Admin VLAN and "Standard" VLAN together

Networking & Firewalls
1

Hi,
I have a problem that I have not found an easy solution you could say.
I have an Admin VLAN that separates from all the standard VLANs about 20 “regular” VLANs.
And I want it to work like this, I put a device that should be inside the Admin VLAN to be configured within the pfsense DHCP via a MAC address. That basically the separation will be in pfsense via the MAC address of the device.
The equipment I have
Main Firewall - Pfsense
Two main switches - HPE Aruba 2930F
All other switches - HPE 1920s

My problem is just the wired connection. And in WiFI I open another hidden SSID and that’s it.
In wired connection all other ports in the switches are of other VLANs in untagged. And I want the Admin VLAN to work no matter what port I connect to the switch. He too will have to be untagged. So you understand the problem?
The only way that came to my mind was to actually go through each VLAN and set a fixed address for each admin device. But I do not want it to be like that. This will be my last option, I prefer to avoid such a solution as much as possible.
That’s why I’re turning here, hoping I’ll find another solution here that I did not think of.
I was thinking of playing with the bridge in Pfsense but I do not know how it behaved there and if it really is the right solution to this problem.

Hope I was clear on what I want to do …
Thanks
Itay

2

Your issue isn’t really a PFSense one but a switch one. The “proper” way to handle this is to use RADIUS based dynamic VLANs. This means that every time a device is plugged into a switch port, the switch sends the MAC address to a RADIUS server. The RADIUS server responds with the VLAN that the device should be in. If the RADIUS server doesn’t know that particular MAC address, the switch can be configured to place the device into a fallback VLAN, which can be different for each port. You should be able to use PFSense as the RADIUS server, so you still have the ability to just place you admin device MACs in there. You can also do the same thing with your wireless, if your APs/controller support RADIUS dynamic VLANs.

I have used this with Aruba 2930s and 2530s but I don’t know if the 1920s have this feature.

3

Ok. Thanks
Sounds good, I’ll check it out.