Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 5 replies
  • Subscribers 28 subscribers
  • Views 2751 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Getting DHCP to work withGuest WiFI VLAN Sophos XG Ubiquiti Unifi Switch and Ubiquiti Unifi APs

uuscotty

Hello, Everyone.

Hoping folks with more experience and knowledge can help me figure out what I haven't done correctly to facilitate Guest WiFi access with VLANing using Sophos XG, Ubiquiti switch and Ubiquiti Unifi APs. Hopefully, once I get this working, I can then apply the learnings and figure out what I am doing wrong to get an isolated IOT VLAN/WiFi network running as well.  Seems my last hurdle to solving this puzzle is getting DHCP to work for my Guest Network clients

I found this thread and thought it would help because I also have a DHCP problem https://community.sophos.com/xg-firewall/f/discussions/117185/guest-wifi-with-sophos-xg-and-unifi-aps.  This helped get me going, but I didn't end up having a hardware/switch issue like OP in this thread.  I have been staring at this for hours and am sure I am missing some improper configuration somewhere that I am just not able to see.

Overview of current setup:

T-Mobile LTE modem in bridge mode

Sophos XG running 18.0.4 MR4

  • WAN DHCP on port 2
  • Private LAN 192.168.70.0/24 on port 3
  • DMZ 192.168.99.0/24 on port 1
  • Guest LAN 192.168.71.0/24 on port 5 with VLAN 71 (10.0.71.0/24)

Ubiquiti Unifi Cloud Key controller for managing switches and APs

Ubiquiti US-16-150W POE switch

  • Port 7 is my uplink to port 3 on the XG
  • port 11 is my link to port 5 on the XG
  • port 13 is being used to test hardwire connectivity with my macbook since I can't get WIFi and DHCP to work.

Ubiquiti Unifi Nano HD APs

  • Private WLAN:  192.168.70.0/24
  • Guest WLAN: 10.0.71.0/24

Here is a diagram of how I have things setup currently.  My macbook on the right side of the diagram is what I am using to test.  When connected via Ethernet, manually setting MB to 10.0.71.11 because I can't get DHCP to work for both wireless and hardwired. I am able to ping the XG interface and am able to access the web as well.  

I am able to reach my internal DNS and ping the VLAN interface and google.  Seems weird to me that I can also ping the192.168.71.1 XG port address.

Steps I have done so far:

1.  Build Guest VLAN 71 in XG and attached to LAN zone (192.168.71.1 for NIC and 10.0.71.1 for VLAN)

2.  add DHCP for Guest VLAN using 10.0.71.0/24

3. add IP Host Network to use for FW rule using VLAN network 10.0.71.0/24

4. set up FW rule to allow host network to access WAN (also put DMZ in there to resolve DNS from my cache server)

I have stared at these configurations forever and as far as I can tell, and from all the posts I have read, I should have things setup correctly in the XG.

Now it was time to set things up on the switch side.  This is probably where I am making a mistake.  I understand VLANs conceptually, but don't have any practice in implementing or configuring them.  To make things a bit steeper on the learning curve, it seems Ubiquiti does things a bit differently as it relates to tagging and trunking.

Here are the steps I took with the configurations.

1.  created a Guest VLAN network in the Unifi controller. Used VLAN 71 to match what I built in the XG.

2.  Built guest wireless network and assigned it to GuestVLAN71 network

3.  built my switch port profiles.

4. Now I assigned the switch port profiles to the ports in the switch.  Port 7, which is the upliink to the LAN port on XG.  Didn't actually change anything here, just left switch port profile set to "all".

Port 11, which is the uplink to the VLAN port on the XG

port 13, which I am using to test via Ethernet with my Mac

I hope this is enough information for some more experienced members to help me figure out what I am doing incorrectly.  Very much appreciate any help that can be afforded.

Thanks,

Scott



This thread was automatically locked due to age.
  • 0

    I'm not into Unify, but I noticed in your Profiles (LAN and VLAN71) that under Tagged Networks you have selected both "Select All" and "GuestVLAN71(71)"

    Since in the XG your port 5 for the normal guest network is not a VLAN port, this port would most likely not be a tagged port. Only port 5.71 is a Tagged port. So in your profiles try to untick "Select All" and only have Tagged Network enabled for the GuestVLAN71(71).

  • 0 in reply to apijnappels

    Thank you for looking.  I tried your suggestion, but am unable to make the adjustment.  As long as native is set to LAN, checking either the "select all" or "GuestVLAN71 (71)" boxes activates both.  Doesn't look like there is a way to independently check one or the other.  They are either both on or both off.  

    -scott

  • 0 in reply to uuscotty

    Maybe then you could make both XG interfaces VLAN interfaces.

    If your unify switch is sending all traffic with a VLAN tag then only the VLAN71 traffic would be picked up by the XG.

  • +1

    I was able to fix my issue related to the DHCP.  I statically assign all my family's clients for web filtering, application filtering, reporting, etc....Anyway, the macbook was assigned a DHCP address from my private LAN so it couldn't pick up an address from my Guest LAN DHCP.  This would explain why I had some successes when manually configuring the wireless adapter.  Once I deleted the static entry for my macbook from the private DHCP, I was able to pick up an address from the Guest DHCP.

    As for the VLANs, I was over complicating things.  I had added two new physical ports to the XG.  One for Guest and one for IOT and then built VLAN subinterfaces under each of those ports.  Bone headed mistake on my part because all I needed to do was build two VLAN subinterfaces under the existing LAN port, one for Guest and one for IOT.  On the Unifi side, I built VLANs to match and just tagged the Guest and IOT at the ports for the uplink to the XG and the ports for my APs.  Now, i am able to hop on all three SSIDs, get a DHCP address from each respective scope and surf properly on all three networks.

    Thanks,

    Scott

  • 0 in reply to apijnappels

    Thank you for the help.  I was able to figure this out.