Wireless VLANs for SSIDs on multiple Unifi Access Points

[darkblade]

I'm trying to get an IoT wireless VLAN working on my (five) Unifi access points.

I'm running the Unifi Controller on a Raspberry Pi, and have figured out adding a VLAN under the Network settings.
I have a non-Unifi firewall router (Firewalla) and have added a VLAN (matching the ID on the Unifi Network controller) on the port to my main LAN switch.

My first attempt resulted in 2 APs becoming unadopted, and only by clearing all the VLAN settings on the switches, was I able to get them back online again.

For my next attempt, I'm focusing on getting just one of the APs working.

I've tagged the VLAN ID in the managed switch against the port with the uplink to the AP. When I try to connect to the new VLAN from a (test) device, the SSID credentials are accepted, but the device continually attempts to get an IP address from the router, and is never successful.
I would imagine the issue is something to do with the device not being able to access the DHCP server on the router.

Am I missing something?

 

[Steveocee]

Yes.
You are tagging traffic as it enters your network via WiFi so that traffic on that SSId is "wrapped" in VLAN tag.
You have then tagged the switch port with the VLAN tag so your AP is effectively plugging into that VLAN.

You haven't set up any network services for that VLAN in your firewall, you need an IP address, DHCP server, DNS, NAT, all the good stuff that makes a network actually work.

Tag the traffic as it enters the network as you have but look at add a VLAN interface to your firewall, usually VLAN's will "attach" to existing interfaces. Get rid of the port stuff on your switch and you should be good to go.

 

[darkblade]

You haven't set up any network services for that VLAN in your firewall, you need an IP address, DHCP server, DNS, NAT, all the good stuff that makes a network actually work.

I've already setup a VLAN network (DNS, DHCP, etc) on the firewall (subnet 192.168.33.1/24) with VLAN ID 33, so devices on the IoT SSID (VLAN ID 33) should be getting an IP from the DHCP on the firewall.

I've just dug out a spare laptop and assigned static IP settings for the VLAN subnet and it can't ping 192.168.33.1. That's with, or without the AP port tagged on the 33 VLAN.
LAN traffic is still working over the AP in both scenarios (port tagged on the switch).

I'm starting to think Unifi have locked down the WVLAN capability to their own hardware.

 

[darkblade]

Figured it out - you also have to tag the port that the firewall is connected to on the switch. Doh!

 

[ChrisD.]

I'm starting to think Unifi have locked down the WVLAN capability to their own hardware.

Why would you think that?