Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 10 replies
  • Answers 2 answers
  • Subscribers 28 subscribers
  • Views 9982 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unify WIfi and GuestWifi with two VLANs and management interface

Pieter van Kampen

Hi,

I managed to get two WLAN networks working on the Sophos XG using our existing Unify AP's.

Port4, zone wifi, static gateway address in the LAN range, LAN Relay

Port4.120 WifiGuest, DHCP server with IP address 192.168.120.x

Port4.121 Wifi, DHCP server IP address 192.168.121.x

 

Firewall rules allow the WifiGuest network access to a guest printer in the LAN, and the WAN. The Wifi has full access to the local LAN.

 

Sofar so good. However, For some reason there is no LAN connection on Port4. 

The AP's are connected to an EdgeSwitch, with a trunk on port 1 connecting the Unlabeled Management interface, and the two VLAN's. The switch port 1 is connected to the Port4 of the Sophos. 

I can get it to work by connecting a separate port of the EdgeSwitch to the LAN switch, but I would like to understand the configuration better, and I think it should be able to work with the Port4 interface.

Any suggestions?



This thread was automatically locked due to age.
Parents
  • 0

    After reviewing what you posted. There doesn't seem to be anything wrong with your methodology as far as each interface being on its own subnet.

    It sounds like you want to run a "provisioning" subnet for the UniFi APs and the UniFi Controller (the controller and APs don't really need to be on the same subnet).

    If this is the case you can create a new zone called provisioning or whatever you want for organizational purposes and apply it to Port4, set your firewall rules for the desired traffic requirements, and ensure your switches are tagged and untagged appropriately.

    I have a similar configuration, all unifi devices (ap and switches) are managed on an untagged provisioning subnet/zone, however my Unifi controller is public facing as I run multiple sites with it.

Reply
  • 0

    After reviewing what you posted. There doesn't seem to be anything wrong with your methodology as far as each interface being on its own subnet.

    It sounds like you want to run a "provisioning" subnet for the UniFi APs and the UniFi Controller (the controller and APs don't really need to be on the same subnet).

    If this is the case you can create a new zone called provisioning or whatever you want for organizational purposes and apply it to Port4, set your firewall rules for the desired traffic requirements, and ensure your switches are tagged and untagged appropriately.

    I have a similar configuration, all unifi devices (ap and switches) are managed on an untagged provisioning subnet/zone, however my Unifi controller is public facing as I run multiple sites with it.

Children