How To Setup VLANs With pfsense & UniFi 2023

[@LAWRENCESYSTEMS]

Configuring pfsense Firewall Rules For Home kzbin.info/www/bejne/mJvVYaWjbpiojKM 2020 Getting started with pfsense 2.4 Tutorial: Network Setup, VLANs, Features & Packages kzbin.info/www/bejne/nKTHnmirmMR_qbc The Best Diagramming Tool "Diagrams.net" kzbin.info/www/bejne/o6GpYpxvqMt4gJI en.wikipedia.org/wiki/IEEE_802.1Q ⏱ Timestamps ⏱ 00:00 VLANs With pfsense & UniFI 02:00 IEEE 8021.Q VLAN 101 Basics 05:54 pfsenwse UniFi Network Setup 08:50 Defining VLANs in pfsense 10:17 Defining VLANs in UniFi 14:27 Using VLAN to create switched networks

[@twitchcoolbob66]

So, as someone who might be getting fiber in soon. This all works the same if you have fiber in for WAN and then use fiber to connect to the switch for lan? Also, having this set all wouldn't cause some stuff to go to igb2?

[@terryrodbourn2793]

All I know what did as Network Engineering for 35 years I crated VLANs in routers setting up battle tents in both the 2nd Gulf War and other places it become routine for me in Cisco routers!

[@randleqgod]

I started using PFsense last year and haven’t looked back. That appliance is a straight up beast. I love the policy routing capabilities.

[@dakodacat]

I am literally going through the process of setting up PfSense & a self-hosted Unifi Controller right now for my home network. This is exactly what I was looking for; What a coincidence!!

[@danimoosakhan]

VLAN tagging is little confusing when u are first starting out. But once u understand the true concept, it becomes your bread and butter. One of the most important thing to understand is how switch is treating Tagged and untagged traffic. If u only assign one vlan to the switch port, that vlan is native/untagged on that port only. There can only be ONE native/untagged vlan on a port meaning u can’t have more than one untagged vlan on one port. In a corporate world for security reasons, u only tag certain vlans on port that are needed on that port, this means u don’t just tag ALL vlans like UniFi does. Tagging ALL vlans on all ports does make your job easier but at the cost of compromising security. I would only do this if the link is between the switches and both switch needs to have access to same vlans.

[@jackwilson4863]

And you should tag all vlans to the port connected to a router that would assign a subnet to each vlan for inter vlan routing. Unless you’ve got a L3 switch.

[@MegaMaskedrider]

Yeah i´m just at the point of having absolutely no clue anymore with opnsense and unifiy config... xD

[@dogphilosopher0]

Where was this video yesterday when I was setting up VLANs with my PFSense and UniFi Equipment? In all seriousness, thank you so much for this!

[@benjaminrathjen152]

Thanks very helpful, could you go over radius authentication with PFsense and Unifi? Much appreciated

[@rjy8960]

6:35 - The internet pictorial :) Nice nod to the IT Crowd! Everything I know about pfsense has been from watching your channel, Tom. Thank you!

[@UKprl]

This is pretty useful as a way of introducing how VLANs are handled in pfSense and UniFi and what happens when you connect them together (on a trunk port). There are a couple of caveats though. Firstly at 14:27, be aware, because of the port profile ALL that the traffic for VLAN 10 is also being sent tagged to igb2, (which pfSense will have to discard) as well as being native traffic on igb1. If you want to exclude VLAN 10 from igb2 you need to create a port profile that contains only the desired VLANs (tagged and optionally for native) to match what you have setup on pfSense on the trunk. Secondly, pfSense themselves recommend you do not setup a network on the parent interface (i.e. native frames) when using vlans, for reasons (relating to how the NICs actually process the tagged and native traffic arriving on the same physical interface to assign to the logical interface in pfSense). Because of this when using UniFi with pfSense and without a UniFi gateway, I don't use the default network they call Corporate at all, and setup a VLAN explicitly to handle management traffic. This means the switch ports facing UniFi access points are given a port profile that is not ALL, but send the new management VLAN natively and tag for all the other SSIDs. This has the added benefit of not flooding broadcast frames to a Wi-Fi access points for VLANs for which there is no Wi-Fi SSID (e.g. wired-only VLANs).

[@UKprl]

Related to this is why I also don't use VLAN 1 on any of the switches. When Ubiquiti designed UniFi they reserved VLAN 1 for internal use. (Effectively it is also assigned it to that Corporate network, but in a way that is not obvious when using the UI). They also prevented you using tagged VLAN 1 for any SSID because of this design choice. This had a nasty side effect of making it difficult to convert any installation from flat unmanaged switching to UniFi without replacing all the switches right away, because VLAN 1 (and management) would effectively be exposed natively on all legacy switch ports as well as trunk links if doing a phased deployment. Actually VLAN 1 frames are not anything special and you should be able to use any VLAN ID from 1 through 4094 (0 and 4095 are the reserved IDs). However other vendors are also known for assigning special uses to VLAN 1 so you might be better off avoiding it completely when scaling out and including switches from more than one vendor, unless you know exactly how it is treated.

[@propeto13]

Tom, thank you for your insight. I created a 4 port 'lagg0' in/on pfsense. On the switch 'cisco' i configured a 4 port 'port-channel' and trunk all traffic.

[@npham1198]

Also get into the security aspect of vlans, such as creating a "blackhole" vlan on the switch trunk/uplink, etc!

[@TechySpeaking]

Well, that was more confusing than I had originally hoped, trying to get my VLAN from pfSense to Unifi. Turns out I was overconfiguring it. Thanks for the helpful video Tom!

[@DanAllen1]

Thanks so much for doing this. I just made the jump from USG to pfSense and this is perfect timing.

[@EduardKondratyuk]

Set up my pfsense box last week, getting my ubiquity switch soon, perfect timing on video. Thanks for these informative tutorials!

[@devoid42]

I have a very similar setup but I defined my connections between my pfsense and the switch as a LAG(LACP) group(using 3 ports), and pass tagged traffic between the switch and the pfsense. Which gives me the ability to utilize more bandwidth on one vlan, while still having availability for a smaller vlan when it needs it.

[@alexsinbb]

Is that what I'm describing in my post? Is that the name for it, LAG (LACP)? I also have 3 ports on my router plugged to the same switch.

[@Oldmandoom95]

I swear you're psychic with these releases... The past 5 videos have all been stuff I've been working on as you release them! Excellent tutorial as always Lawrence

[@franciscos.5839]

at 13:20 I agree with you...they need to fix this asap it was so annoying to trying configure a port I was looking everywhere and sure enough I had to scroll to see the VLANS.

[@richardkeating2760]

Thanks Tom. I think my pfSense is a different model than yours. My igb2 is only 100Mb. I was having a problem with setting up my VLAN on Unify/pfSense and watched your video 3 times. I could see DHCP Discover and Offer coming into pfSense VLAN port but no Request or Ack. Boot/reboot and finally decided although port shows lights changed the cable and voila, all working. Thanks for making it clear so at least I knew I had it right.

[@SyberPrepper]

Very helpful Tom. I just got a new USW Pro 24 PoE switch and was needing to know how it works with PFsense or OPNsense. Thank you.

[@therealdjflip]

Getting back into PFSense, so this is very helpful, as in the process of ordering a dream machine

[@mattparksey]

Thank you for this video. I've been using the basic setup for a while. I've been having issues with the AP stability as the uptime never supasses 1 day. I notice when I turn on a second SSID, the load on my AP goes from 0.03 to above 1.00. I'm now testing a USW-Lite-8-POE in place of my dlink managed, but still experiencing the increased load.

[@Elliot9874]

Perfect timing. I am building my Pfsense tonight. Thank you Tom!

[@nerdegem]

In case anyone needs this, if you're using VMWare ESXi with pfSense, you have to set the vLan to 4095 (trunked) on the VMWare Port Group. This is different behaviour to my experience with the Ubiquti edge switch where the vLan PGs were set to 0 and the traffic still flowed.

[@AnIdiotAboard_]

Could have done with this a few weeks ago. Installed Starlink for a mobile home community, every van was cabled (not a massive site 20 users) Each van on its own vlan, with a Catalyst 10G switch to PFSence. Getting PFSence to play nice vlans was a propper BALLACHE, still its done, they all get there 8meg garanteed and they all get upto 200mbps burst. Not bad really when you think about it $75 install for each van coveres the hardware cost, and $100 a month split 20 ways = $5

[@RobertTaylorRTC]

Tom - Your videos are one of the best sources of information regarding networking with pfSense and Unifi. I truly appreciate your efforts. In this video where you selected the second native NIC from pfsense, I totally get that segregation on the Unifi side. However, on the first "all" vlan feed from pfsense - wouldn't that also include the vlan 60 group traffic into that vlan 50 traffic mix? I get vlan 50 would not go into vlan 60 but since vlan 50 is "all", it includes all the vlans defined on Unifi. At least on my Unifi contoller shows it this way. If my object is to truly separate the traffic, wouldn't I need to redefine the native vlan to exclude vlan 60?

[@udoloske]

Hello Tom, first of all thank you for your very informative videos. I currently have a UDM-Pro, a US16-150W switch, a U6-Pro, an AP-AC-Pro and an AP-AC-M. My networks consist of the main Lan, a guest network, an IoT network and a camera network, but only one NVR from another manufacturer is connected to it. But I would like to use a pfsense in the future, but I'm not sure whether I should use the pfsense in addition to my UDMP, or replace the UDMP completely with the pfsense. What would be your recommendation in this case? Many greetings from Germany

[@Ussie284]

Thank you so much for this content. It has increased my enjoyment (and ease) with building and expanding home projects.

[@ChrisSchwarck]

Having a fun time trying to figure out if VLANS will work with my set up. Main host is ESXi 6.7.0 Update 3, with a PFSense vm as my main router, and the Unifi Network Controller hosted on another vm as a docker container (on the same ESX box). So far, no luck. PFSense is showing no traffic on the VLAN. Checked the VLAN tags, etc., as provided in this video, so I think somewhere in all of the virtualization, something is not VLAN aware.

[@mujahidjaleel]

What if I don't have a USG or any switch plugged in between the pfSense and the UniFi AP? I have a proxmox server with extra nics running a virtual pfsense edge router. How would one go about setting up multiple vlans to multiple SSIDs?

[@iainmcmullen414]

I'd love to see something on QoS of VLANs with pfSense and UniFi. We've been able to define the VLAN priority within pfSense, however it doesn't look like we can define the priority within UniFi.

[@Chris-on5bt]

My dude, you know exactly what I need in life, thank you!

[@Foiliagegaming]

Thank you guys for all the great and educational content. I was wondering if there would be a reason that you wouldn't use one of the 10Gb ports for trunking.

[@mattclifton76]

Will this type of setup work with the dream machine pro?

[@zomgoose]

My understanding is ALL is a Trunk Port in Ubiquiti. Setup a trunk port if you are using another brand of switch.

[@RKGraves]

Excellent Tutorial - Thank You!

[@donnielewis186]

Any tips for VLAN and Fortigate? Also what software are you using for the diagrams? It could be useful in teaching my team!

[@LAWRENCESYSTEMS]

I don't use Fortigate and Diagrams.net kzbin.info/www/bejne/o6GpYpxvqMt4gJI

[@clayton5586]

Could you cover pfsense along with ubiquiti layer3 switching?

[@MrMackster01]

Great video! thank you! Dumb question- where would the UDM pro go in this scenario? i have a UDMP accepting my internet /WAN traffic and then connecting to a Unifi Switch! Any suggestions would be appreciated

[@LAWRENCESYSTEMS]

kzbin.info/www/bejne/hZ7QY6OHiq-CZtE

[@ramachandrankrishnamoorthy95]

Hi Sir, This video is really helpful for us to understand how we connect PFSense with Ubiquiti Layer 3 Switch. However, is it possible to use Cisco ASA instead of PFSense?

[@LAWRENCESYSTEMS]

Yes

[@ramachandrankrishnamoorthy95]

@@LAWRENCESYSTEMS Thanks. Should I follow the same procedure for ASA as well. Correct?

[@KirkSakamoto]

What are you running the Unifi controller on? Is it a cloud key or hosting in the cloud. I have a similar setup but having a problem of how to attach and access the unifi controller. Any help would really be appreciated. Thanks.

[@steffenskovmoller]

Thanks for the video Tom. Maybe a video, about dynamic assigned vlan based on radius login.

[@Vadinaka]

Sorry Tom for my question. I am a huge fan of your work and long time follower. I am about to buy a new screen. May I ask the references of the one behind you please?

[@JeppoTheWrecker]

Hi Tom, I have an idea for a video for you. I have a Unifi VLANed network with pfsense and a cloudkey controller. I wanted to extend the number of network points at a remote location on the network with another switch and all the connections are on the iot network, the cloudkey is on the main network. The switches I choose were the flex minis, as cheep and available. But how to get them to communicate. Happy to discuss with more detail.

[@LAWRENCESYSTEMS]

I have a video on that topic and the cloudkey is not ideal due to it's limitations of how many devices. kzbin.info/www/bejne/n6G0coacbcibd9E

[@sebastianzak9563]

Lawrence, will you make new Video with Unifi 8.1.113 version ?

[@j2theay]

Tom are you typically deploying pfsense/UniFi with layer 3 switches?

[@LAWRENCESYSTEMS]

Yes

[@Brother-Luke]

Thanks for all your videos Tom. They are very helpful and well presented. I was wondering, what software do you use to build your network diagrams?

[@LAWRENCESYSTEMS]

The Best Diagramming Tool "Diagrams.net" kzbin.info/www/bejne/o6GpYpxvqMt4gJI

[@corneaccount9778]

Option 2 does not work for ssids:Unify ap port 7 default lan on a tplink switxh and port 9 from switch to opt por, port 9 untagged vlan 10 and port 7 ap tagged in vlan 10 because of the ssid vlan 10 must go through? Must the uplink port to lan pfsense also be tagged in vlan 10 on tp link switch?

[@Nvious1]

Could you do a follow-on video that will do pfsense - unifi dynamic vlan using radius authentication (user / MAC) with a single SSID? I would like to keep my wifi with a single SSID, but be able to send things like IoT (via MAC) into a vlan.

[@mikemartin101]

In the second configuration, where you've fed in NSFW_NET into a separate port, do you need to then set the other ports to specific networks? If they're setup for all, wouldn't they somehow get the NSFW_NET traffic too?

[@speedup070605]

Thank you for very informative video. Love your work mate. Also do you have any poll that we can vote for your next video or we just drop in the comments?

[@LAWRENCESYSTEMS]

My forums are the best place forums.lawrencesystems.com/c/site-feedback/3

[@edwinkm2016]

Hi Tom. Still confused about default and native vlans. Also experience with vlan hopping? My setup works but I am not sure if it is really secure.

[@samsampier7147]

Not Tom, but native vlans are just untagged vlans on a particular trunk. Default VLAN is simple a VLAN created at the factory for you. Most vendors use VLAN 1 as default. VLAN hopping is a thing. Secure systems use a unused VLAN for the native vlan (something easy to remember like 999).

[@edwinkm2016]

@@samsampier7147 if I understand correctly. My important lan is now without vlan. All less privileged networks are vlans on this same interface. Are there risks people can jump to this untagged network?

[@williamp6800]

@@edwinkm2016 VLANs are not inherently less privileged. By default, VLANS only inherently provide logical separation of connections. The rules you apply (or don’t apply) to each VLAN determine the degree of separation, and thus security, between VLANS. For example, if you created VLANs in pfSense but did not apply any rules, you could jump between all the VLANs without any restriction. Just type in the IP address and you’re there. And because pfSense implements “best practice” defaults, none of the VLANs would be able to access the Internet. They would function only within your local network. You need to add a rule and explicitly give Internet access to a VLAN. As for default and native VLANs and the tagging that goes with them, that still confuses me so I can’t help you there. After I rebuild my pfSense installation this week, I might be able to add something on that.

[@shetuamin]

Can you make a video for block udp flooding port 1900 form smart tv?

[@JohnSmithIam]

Do you have a recommendation for a home network using a managed Unifi switch?

[@LAWRENCESYSTEMS]

Yes, use the UnFi switch that fits your budget and use case.

[@Gevs90]

Hi, thanks for video. Can I use the scenario without USG ? I mean, if I host Unifi network application on my own server, can I set on single port multiple VLANs ?

[@LAWRENCESYSTEMS]

I did not use a USG in this video, so yes

[@Gevs90]

@@LAWRENCESYSTEMS thank you 😊

[@papypom]

Well, thank you, this is exactly what I was looking for. Using OPNsense with TP-Link Omada, but as OPNsense is a fork of pfSense, and Omada a rip-off of Unifi, the video remains valid :)

[@ncurses]

nice vids! one question though. do pfsense have a webserver "virtual hosting" capability. like in sophos?

[@LAWRENCESYSTEMS]

It has HAProxy support.

[@duncan-mcrae]

How would you integrate a Synology NAS that was used to stream to a TV and store work stuff on when you have the iot on a NSFW lan?

[@daleweaver777]

Tom, do you feel UTM devices like Watchguard with their security subscription are worth it? Or would you prefer to use pfSense and then increase endpoint secruity software like Huntress?

[@LAWRENCESYSTEMS]

The endpoint is where all the bad things happen so that is the first place to focus.

[@daleweaver777]

@@LAWRENCESYSTEMS thanks for the reply. That is what I was thinking. Also so much traffic is HTTPS now days and I don't have the Watchguard setup to be able to decrypt to inspect and then re-encrypt. So I'm not getting a lot of the benefits from an edge device doing everything. Probably better to use the money towards better endpoint security.

[@AnterosLive]

Is it possible to make a USG4Pro work WITH pfsense? I do like the unifi environment and wish it was easier to use both.

[@LAWRENCESYSTEMS]

Not sure why you would want to but you could double NAT them

[@big-g4785]

Could you go a step further explaining how you could define SSID's bound to VLAN's that then via Radius or other auto switch based on the MAC address of the end user WiFi devices. Simplified 4 VLANS bound to 4 SSID's (VL10-VL20-VL30-VL40), based on a clients MAC Address it would automatically connect to the correct VLAN irrelevant of which SSID they choose. Use case: VL10 is for Ops Engineers or External Maintenance, VL20 is for General Office Workers, VL30 is for RnD Department & VL40 is for Guests, based on the MAC of the devices they use they would automatically be put onto the correct SSID regardless of which SSID [Maintenance; Office; RnD; Guest] they selected.

[@LAWRENCESYSTEMS]

MAC addresses are easily changed so this is not a good way to attest to which devices should be on which network.

[@vm4463]

Good content, keep it coming.

[@TheAxtn8r]

Thanks for the video Tom! How does UniFi handle VLANs between switches? Say I had a port on one switch with a profile that trunks VLAN 2, 4, and 6 going to another separate UniFi switches port with the same profile, would the traffic going between the switches be tagged so that the second switch could transmit data to ports with profiles for the individual VLANs?

[@LAWRENCESYSTEMS]

The connection between switches needs to be set to ALL on both switches.

[@FSUGrad1999]

Hey @Lawrence Systems, I'm trying to make the switch to pfsense from a USG-3p. After I get all my networks and VLANs defined in the pfsense box, I'm assuming I need to go into Unifi controller and change all my networks to be VLAN only. Is there anything else I might be missing? PS. IPv6 is very easy to disable in UniFi Controller, but I'm not sure how to do it correctly in pfsense. Any chance you could touch on that in a future video? Thanks for all you do great stuff.

[@markGibby]

ok i got the vlan setup on unify and pfsense but you didnt cover how to configure the ip or anything.. what IP does it get and how do you set that?

[@andrevanvlaanderen6666]

Very interesting, thanks. P.s. You forgot the first e in the #pfsnse.

[@CampRusso]

🤔 what if I want to replace my USG 3P with pfsense? I also have a self-hosted controller plus USWpro24 and UAP AC Pro. I'm only using the default vlan. I have only the basic settings. Should I just create a new site in Unifi and move over the switch/ap?

[@Jonny_O]

I thought the Internet was wireless? That's what Roy and Moss told Jen, at least. 😀

[@PJBhm]

So, port 16 and port 24 are trunk ports. Am I right ? thanks !

[@rjdp3]

Thanks Law, you rule 😎

[@GregE9981]

I would have setup vLANS on a LAGG once it got to multiple physical interfaces out of the pfSense. Plus it adds a little tolerance to the network if one of the cables or physical interface went down, traffic would still flow. just my 2 cents.

[@geovanivaleriosanchezelgio1397]

cual es el modelo de unifi que hace capa 3 para hacer ruteo estatico vs pfsense ?

[@Acinuter]

Hi Tom, thanks for the video. I have a follow up question / clarification needed. For the 'advanced' scenario with the NSFW vlan. As I understood, main uplink port from Unify switch is set as ALL - meaning it will route ALL vlans to the pfsense, regardless of the vlans setup, right? And traffic from Marcus PC will arrive with its vlan tag on Unify switch, and the idea is that it will get routed to pfsense ONLY via a secondary unify port setup on the same vlan. Question: what prevents the "main" upling to catch that route - as it is configured as ALL, so it could route all vlans to pfsense.

[@LAWRENCESYSTEMS]

When a port is set to ALL it makes ALL VLAN data come to that port and it is up to the device to use or disregard that data. In the case of most computers they only use the native network data.

[@aednichols]

@@LAWRENCESYSTEMS thanks, this was an important missing piece for me!

[@Ace-n3t]

This was like a unifi ad

[@guilhermeb7615]

How you can connect Unifi to manage a remote network? I've trying setting up a VPN but doesn't seem to have an option to tell Unifi to look for that particular LAN... thanks

[@ramosel]

Tom, do you do any work with OpenWRT? I've been looking for this type of information using pfSense and the new OpenWRT VLAN filtering to accomplish this same work.

[@LAWRENCESYSTEMS]

Nope, I don't use OpenWRT

[@ramosel]

@@LAWRENCESYSTEMS Thanks, understandable.

[@simritathwal4020]

So I have a scenario that I don't know the specific terms for. I have two networks, both without unifi routers but utilizing unifi switches after the router. Network 1 is Bridge Network (192.168.1.x) and Network 2 is Building Specific Network (192.168.30.x). My goal is to use one switch and give specific ports bridge network and the rest non-bridge network instead of having a separate switch for each network. Would I have to create the vlan within my router (Fortigate) and as well as on my unifi controller or do I just do it on the unifi controller? How do I go about this?

[@siavashsabouritabatabaei6526]

thank you

[@sheldonfaria]

reminds me of a friend who tells me more than i need to know.

[@AnonymousB460]

Do you have one for pfsense and omada?

[@LAWRENCESYSTEMS]

No, but Omada is a close to UniFi in they way it works so the same should work.

[@kyopan23]

Can I just define VLAN 10 in pfsense on the second example?

[@maxmustermann9858]

So is it possible to define 4 networks in the pfsense and and have two VLANs over one Interface and the other 2 over the other? So by that I mean is it possible to have multiple tagged VLANs over a interface on but not all? My use case: I have a pfsense and a UniFi switch in the main house. From there I connect multiple access points „VLAN 1“, security cams „VLAN 100“ also I make a connection to the garage where I have an extra switch which only needs an uplink to the main switch for VLAN 100 the Cam network and an extra VLAN 110 for the door access. So is this possible to have two VLANs tied to one port but not the main VLAN 1?

[@LAWRENCESYSTEMS]

That should work

[@bossman762x39]

can this be done with a udm pro for unifi and a netgate 4100 for pfsense? right now i am using a udm pro in a fully unifi network but i want to jump into pfsense, i like both. i want to get into pfsense for HA and the firewall and to get familiar with it as a whole. can i keep both with these devices?

[@LAWRENCESYSTEMS]

Yes, but I don't think it's a great idea kzbin.info/www/bejne/hZ7QY6OHiq-CZtEsi=PTQuj4hxQUIOVJmk

[@per-mortenevensen941]

I have a netgate 1100 an use bouth opt and lan ports from it to 2 different switches, vlans 10,20,30,40 out as trunk on both ports. Is that any problems?

[@SteeleDaMan]

Please do a similar video but for Tp link Omada! I have an Omada switch and WAP with pfsense and I can’t get vlans set up and I’m not sure why

[@LAWRENCESYSTEMS]

Not likely but their interface is very close to UniFi.

[@ajugland]

How do you setup Unifi Dream Machine for gaming. Possible to make one VLAN and open all ports? Looks like its blocking voice in fortnite

[@jamescater66]

Do you need to set up an "All Except NSFW" profile for the main trunk so that VLAN 10 traffic doesn't get sent back down the main trunk (only to be thrown away by the router)

[@LAWRENCESYSTEMS]

I don't need to.

[@matthewjohnson1511]

What do you have your “ Management Network” set to? I have experienced much grief without a true understanding sometimes of how I made something work with using Sophos as you do Pfsense and multi site self hosted controller. The “management network” has caused me several all nighters. Ugh.

[@LAWRENCESYSTEMS]

default

[@matthewjohnson1511]

On a 20-30 site controller that has physically different locations in different cities do you keep the default for the Management Network? I was trying to pass a VLAN from non Unifi Firewall for Management VLAN for each site that matched the IP scheme for the site. Maybe that’s wrong 🤷‍♂️?

[@LAWRENCESYSTEMS]

@@matthewjohnson1511 Put the UniFi devices on the default / native network and all the other networks in VLAN.

[@TheAncientSpirit]

At 14:00 Tom set port 1 port profile CAM_LAN (id 60) does that mean that port 1 is now what is usually refered as "access" port for VLAN60 or is it "trunk"? How would you set e.g. port 2 as trunk that would route only VLANs 3 and 4?

[@LAWRENCESYSTEMS]

PORT 1 Is set to CAM_LAN (id 60) which means it ONLY connects to that network and NO other networks come from that port.

[@Justin-lt3jt]

For someone not concerned with saturating pfsense interface ports (internet speed is way less than gigabit), is there still value/reason for the dedicated opt switched networks? Besides for fun.

[@williamp6800]

There are two issues. One is saturation of the WAN interface which is limited by your ISP connection. The other issue is saturation of your LAN. If local traffic within your network is exceeding 1GB, using a separate physical interface will physically separate some the local network traffic. If the traffic doesn’t need to move between the two physical interfaces, performance would improve.

[@dpscribe]

Next video hope lesson on Inter-V-Lan routing.

[@LAWRENCESYSTEMS]

Already did that video kzbin.info/www/bejne/jaKkopiJadl3gpo

[@FPol-if6bm]

what is the difference between vlan only, and just select vlan in the network?

[@LAWRENCESYSTEMS]

As I said in the video, VLAN only does not define the networks in the UnFi routing equipment.

[@berndeckenfels]

Does Unifi also allow tunnels to controllers for level 3 roaming with vxlan or wlc-tunnel CAPWAP?

[@LAWRENCESYSTEMS]

Not that I am aware of.

[@zubair5244]

is it possible to connect more than 400 users concurrently with unifi dream machine actually when we connect here machine got jammed therefore another unifi dream machine is installed but we may need to connect more than 1000 users which is not possible with our UDM pro controller because it is not supported

[@andrewagredano9968]

It it possible to run a UniFI 6LR to pfsense without a switch. Just a simple design. I ask because I cant seem to set it up myself. I currently have a old AP-AC-Pro what I want to switch out but cant seem to figure it out. Any clue as to where im failing

[@WarpedFlayme]

So with a Unifi switch, is it accurate to say that the a port with a single-network profile set produces untagged packets while a port with a multi-network profile (such as "All") produces tagged packets?

[@LAWRENCESYSTEMS]

The UniFi switch does not produce the VLAN packets but it does parse the data going to the ports based on them.

[@WarpedFlayme]

@@LAWRENCESYSTEMS Sorry, by "produce", I just meant "comes out of", not "generates". I know the end devices are generating the data that is being shuttled about.

[@thesir6556]

Lawrence, if you're hiring for jobs in Michigan let me know!

[@alexsinbb]

Is it possible to set VLANs only at the UniFi switch level using dedicated untagged ports so that my LAN IOT traffic doesn’t hairpin at IGB1 thus halving the bandwidth. I assume in this scenario that the bandwidth of the switch is > 1Gbps total which is the case for most UniFi Switches.

[@alexsinbb]

​@SuperWhisk There are still two physical connections going to the router. Example IGB1-LAN, IGB2-IOT with separate ethernet cables going to separate ports on the Unifi Switch. The switch port receiving IGB1-LAN is Profile "LAN". The switch port receiving IGB2-IOT is set to the Unifi defined Native Network for IOT (20) which has been configured as VLAN 20 in the Unifi side (not the pfSense side). In this fashion, traffic between LAN and IOT can reach 1Gbps instead of 500Gbps when you use VLANs on the same router port. Unifi will tag all the IOT traffic as VLAN20 and then both subnets can talk over the same switch. Traffic between LAN and IOT will leave the switch and run through both wires and both IGB1-2 ports. Otherwise in the classic use of VLANs on the same IGB1 as described in this video, the traffic between subnets is limited to the speed of the single router port hair pinning on itself. Yes I have rules between subnets to allow specific media high bandwidth traffic. In my scenario, the media server is on LAN, but all the media consuming devices are on IOT.

[@liberty-vf4bi]

Where do you get the custom images you use in the diagrams?

[@LAWRENCESYSTEMS]

Google image search.

[@liberty-vf4bi]

@@LAWRENCESYSTEMS 😄 Yes, Ok. But these are just normal images. How do you then get the "custom connectors" and opacity (no white space) seen in most of the images used in your diagrams?

[@LAWRENCESYSTEMS]

@@liberty-vf4bi Those are built in ones

[@itxgod3946]

I ran into problems :( My Unifi APs are connected to an unmanaged POE switch, which I believe is preventing my vlan experiment.

[@StevePatak]

Hmmm...I was just thinking about why I didn't actually define all my VLANs in Unifi when I first got my system set-up. I don't have a good reason other thank Unifi sees all the VLANs and I can set each port as needed. Should I bother explicitly defining them within Unifi?

[@LAWRENCESYSTEMS]

If you don't need them, then don't set them up.

[@StevePatak]

@@LAWRENCESYSTEMS I guess my question is, and maybe I missed it in the video, is there anything gained by defining them? Does it improve anything?