Configuring UniFi APs on VLAN with pfSense router, Cisco switch and Allied Telesis switch

[jlaroche]

We are trying to deploy 10 UniFi AP-AC-LRs in our network and need some assistance. Below I will try to give a precise overview of both our setup and our goal. Please ask questions if anything is unclear.

GOAL:
We’re trying to set up three SSIDs that will be separate from our physical network and also separated from eachother.

What we’ve tried:
We’ve set up VLANs on our pfSense router/firewall. (Note: We closely followed the suggestions of this great Youtube instruction : https://www.youtube.com/watch?v=b2w1Ywt081o ). We also tried to setup trunks on our Cisco switch to our other Allied Telesis switches. All Allied Telesis switches have VLANs setup (see photos below for more details about the setup).

• NOTE:
  All Aps are connected to the Allied Telesis switches. We currently have two in place for testing. They are set up on the 48 port Allied Telesis on ports 26 and 27.

DETAILED OVERVIEW OF TOPOLOGY:

---

SSIDs:
Organization-Guest (VLAN 310) Organization-Student (VLAN 320) Organization-Staff (VLAN 330)

UniFi Controller:
Our controller for the UniFi APs is set up on an Ubuntu Server VM in Hyper-V

NETWORK SETUP:

----------------

pfSense (router/firewall)
ISP to “WAN” --> pfSense --> Internet flows to network via “LAN” port
|
Cisco Catalyst 3650 (24-port Switch)
pfSense LAN --> Port 22 of Cisco 3650 --> Port 24 of Cisco goes out to next switch
|
Allied Telesis AT-GS950/48 (48-port switch)
Port 24 of Cisco --> AT-GS950/48 on port 48 --> Port 47 of AT-GS950/48 goes out to next switch
|
Allied Telesis AT-GS950/24 (24-port switch #1)
Port 47 of AT-GS950/48 --> AT-GS950/24 (#1) on port 24 --> Port 22 of AT-GS950/24 (#1) goes to next switch
|
Allied Telesis AT-GS950/24 (24-port switch #2)
Port 22 of AT-GS950/48 --> AT-GS950/24 (#2) on port 22

---

• NOTE 1: We’re not experts with VLANs and there are quite a few moving parts in this setup. Any assistance/suggestions regarding configuration would be highly valued.
• NOTE 2: Also, DHCP for these VLANS is being handled by pfSense.

[emre]

1.access point
switch ports that are connected
it needs to be trunk

2.

Is routing through PFSense
or through the switch
you do?

If you are going to do it via pfsense
The ap ports on the switch are trunk enough

3. You need to create VLANs on PFSense
and you need to define the ip address for the VLANs you created

4.

port you connect to pfsense switch
I need to trunk

The port you connect to the switch on the access point
I need to trunk

[jlaroche]

The pfSense appliance is our router/firewall.

OK, I want to make sure I am understanding you correctly:

1. The port connecting the pfSense router/firewall to the Cisco 3650 switch (port 22 on Cisco) needs to be set as Trunk.
2. The port connecting the Cisco 3650 switch to the Allied Telesis 48 port switch needs to be set as Trunk.
3. All ports on Allied Telesis switches that connect to the APs need to be set as Trunk.

If this is correct can you please assist with the specific commands we need to input in the Cisco 3650 to Trunk ports 22 and 24? I just want to be perfectly sure we are doing this properly.

Thanks in advance!

[emre]

Have you used a physical port on the pfsense side?
then
You need to physically enter the switche separately


for example
vlan X Guest defined on a separate interface on pfsense
you can enter it in a separate port on the switch
Do switchport access vlan X

[jlaroche]

Sorry emre, but your comments have been incredibly difficult to understand and all-around unhelpful