There is more which is not OK and that could be related. Here more starting with an outline from the situation.

The picture shows the router.firewall pfSense attached to a 1G-network below a Zyxel GS1920 switch and a 10G-network below a TL-SX3008F switch. Below those switches all kind of clients.

However there is something going terrrible wrong in, according my actual impression the communication between pfSense and teh SX3008. For absolutely unkown reasons, communication towards some clients are OK, where communication towards other clients (bizar even in the same subnet) are not OK. 

Here some Behavoir examples. All connections are using vlans.

- vlan-Y client-C (PC), can access Clients A & B, however only

if you manually assign client-C with an IP

- Client A can be accessed via Client D

- Client B on the same vlan(!) can not be reached not pinged.

- client-C does can not connect with DHCP-server on pfSense

It seems that in comming packages can in certain situation,

not be delivered to the 10G clients.
Reason and conditions unkown !!!!

Note that comparable connections from pfSense to the Zyxel switch or a Mikrotik switch (and smaller netgear switches) are working based on the same principels without any issue. 

Note that I spend many many hours trying to understand what what is happening and why it is not working as expected. Trying different settings, tools like wireshark etc.

  @KJK 

Yep PIVD are essential to define the vlan for untagged devices. The default is one for each port and all devices are interconnected. Exactly what I do not want. I am not using "vlan-1".

So the port to which the PC is connected has as PIVD the number ot the ^PC-vlan^. And in the vlan setup screen I defined the PC-connection as a untagged interface like this

Port-6 is the PC-connection. And as you can see I am using dummy vlans 100x to make sure that ports can not interconnect via vlan-1.

 So, thanks for the replay but I think that I did set-up the PIVD's in a correct way.

Louis 

  @KJK 

Yep there is one lagg containing multiple vlan's towards pfSense (ports 1 &2). One of those vlans (vlan17) is the vlan related to the PC.

And the picture in my post above related to vlan17 shows that UNIT-6 is untaged member of that vlan and LAG-1 is a tagged member of the VLAN.

so if I do not mis interpreted the gui, that seems to be correct.

Given the combination of the issues described in my second post, I verdict the LAG-communication. For that reason I just made a wireshark capure of the lagg towards the GS1920 and the lagg towards the SX3008. One thing hits me. The GS1920 is sending LLDP- and LACP-messages, the SX3008 is only sending LACP-messages. So I will have a look at the LLDP section of the SX3008

If that solves the problems, I will report here

  @KJK 

I agree, I had a look at it dis some trails and I think it is just info for a management system.

I turned it off again

  @Louis2 

I did some further testing using the pfSense package capture function

Related to the pinging the clients in VlanX. Wireshark shows that:

• the pings arriving from client D, are leaving pfSense via the VLAN-X gateway
• there are responses from client A but not from client B
• also not via the mngt vlan or so ( I did want to be sure there is not routed wrong)

Related to the PC not getting an address from the dhcp server

• on the pfSense PC-vlan interface is no IPv4 traffic at all, so also not from the DHCP-server
• there is IPv6

Traffic on the PC-vlan if the PC has a manual configured IPV4-address

• the PC has connectivity to internet etc
• and the traffic is passing via the pfSense PC-lan gateway, so it takes the correct path

These "measurements" are hopefully helping to understand the problem, but for the moment I am completely lost 

  @KJK 

I understand what you are saying, hower note that this is absolutelely not the first time I configure a setup like this. And IMHO it should be easy. However what I am seeing now is bizar !!

You also should be aware that I bought this switch at least as a temporarely replacement for a bigger Mikrotik Switch (CRS317), which is defect. To a large extend the SX3008 is a 1:1 replacement of eight of the sixteen CRS317 ports. And the pfSense configuration is hardly changed at all.

So my estimation was that I would have it up and running in one lets say two hours. I have been spending days allready and it is still not working !

I am really thinking that there is a bug in the switch software !

Note that I was in a hurry to have the defect switch repacement. So, when the unit arrived I noticed that it was version 1 hwardware not the intended actual 1.6 harware.

My initial thought was to return the device.  However given the fact that a) I urgently needed a new switch anb b) the software releases for the 1.0 hardware release where much newer tan those for the newer 1.6 release(!),  did me decide to keep the device. First thing I did is update the software.

Whats ever related to the problems:

- the not working DHCP (dhcp server is pfsense), I use that on all my switches and devices

- the fact that I have two devices in the same vlan one reachable the other not (when arriving via the pfsense lagg)..... bizar
- in fact both problems make me think in the same direction some issue retated to (outgoing?) messages towards pfSense
(the same lag two device problem does not occur if I test from another SX3008 vlan)

The switch is part of my network and I also need that network to do tests. What I am going to do next is replacing the lag with a single trunk. To do that I have to change pfSense and the switch. But to be honest, if I can not solve the problem today perhaps tomorrow, I am going to buy another switch and returning this one or throwing it in the wastebasket