Guest Wifi with Netgate XG-7100 and Ubiquiti AP *without* switch

stb · Oct 15, 2018, 10:13 AM

Hi all,

I am using a Netgate XG-7100 as firewall and a Ubiquiti AP-SHD as access point. The basic setup of the XG-7100 is done and works fine, also the access point works with the main SSID. The UAP-SHD is connected directly to port 8 of the XG-7100 with the PoE injector in between, but no switch.

Now I want to create a guest wifi network which is isolated from the main SSID using VLANs. This is where I currently struggle.

In Unifi Controller I tagged the guest wifi network with VLAN 200, and also in pfSense I set up what I believe to be a sensible configuration, however when clients connect to the guest wifi, they do not see the gateway nor do they get an IP assigned from the DHCP server.

I'm hoping for some help here to show me my misunderstandings.

The XG-7100 uses VLANs to separate WAN from LAN on the same lagg0. So I created an interface with VLAN 200 and put it on port 8 (tagged), but also put VLAN 4091 (LAN) on port 8 (untagged). The Port VID is 4091.

🔒 Log in to view 🔒 Log in to view 🔒 Log in to view 🔒 Log in to view 🔒 Log in to view 🔒 Log in to view 🔒 Log in to view 🔒 Log in to view

I would be very grateful for any pointers into the direction where I'm missing something.

Greetings,
Stefan

akuma1x · Oct 23, 2018, 6:33 PM

I think this video might have what you are looking to do.

https://www.youtube.com/watch?v=DL4vMLgBrYI

Jeff

IT_Dept · Oct 27, 2018, 10:48 AM

Hello Stefan,

the ETH1-ETH8 ports of the Netgate XG-7100 appliance are members of a Marvell switch. That switch is uplinked to the pfSense appliance through two internal ports, numbered 9 and 10 respectively. You can see that in one of your screenshots, under "Interfaces / Switch / Ports".

You should edit your port group number 3 (VLAN 200: Guests), and add these two internal uplink ports as a tagged members of your Guest VLAN. That is, the port config for your Guests VLAN should be 8t,9t,10t.

Regards

stb · Oct 27, 2018, 11:37 AM

@it_dept
Thanks a lot. In the meantime I figured that one out also, but you are spot on and that was why it didn't work. I gave your posting a +1, not sure whether the forum here allows to mark a post as "solution".

dreamrae · Nov 2, 2018, 12:00 PM

@it_dept thank you. I've been up for a couple days without sleep trying to figure this one out. The entire site with APs is back online.