In order to complete this recipe, you must have at least one unassigned interface to use as the parent interface.
- Navigate to
Assignments, and click on the VLANs tab.
- Click on the
- Choose a
Parent Interfacefrom the drop-down menu; this should be a currently unassigned interface:
- Enter a VLAN Tag from
1is reserved as the default VLAN tag and should not be used).
- Enter aVLAN Prioritylevel from
7(or just leave it at the default value of
- Enter a brief
- When you are done, click on the
- Click on the
- In the
Available network portscolumn, select the newly created VLAN in the drop-down box, and click on the
- To configure the VLAN, click on the interface name in the
- On the Interfaces configuration page, check the
- Change the
Descriptionto an appropriate one for the VLAN (for example, DEV).
- Set theIPv4 Configuration Typeto an appropriate value (usuallyStatic IPv4).
- Set theIPv6 Configuration Type, or leave it set toNone.
- If you set theIPv4 Configuration TypetoStatic IPv4, you must enter theIPv4 Addressand CIDR for the new VLAN. Use a subnet that has not yet been used (for example,
- Leave the IPv4 Upstream gatewayset to None.
- If you set theIPv6 Configuration TypetoStatic IPv6, you must enter theIPv6 Addressand CIDR for the new VLAN.
- Leave theIPv6 Upstream gatewayset to none.
- Leave theBlock private networksandBlock bogon networkscheckboxes unchecked.
- When you are done making changes, click on the
Savebutton, and then, when the page reloads, click on the
Up to now, we have contemplated networks that correspond to a single network interface. Sometimes, however, we want to decouple logical network groupings from physical interfaces. We may want to have more than one network on a single interface—or, less commonly, have a network span multiple interfaces. We can accomplish this with virtual LANs, or VLANs. By attaching a special header to an Ethernet frame, known as an 802.1Q tag, we can have VLANs. Since the VLAN tag is an integer from 1 to 4094, it would seem that we are limited to 4094 VLANs (or 4093, since we are not supposed to use 1 as a tag), but by using QinQ tagging, we can nest VLAN tags, making it possible to have a much greater number of VLANs on our private network (in fact, a much greater number of VLANs than we would probably ever need).
In step 5 of this recipe, we referenced the VLAN priority level. This is a feature added to pfSense with version 2.3 that allows you to define a class of service for your VLAN. It is a 3 bit field from 0 to 7. Somewhat counter-intuitively, 1 is the lowest priority level (background), while 7 is the highest, and 0 is best effort treatment, which is one step above the lowest priority level.
In order to utilize VLANs on your network, you need one or more managed switches. These are switches that recognize 802.1Q tags placed in the Ethernet frame by pfSense, and which will forward the frames to the correct port. Managed switches are never plug and play, they always involve some configuration, so consult your switch’s documentation for details on how to configure it.