated with igc0 but with VLAN tag 5.  Went through the motions of setting this up but no success. 

Connecting switch now has Vlan 1 untagged (the legacy directly connected network) and vlan 5 tagged.  When performing a packet capture on OPNSense for both icg0 and vlan0.5, I see no traffic on interface vlan0.5 but on the capture of igc0 I see the unanswered ARP request of the client PC in Vlan 5, complete with the 802.1q tag correctly set to 5 in Wireshark.  I also see the rest of my vlan 1 traffic without any 802.1q tag.  Therefore, it looks like the switch is doing its job properly.

Question then:
When operating in 802.1q trunk mode to OPNSense, can the physical interface / LANInterface be used for untagged traffic while handling tagged traffic through a VLAN interface associated to the same icg0?  or once you want to use a trunk, all interfaces have to be VLAN interfaces tagged towards OPNSense?

Should I not see the ARP request for my vlan 5 tagged frame in the vlan0.5 interface capture instead of icg0?

Are there additional considerations to enabling this topology (a setting somewhere) that may need to be set?

I put a "permit any" for this interface but in theory OPNSense should respond to the ARP (L2) no matter what the firewall rules are (L3).

Thank you for your insights.