Evaluating the capabilities of the UniFi Dream Machine Pro all-in-one enterprise security gateway & network appliance (UDM Pro), I was wondering whether this site-to-site setup is possible:

Site-to-site setup

Setup context

Setup goals

  • The three networks behind the Ubiquiti routers should be connected via site-to-site VPN, e.g. IPSec.
  • All UniFi devices, i.e. the Access Points (APs), the UDM Pro, and the USG, should be controlled by the UniFi controller on the UDM Pro.

Some observations

  • IPSec between several EdgeRouters only (without ISP routers, without UniFi routers) does work, but the UDM Pro interface did not allow to enter dynamic DNS names as IPSec peers.
  • When adding the ISP routers with port forwarding (UDP 500 and 4500), I think I would need to tell the EdgeRouters to use their dynamic public IPs when establishing IPSec for authentication, but I'm not sure if I can do this in the GUI.
  • From what I've seen, the USG and the UDM Pro would support dynamic DNS when using OpenVPN rather than IPSec, but the EdgeRouter does not support OpenVPN from the GUI.
  • The most uncertain thing to me is whether I can use the UDM's UniFi controller through the tunnel, especially because the UDM Pro is an appliance and I'm unsure whether it would support controlling multiple sites, or be controlled by an external UniFi controller.
  • Why is your business using ISP routers? Your business should have its own routers to connect to the Internet. You want the public addressing on your routers, not routers you do not own or control. Also, your business should have static IP addresses, not dynamic.
    – Ron Maupin
    Nov 20 '20 at 15:07
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 31 '20 at 3:57
  • @Ron Maupin: I think, Ron Trunk's answer is technically a workaround as it does not meet all context requirements posted in the question. I ended up using a different workaround myself, which I will post as an additional answer. But I haven't found a solution that meets all requirements, yet. Do you think I should then just accept one of the answers or should we keep the question open? As I didn't know whether the problem is solvable, I've phrased the question "is … possible?" rather than "how can I …?". Thanks for the follow-up!
    – fiedl
    Jan 4 at 21:03
  • Both (ISP router, dynamic IPs) are temporary requirements for a transitional period. For example, the ISP routers are used to support a legacy phone system in this setup.
    – fiedl
    Jan 4 at 21:06

It's possible, but first you need static IP addresses. You can ask your ISPs to give you static addresses (for a fee, of course).

The most uncertain thing to me is whether I can use the UDM's UniFi controller through the tunnel...

Once you establish the tunnels, they essentially become transparent to the devices. Baring latency problems, your controllers can't tell the difference if you're using VPN tunnels or not.

  • Thank you. I've also thought about suggesting static IPs. Are they required at all sites or only at one of the sites for the IPSec auth to succeed? Or is this just due to the limitations of the GUIs of the USG and the UDM?
    – fiedl
    Nov 20 '20 at 17:00
  • As it turns out, static IPs are only required due to the limitations of the UDM GUI. They are not a requirement of IPSec. When configuring IPSec manually or using different routers (e.g. EdgeRouters or routers with pfSense software), dynamic IPs may be used for all three sites.
    – fiedl
    Jan 4 at 21:11
  • Note: Using the UDM UniFi controller through the IPSec tunnel works fine. The only drawback is that the UDM software does not support multiple sites, which means that all unifi devices will be shown in one site in this setup.
    – fiedl
    Jan 4 at 21:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.