VLAN trunking between ESXi and pfSense

[ESX_pfSense]

Hi!
I have a pfSense running on a Watchguard x700. Furthermore, I do have an ESXi server which is running several VMs in different VLANs. This ESXi server does have a physical LAN port (uplink) that is connected to the Watchguard (pfSense).

Now my question is how I can manage to create a trunk between the ESXi server and the pfSense so that I can have access to the VLANs on the ESXi server. As of now, I could not find any option in the pfSense which allows me to setup a port as a trunk port.
Thank you for your help!

 

[RESTfulADI]

What you're describing is called router on a stick.

http://blog.stefcho.eu/?p=695

 

[ESX_pfSense]

Thanks, I will look into that.

 

[ESX_pfSense]

Well, I looked over that solution and unfortunately, that is not exactly what I need. Basically, I want to use the pfSense AS a switch that uses one of its ports as a trunk to the ESXi, i.e.:

Internet <=> pfSense <====> ESXi <=> VLANs 10, 20, etc.

 

[MysticRyuujin]

You do understand that VLANs are meant to separate broadcast domains right? Without a router (or a layer 3 switch that can route VLANs) two VLANs cannot (or should not) talk to each other...

For each VLAN you should have a separate subnet and each subnet should have a default gateway (the pfSense router) and the gateway should route the traffic between VLANs.

If you just want all the machines to talk to each other why are you using different VLANs?

I don't know a lot about pfSense but I would assume that you need to create virtual interfaces and assign them dot1x VLANs.

 

[k1pp3r]

To do trunk ports you need a layer 3 device. Most firewalls (not sure about pfsense) are primary firewalls that do minor layer 3 routing. Most don't do inter vlan routing, you would need a layer 3 switch or a router to provide that.

 

[MysticRyuujin]

Most firewalls don't do layer 3 routing? That's news to me...where are you getting this information?

Some of them might not support routing protocols such as OSPF but almost all of them support some type of routing unless they are transparent and only have 1 outgoing interface for each incoming interface...

 

[0V3RC10CK3D]

Should be easy.

Mutiple VLANed port groups on the host. Single uplink.
Plug that cable into firewall. Configure multiple sub interfaces on that port. Each sub interface would use a vlan tag.

 

[k1pp3r]

Most firewalls don't do layer 3 routing? That's news to me...where are you getting this information?

Pick up an ASA5500 and a 1951 igs router and tell me they do the exact same thing. They do limited layer 3 functionality.

Example? Just look at the QoS features of an ASA vs a layer 3 router.

 

[MysticRyuujin]

I never EVER said they do the same exact thing...

I have an ASA5515-X at home lol. It routes between VLANs using sub-interfaces just fine. I'm a CCNP and a CCSP. I'm well aware what an ASA can and cannot do.

Your statement was "Most don't do inter vlan routing." and that is incorrect.

 

[Meanee]

To do trunk ports you need a layer 3 device.

Wait, what?

Layer 3 is needed for inter-VLAN routing. But trunk ports will work on any good old L2 switch. Then you can use router on a stick.