cisco sg300 dynamic vlan assignment

pfSense router-on-a-stick VLAN configuration with a Cisco SG300

Last revised 28 january 2018., introduction, cisco sg300, initial connection, general configuration, create vlan ids, configure interfaces.

• Assign switch IP
• Power saving notes

My pfSense baseline guide makes extensive use of VLANs to provide enough network segments to facilitate the segregation of devices into the following categories

Without VLANs it would be tough to provide enough network interface connections to enable me to apply strict firewall rules and traffic prioritisation to support my needs. For example, the video surveillance system is confined to a single VLAN and has very limited abilities to communicate with devices in other subnets and the internet, my gaming consoles have prioritisation to ensure smooth and problem free network play. These Virtual LAN (VLAN) segments are connected back to pfSense in a ‘router-on-a-stick’ configuration. Its referred to as ‘router-on-a-stick’ because of the single trunk cable connecting the 802.1Q capable switch to our pfSense router. This enables our switch to handle local subnet traffic switching whilst leveraging pfSense to firewall inter-subnet traffic. Some of my fileservers and devices generate a substantial amount of traffic and not having to push all this traffic through pfSense allows it to better handle the load it does need to process.

Here’s a diagram to help illustrate my configuration.

The Cisco SG300 switch is an affordable, high-performance, relatively easy to manage device that’s designed specifically for smaller homes and businesses whilst retaining many of the advanced feature sets of other enterprise level products. Although this guide is created on a SG300-10PP which offers fanless operation, 10 gigabit ethernet ports and supports power over ethernet (PoE) the SG300 range includes models with up to 48 ports. The Cisco SG500 range offer a similar configuration interface and also includes 10 gigabit networking ports on certain models suitable for those needing higher bandwidth capabilities.

The SG300’s configuration page by default is available on the 192.168.1.254 address. To access it set your PC that you will be using to configure it from into the 192.168.1.x address range, I used 192.168.1.100. Connect your PC to the SG300’s port 8. You could use another but this keeps the lower ports free and avoids unnecessary complications further on in this guide. Connect the power and wait for the SG300 to complete its boot process, its takes a little while before you can access the login page at http://192.168.1.254 Login with the default username cisco and password cisco

When you log in you will be initially prompted to change the default password, set it to something secure.

Enable L3 routing

Enabling layer3 routing will enable us to assign an IP address to our VLAN(s) and ease access post configuration easier. Changing the fundamental processing mode will reset the switch back to its default state.

Navigate to Administration > System Settings and set

• Host name = sg300
• System Mode = L3

Click Apply which will reboot and reset the switch. Once the switch has booted, log back in with default username (cisco) and password (cisco) again where you will be prompted to set your secure password again.

Save & Apply

Navigate to VLAN Management > VLAN Settings, we will configure the VLAN IDs here required to support my baseline guide. I’ve added some images to help illustrate configuration options and final states.

Create VL10_MGMT ID

• VLAN ID: 10
• VLAN Name: VL10_MGMT
• VLAN Interface State: Enabled
• Link Status SNMP Traps: Enabled
• Range: [ ] Click Apply

Create VL20_VPNLAN ID

• VLAN ID: 20
• VLAN Name: VL20_VPNLAN

Create VL30_CLRNET ID

• VLAN ID: 30
• VLAN Name: VL30_CLRNET

Create VL40_GUEST ID

• VLAN ID: 40
• VLAN Name: VL40_GUEST
• Range: [ ] Click Apply and then Close

When you are done, your VLAN ID table should look like this

I recommend saving your configuration at this point which is made available through he flashing Save prompt in the top menu bar. Anytime I mention to save I refer to saving the current state to the running and startup configurations.

In this guide we will create the following interfaces:

Broadly thinking an access mode port can be part of only one VLAN and is typically used to connect to a device or PC. A trunk mode port can be part of one or more VLANs and is typically used to carry information between switches or devices.

Setup VL10_MGMT access port

Navigate to VLAN Management > Interface Settings

Highlight GE1 and select Edit

• Select ‘Access’ Apply & Close

Navigate to VLAN Management > Port VLAN Membership

Highlight GE1 and select ‘Join VLAN’

• Remove ‘1UP’ (highlight it, and click the left arrow)
• Add ‘10’ as Untagged. (highlight it, and click the right arrow)

Click on Apply and Close

VL20_VPNLAN access port

Highlight GE2 and select Edit

Highlight GE2 and select ‘Join VLAN’

• Remove ‘1UP’
• Add ‘20’ as Untagged. Click on Apply and Close

VL30_CLRNET access port

Highlight GE3 and select Edit

Highlight GE3 and select ‘Join VLAN’

• Add ‘30’ as Untagged. Click on Apply and Close

VL40_GUEST access port

Highlight GE4 and select Edit

Highlight GE4 and select ‘Join VLAN’

• Add ‘40’ as Untagged. Click on Apply and Close

Trunk to Unifi AP

The trunk needs to be configured to provide the management interface on the untagged traffic, and the other SSIDs on tagged packets.

Verify GE5 is configured as a trunk port

Highlight GE5 and select ‘Join VLAN’

• Add ‘10’ as Untagged.
• Add 20, 30 & 40 as tagged Click on Apply and Close

Trunk to pfSense

The trunk needs to carry all the VLANs between our switch and pfSense’s parent interface in tagged packets.

Verify GE6 is configured as a trunk port

Highlight GE6 and select ‘Join VLAN’

• Leave 1UP present
• Add 10, 20, 30 & 40 as tagged Click on Apply and Close

When you are complete you Port LAN configuration should look like this

Save the current configuration to the running and startup configurations.

Connect a Cat5e cable between your pfSense trunk interface and port 6 on the SG300 switch.

Assign switch IP address

We will now assign a fixed IP address to our switch via the VL10_MGMT VLAN to enable us to modify the configuration as and when needed.

Navigate to IP Configuration > IPv4 Interfaces

• Select VLAN 10
• Select Dynamic IP address Click Apply

Don;t worry at this point you will lose contact with the SG300. Setting the IP address of the VL10_MGMT interface overrides the default 192.168.1.254 address we have been using so far. Before we can reconnect, we will configure pfSense to provide a fixed IP address via a Mac address reservation. I like to assign fixed IP addresses to my infrastructure hardware and I prefer to do it through Mac reservations within pfSense. This has a benefit of maintaining accurate routing tables and provides me with a centralised resource to keep track of current reservations.

Log into pfSense and navigate to Statistics > DHCP reservations where you will hopefully see our current SG300 IP address assignment as made by the DHCP server, in the example below you can see the SG300 has acquired the 192.168.10.162 address.

Click the ‘plus’ symbol (underlined with red above) to assign a static IP address, I’m using 192.168.10.2.

Its now worth rebooting your SG300 switch to ensure it picks up the new IP address we just allocated for it.

Disconnect your PC from the SG300 switch and reconfigure it to obtain an IP by DHCP.

Connect your PC to port 1 and assuming everything has worked you should be awarded an address in the VL10_MGMT subnet of 192.168. 10 .x.

Verify ports 2 provides an address in VL20_VPNLAN range, i.e 192.168. 20 .x Verify ports 3 provides an address in VL30_CLRNET range, i.e 192.168. 30 .x Verify ports 4 provides an address in VL40_GUEST range, i.e 192.168. 40 .x

Connect your Unifi AP to SG300’s port 5 and verify you can connect to each SSID and are awarded a corresponding IP address.

Verify you can access the SG300 web configuration page at 192.168.10.2 from VL10_MGMT, VL20_VPNLAN & VL30_CLRNET. You should no able to access it from VL40_GUEST due to our pfSense firewall configuration blocking access to other internal networks.

Configuration notes

Power saving mode.

The Cisco SG300-10PP is equipped with some useful power saving technology but I have previously found some issues with PoE being enabled with certain devices. If you find you are having problems try disabling the power saving features to eliminate this possibility.

To disable navigate to Port management > Green Ethernet > Properties and set

• 802.3 Energy Efficient Ethernet (EEE) = Disabled Apply

SG300 manual