pfSense Gold Subscription

Author Topic: Multiple VLANs with ubiquity Unifi AP  (Read 298 times)

0 Members and 1 Guest are viewing this topic.

Offline Atreides

  • Jr. Member
  • **
  • Posts: 58
  • Karma: +0/-0
    • View Profile
Multiple VLANs with ubiquity Unifi AP
« on: December 25, 2017, 08:27:41 pm »
I'm trying to setup multiple vlans and ssids with my Ubiquiti access points. I'm not sure if I'm doing something wrong in pfsense, in my access point controller, or in my switch. I'm seeing the networks broadcasted, but I am able to connect to them. They ask me for the password but never connect.

I also noticed pfSense has a wireless setting page. I assuming that is for when a wireless interface is added directly to the pfSense, and that I shouldn't be using it. Is this assumption correct?

I should note that i'm able to connect to a wireless network that is not using a vlan with identical settings except for the vlan.

Controller

The controller is managed on vlan1

I have created a few Wi-Fi networks in my Unifi controller.

house -> vlan10
john -> vlan20
iot -> vlan70

Switch

In my switch I have connected the two access points to ports I have set to GENERAL, and set to VLANs 1,10,20,70. The switch is then trunked to my pfSense. I'm not sure if this is the right way to connect the access points to the switch. Should they be connected over a trunk? I was unsure about this. When I tried to trunk from the access points to the switch, I was unable to manage them in my controller.

I'm wondering if it's a problem with my switch since someone already mentioned that tp-link's can have a problem with vlans In a separate thread. I'm considering buying a Ubiquiti switch.

pfSense

In pfSense I've created three interfaces HOUSE (vlan10), JOHN (vlan20), IOT (vlan70) which are on the interface the switch connects to.
« Last Edit: December 25, 2017, 08:50:57 pm by Atreides »

Offline strangegopher

  • Jr. Member
  • **
  • Posts: 34
  • Karma: +0/-0
    • View Profile
Re: Multiple VLANs with ubiquity Unifi AP
« Reply #1 on: December 25, 2017, 09:15:48 pm »
is your controller on trunk port too? it should be.
Also Switch -> AP port, pfSense -> switch port need to be on trunk ports.
Do you have a management wireless ssid with no vlan?
Do that and you can connect to no vlan ssid and manage AP wirelessly.

Online johnpoz

  • Hero Member
  • *****
  • Posts: 14732
  • Karma: +1370/-202
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Multiple VLANs with ubiquity Unifi AP
« Reply #2 on: December 25, 2017, 10:59:52 pm »
I use unifi AP and they have no problems with vlans..

Yes their IP that you talk to them would be untagged... But any vlans that they advertise could either be on the untagged vlan or some other tagged vlans..

It would work work like this

pfsense -- untagged, and tagged --- switch --- untagged, tagged AP ---- client SSID -- client...
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.4.2-RELEASE-p1 (work)
1x SG-4860 2.4.2-RELEASE-p1 (home)

Offline Atreides

  • Jr. Member
  • **
  • Posts: 58
  • Karma: +0/-0
    • View Profile
Re: Multiple VLANs with ubiquity Unifi AP
« Reply #3 on: December 26, 2017, 11:32:06 am »
I use unifi AP and they have no problems with vlans..

Yes their IP that you talk to them would be untagged... But any vlans that they advertise could either be on the untagged vlan or some other tagged vlans..

It would work work like this

pfsense -- untagged, and tagged --- switch --- untagged, tagged AP ---- client SSID -- client...

That's basically what I've done. Maybe it's an issue with my tp link switch? Would you say it would be a good idea to get the ubiquity fully managed 8 port switch I linked?

Just to clarify, should the input port from the access points be trunked? Or should it be set to general, with all the different vlans I have set.
« Last Edit: December 26, 2017, 11:38:55 am by Atreides »

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9559
  • Karma: +1083/-309
    • View Profile
Re: Multiple VLANs with ubiquity Unifi AP
« Reply #4 on: December 26, 2017, 12:36:18 pm »
Ubiquiti APs like to be managed on the untagged VLAN.

SSIDs with a VLAN set are tagged to/from the AP.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline dotdash

  • Hero Member
  • *****
  • Posts: 1928
  • Karma: +99/-3
    • View Profile
Re: Multiple VLANs with ubiquity Unifi AP
« Reply #5 on: December 26, 2017, 12:40:41 pm »
Not sure what terminology the TP Link switches use, but assuming the default wireless is on the house vlan, you want the port connected to the UniFi AP to be native/untagged on 10, and tagged on the guest net (70?). You might also need to set the PVID to 10.

Offline Atreides

  • Jr. Member
  • **
  • Posts: 58
  • Karma: +0/-0
    • View Profile
Re: Multiple VLANs with ubiquity Unifi AP
« Reply #6 on: December 26, 2017, 04:59:32 pm »
I'm seriously thinking about buying the Ubiquiti switch. I'm hoping it'll make things easier so that there won't be any integration problems between the switch and my access point. People have mentioned problems with tp-links and vlans so I'm worried that might be causing the problem. Does anyone think this is a good or bad idea? Or if there is a better alternative?

I'm still not sure if I should be trunking between the access point and my switch. Should the port that the access points come in on be set to trunk? Or should it be set to GENERAL, which is the setting I use usually when vlans are coming in from various clients?

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9559
  • Karma: +1083/-309
    • View Profile
Re: Multiple VLANs with ubiquity Unifi AP
« Reply #7 on: December 26, 2017, 07:39:30 pm »
The management VLAN has to arrive at the AP untagged.

The SSID VLANs have to arrive at the AP tagged.

On a cisco switch I am pretty sure you use general mode for that.

You might also be able to use a trunk port with a pvid set.

Every switch does it differently. For instance on brocade you would do something like this:

vlan 100
  tagged ethernet 1/1/1

vlan 101
  tagged ethernet 1/1/1

vlan 102
   tagged ethernet 1/1/1

interface ethernet 1/1/1
   dual-mode 100

That would make 100 untagged (the PVID) and 101 and 102 tagged.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Online johnpoz

  • Hero Member
  • *****
  • Posts: 14732
  • Karma: +1370/-202
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Multiple VLANs with ubiquity Unifi AP
« Reply #8 on: December 26, 2017, 09:19:44 pm »
Trunk would be used to your AP with the management vlan being the native or untagged traffic.. General would allow for more than 1 untagged vlan, while a trunk really has an enforced filter and only allows the 1 single untagged vlan, etc.

General gives you a bit more flexibility for doing odd stuff.. But to unifi AP if all your SSIDs are on vlans with only 1 of them untagged and the same as your management network your using to talk to the AP on then trunk would be correct cisco setting..

Either general or trunk would work as long as you setup the correct tagging for your vlans.
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.4.2-RELEASE-p1 (work)
1x SG-4860 2.4.2-RELEASE-p1 (home)