4

I've got a Ubiquiti EdgeRouter PoE (5 port) which I'm setting up just now. I'm trying to achieve a solution where the single UniFi AP can hand out IP addresses in the 10.0.2.0/23 space, while devices in the office which require a cable connection can get IPs in 10.0.0.0/23. So far I have set up:

  • Port 0 with address 192.168.1.1, patched directly to a port in the office so that I can still log into manage the router regardless of the other port settings.
  • Port 1 connected to the internet line using DHCP
  • Port 2, "LAN", configured with an address of 10.0.0.1/23
  • Port 3, "WLAN", configured with an address of 10.0.2.1/23

I've set up two DHCP pools - one for 10.0.0.0/23, which correctly hands out IPs when you connected to the LAN port, and one for 10.0.2.0/23, which also correctly hands out IPs when you connect to the WLAN port.

The LAN port is connected to a switch, managed by the company above us who own the racks.

So now, I've connected the AP to the WLAN port, and I can see in the EdgeRouter UI that it has obtained a DHCP lease for 10.0.1.10 (yes, I would prefer to manually assign this outside of the DHCP range, but I don't think it affects this). However, when I run the UniFi controller on my laptop, connected via the switch to the LAN port, it can't see the AP.

How can I get the controller to see the AP, keep the LAN and WLAN DHCP pools separate, and still maintain routing between the two? I'm reading a lot about UniFi having issues when not connected to the same switch, which it isn't, but I don't see anything concrete about how to solve the problem! I'm wondering if I need to connect everything through the switch and use VLANs, but I've not used VLANs before and I don't know if that would just amount to the same setup!

Edit:

I've actually made some progess, in that I went with Jim G's "Option 3", and I've at least got some WiFi working. I have set up two SSIDs, one which applies the VLAN tag and one which leaves the traffic untagged. Untagged traffic through the AP successfully gets an IP in the 10.0.0.0 network and can access the internet. However traffic on the tagged SSID, which is the setup I really want, sees the same problem - an IP is handed out but there is no network access.

Some investigation with ping led me to see that initially after the DHCP lease is assigned, I can ping the router and use the internet on the VLAN. However the response times from ping are around 5-7 seconds, and then they start timing out and only come back occasionally (but they do come back for the odd response). Given that they do come back, the timing of just having connected may be insignificant though.

Edit - here's the ping times and pattern:

PING 10.0.2.1 (10.0.2.1): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
64 bytes from 10.0.2.1: icmp_seq=0 ttl=64 time=5696.117 ms
64 bytes from 10.0.2.1: icmp_seq=1 ttl=64 time=4987.305 ms
Request timeout for icmp_seq 7
Request timeout for icmp_seq 8
64 bytes from 10.0.2.1: icmp_seq=2 ttl=64 time=7390.786 ms
64 bytes from 10.0.2.1: icmp_seq=3 ttl=64 time=6985.669 ms
64 bytes from 10.0.2.1: icmp_seq=4 ttl=64 time=6236.806 ms
64 bytes from 10.0.2.1: icmp_seq=5 ttl=64 time=5840.661 ms
64 bytes from 10.0.2.1: icmp_seq=6 ttl=64 time=5108.968 ms
64 bytes from 10.0.2.1: icmp_seq=7 ttl=64 time=4186.371 ms
64 bytes from 10.0.2.1: icmp_seq=8 ttl=64 time=3535.087 ms
64 bytes from 10.0.2.1: icmp_seq=9 ttl=64 time=2627.659 ms
64 bytes from 10.0.2.1: icmp_seq=10 ttl=64 time=1683.275 ms
64 bytes from 10.0.2.1: icmp_seq=11 ttl=64 time=776.689 ms
64 bytes from 10.0.2.1: icmp_seq=18 ttl=64 time=1878.685 ms
Request timeout for icmp_seq 20
Request timeout for icmp_seq 21
Request timeout for icmp_seq 22
Request timeout for icmp_seq 23
Request timeout for icmp_seq 24
Request timeout for icmp_seq 25
Request timeout for icmp_seq 26
Request timeout for icmp_seq 27
Request timeout for icmp_seq 28
Request timeout for icmp_seq 29
Request timeout for icmp_seq 30
Request timeout for icmp_seq 31
Request timeout for icmp_seq 32
^C
--- 10.0.2.1 ping statistics ---
34 packets transmitted, 13 packets received, 61.8% packet loss
round-trip min/avg/max/stddev = 776.689/4379.544/7390.786/2045.686 ms
  • Why is the gateway 10.0.2.1? Also, both networks overlap - 10.0.0.0/16 and 10.0.1.0/16 are in the same range. Did you mean /24? – Jim G. Jun 5 '15 at 16:42
  • Aha - that would be because I posted the question before I changed the configuration slightly! I've modifed the question, but I haven't added the new VLAN because that's already further down. What it should be is two /23 networks: 10.0.0.0/23 and 10.0.2.0/23. The router has an IP on each of those (since the VLAN is the latter), and so the router is either 10.0.0.1 or 10.0.2.1 - the first addresses of each range. – alitheg Jun 6 '15 at 16:42
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 17:14
2

By design, the two networks are segregated and can't communicate with each other. You have a few options:

  • put the unifi controller on the WLAN network (not that great of an option)
  • change the firewall/routing rules to allow the AP to communicate with the LAN (a bit of a security risk)
  • put the AP on the LAN and use a VLAN for the WLAN traffic

Option 3 is the cleanest, IMO. All of the management traffic is on the LAN, but any wireless clients are put on the wireless VLAN.

| improve this answer | |
  • That does seem like the cleanest option, (and I thought of Option 1 last night!). I have a couple of questions though: Can the EdgeRouter make sure that Wireless traffic goes on a VLAN? The only VLAN configuration I can see is configured by physical interface. I'd still be able to route traffic from the WLAN to the LAN devices using the router right? – alitheg Jun 4 '15 at 8:09
  • I haven't set up an EdgeRouter before - can you set multiple VLANs on a port? You'd set the LAN VLAN as the PVID and untagged, the wireless VLAN would be tagged. Then on the AP you'd configure the wireless traffic to be tagged to the wireless VLAN. – Jim G. Jun 4 '15 at 15:55
  • You can indeed! My first attempt was using 2 VLANS configured on the switch, but I can't for the life of me figure out how to set the PVID! I've looked at the manual and an example config which says it has one, and it's not set anywhere in the config! – alitheg Jun 4 '15 at 16:13
  • I've added some more info above - I can use WiFi if the traffic is untagged, but when it's tagged it fails. I also realised that it's not just a complete failure to communicate, it's a combination of timeouts and really long latencies – alitheg Jun 4 '15 at 16:18
  • According to this: community.ubnt.com/t5/EdgeMAX/…, the PVID is always 1 on the port unless you are explicitly using a VLAN. So it looks like in theory my setup is as you describe! Unfortunately my tagged traffic still can't get through though! – alitheg Jun 4 '15 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.