1

Good morning!

I’m newish to the world of Ubiquiti and am running into some issues that I’d appreciate some guidance on.

I’ve had an Edgerouter X for about a year. Port 1 is my internet, port 2 is doing DHCP for 192.x addresses and port 3 is doing DHCP 10.x addresses. I’ve tagged port 2 as VLAN 5 and port 3 as VLAN 10.

I went ahead and got myself a US-8-60W unifi switch along with a cloud controller and UAP-AC-Lite.

On the Unifi switch I setup 2 networks. One LAN that offers up 192.x addresses and a 2nd as VLAN only using VLAN 10 to match the ER-X.

I setup 3 wireless networks. One for personal use, one for business, and one for guests. The personal one will pump out my IP’s as expected. The business or guest one will not hand out anything. Similarly my ethernet ports on that switch will only hand out an IP if I have the switch profile set to All. Selecting my other networks basically makes it dead.

I know it’s got to be something stupid I’m missing but I’m coming up empty. Thanks in advance!

8 Spice ups
2

What is acting as your DHCP server? Are VLANS supported through the entire route to the DHCP server? Do you have all of the subnets defined in the DHCP server?

I’m guessing that the personal subnet is on the default VLAN. Are the guest and business subnets also on VLANS, or just different subnets?

3

My edgerouter is the DHCP server and where the vlans are defined.

4

Your config is not quite correct I suspect. Inside the AP config you can set the VLAN ID for the network itself. That should match the VLAN of the network you want to separate. If you want to split things up, you basically want to setup your router (I guess you’re using an edge router) so that it has a VLAN ID with no tag for one port, then say 10 for another port, etc, and plug them all into a flat switch with your AP.

The AP will pass tagged traffic to your router and it will only flow over the port that has the matching tag (tagged/10/20 matching the tag on the cloud controller). It’s likely that you can set this up to route multiple tags with a single port so you don’t need the switch with an edge router, but I have not set one of those up (I typically use other routers like a watchguard).

Moral of the story, you’re not getting DHCP on your secondary WiFi because it’s not tagged to match the traffic in the cloud controller.

1 Spice up
5

It sounds like thelanrangerhit the nail on the head. Can you upload some pics of your config?

@thelanranger

6

Secondary WiFi is not going to receive DHCP packet traffic. You will need to alter your design or your config to accommodate. Otherwise traffic will not get through. It is possible to route traffic over one interface instead of two using VLANs otherwise just use the interfaces as the segregation unit to divide traffic up.

7

Ya, I’ll get some screenshots later this evening.

I guess my next question in the meantime would be, can I just eliminate the ER-X and just use the the cloud controller to push my DHCP scopes out instead?

8

Screen_Shot_2019-06-19_at_4.00.52_PM.png
Screen_Shot_2019-06-19_at_4.00.52_PM.png720×682 45.2 KB

Screen_Shot_2019-06-19_at_4.00.37_PM.png
Screen_Shot_2019-06-19_at_4.00.37_PM.png800×118 24.9 KB

Screen_Shot_2019-06-19_at_3.59.54_PM.png
Screen_Shot_2019-06-19_at_3.59.54_PM.png800×146 18.7 KB

Screen_Shot_2019-06-19_at_4.00.22_PM.png
Screen_Shot_2019-06-19_at_4.00.22_PM.png800×166 23.7 KB
9

Hi there. The ER-X will be required for the DHCP and routing in general. The CloudKey Controller, as far as I have seen, does not do any DHCP or Routing, but does give the configuration areas/options as the controller can manage Unifi Security Gateway (USG) devices.

Quick question, how many cables do you have from the ER-X to the Unifi Switch? The reason for that question is to see how the two VLANs reach the switch. So, I’m guessing the two ports, Port 2 and 3 from the ER-X are both connected to the Unifi switch? If not, only one of your two VLANs are going to reach the switch.

With the ER-X, you should be able to create Virtual Interfaces. So, Port 2 could also have a virtual interface carrying the VLAN ID that is on Port 3 currently. That forms your trunk to your switch, then on the switch you have your VLANs setup and assign port profiles accordingly.

10

Good call ds53. I only had the 192 network plugged into the switch. I’ll try plugging the 10 network in and see what that gets me.

11

I would be looking at Vlan Tagging on your switch

I would presume that your AP is connected to your switch, as is your edgerouter (on 2 ports)

Edgerouter port 2 is tagged Vlan 5, so all outgoing packets will be tagged as such. Does the port on the switch allow VLAN 5 to come in?

Edgerouter port 3 is tagged Vlan 10, so all outgoing packets will be tagged as such. Does the port on the switch allow VLAN 10 to come in?

The port that your AP is connected to will also need memberships. You can either tag all of your networks to the appropriate VLAN, in which case, you will need to permit tagged packets on the switchport for the AP on those Vlans. You can also select an ‘untagged’ port, meaning that the the wireless network you want in VLAN 5 can be untagged in Unifi, as long as the ‘untagged’ vlan on the AP’s switchiport is 5.

Good luck!

12

Basically, the only thing you need to do is connect the eth1, switch0, and the AP all together on a flat switch, then it will work.

What is happening now is that if you plug the AP into eth1 and tag Guest in the AP as 10, then the router will not forward traffic to the switch0. You need a connection or a route from eth1 to switch0. You can do this with a flat switch (or possibly with some configuration in the device, but then I’m not familiar with).

You want tagged (Guest would be tagged 10) traffic to hit the switch, the if it is tagged, it would do nothing on eth1, but get DHCP from switch0. This would give you DHCP and traffic flow through that port. Make sense?