Unifi AC AP Pro VLAN configuration

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi All,

I'm struggling to get my Unifi AC AP Pro working to send traffic over any VLAN than the default one. I'm using a Brocade ICX 6450 switch and a VyOS router, and I've tested connectivity over all VLANs between the access point and the router, so I'm fairly confident that is not the issue.

My AP gets a DHCP address from the router, but any device that connects to the AP does not seem to get a DHCP address from the router. When I set up tcpdump separately on eth0.100 and phy0-ap1 I did not see traffic from ap1 making its way over to eth0.100.

My configuration is as follows:

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdf5:8b46:ef7c::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'dhcp'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 2 3'
        option vid '1'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0t 2t 3t'
        option vid '100'

config interface 'vlan100'
        option proto 'dhcp'
        option device 'eth0.100'
        option type 'bridge'

And

/etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'pci0000:00/0000:00:00.0'
        option channel '36'
        option band '5g'
        option htmode 'VHT80'
        option cell_density '0'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/ahb/18100000.wmac'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option disabled '1'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'ap5'
        option encryption 'sae-mixed'
        option key '<snip>'
        option network 'lan'

config wifi-iface 'wifinet3'
        option device 'radio0'
        option mode 'ap'
        option ssid 'ap5_vlan100'
        option encryption 'sae-mixed'
        option network 'vlan100'
        option key '<snip>'

I tried disabling the firewall as the AP doesn't really need one as long as the packets are getting tagged properly. That didn't seem to have any effect but here's my current /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option synflood_protect '1'

config zone
        option name 'vlan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'vlan100'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
2

The bridge statement is not valid inside a network interface stanza.

Instead, we need to make a bridge device and then use that for the network interface. Further, if VLAN100 is not used to manage the device, it should not have an address, so we'll make it unmanaged. It will look like this:

config device
        option name 'br-vlan100'
        option type 'bridge'
        list ports 'eth0.100'

config interface 'vlan100'
        option proto 'none'
        option device 'br-vlan100'

If VLAN100 will be used as a management network, you can make the proto DHCP again like this:

config interface 'vlan100'
        option proto 'dhcp'
        option device 'br-vlan100'
3

Thanks! This seemed to work! Fwiw I didn't set this up by making changes to the configuration, I set this up through luci. I'm not sure exactly where I went wrong but that suggests there's a bug somewhere in LuCI with setting up vlans on this device. Any idea where I can report something like that?

4

You can do it via luci, you just have to create a bridge device and then use that device in the network interface.

5

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.