Showing results for 
Search instead for 
Did you mean: 

Configuring UniFi APs on VLAN with pfSense router, Cisco switch and Allied Telesis switch

Level 1
Level 1

We are trying to deploy 10 UniFi AP-AC-LRs in our network and need some assistance. Below I will try to give a precise overview of both our setup and our goal. Please ask questions if anything is unclear.


We’re trying to set up three SSIDs that will be separate from our physical network and also separated from eachother.


What we’ve tried:
We’ve set up VLANs on our pfSense router/firewall. (Note: We closely followed the suggestions of this great Youtube instruction : ). We also tried to setup trunks on our Cisco switch to our other Allied Telesis switches. All Allied Telesis switches have VLANs setup (see photos below for more details about the setup).


  • NOTE:
    All Aps are connected to the Allied Telesis switches. We currently have two in place for testing. They are set up on the 48 port Allied Telesis on ports 26 and 27.


Organization-Guest (VLAN 310) Organization-Student (VLAN 320) Organization-Staff (VLAN 330)


UniFi Controller:
Our controller for the UniFi APs is set up on an Ubuntu Server VM in Hyper-V



pfSense (router/firewall)
ISP to “WAN” --> pfSense --> Internet flows to network via “LAN” port
Cisco Catalyst 3650 (24-port Switch)
pfSense LAN --> Port 22 of Cisco 3650 --> Port 24 of Cisco goes out to next switch
Allied Telesis AT-GS950/48 (48-port switch)
Port 24 of Cisco --> AT-GS950/48 on port 48 --> Port 47 of AT-GS950/48 goes out to next switch
Allied Telesis AT-GS950/24 (24-port switch #1)
Port 47 of AT-GS950/48 --> AT-GS950/24 (#1) on port 24 --> Port 22 of AT-GS950/24 (#1) goes to next switch
Allied Telesis AT-GS950/24 (24-port switch #2)
Port 22 of AT-GS950/48 --> AT-GS950/24 (#2) on port 22

  • NOTE 1: We’re not experts with VLANs and there are quite a few moving parts in this setup. Any assistance/suggestions regarding configuration would be highly valued.
  • NOTE 2: Also, DHCP for these VLANS is being handled by pfSense.


Cisco Port 22.jpgCisco Port 24.jpgpfSense VLAN setup.jpgUniFi Controller Guest SSID Config.jpgUniFi Controller Network Config.jpgUniFi Controller SSIDs.jpg

4 Replies 4

Level 1
Level 1

1.access point
switch ports that are connected
it needs to be trunk



Is routing through PFSense
or through the switch
you do

If you are going to do it via pfsense
The ap ports on the switch are trunk enough
You need to create VLANs on PFSense
and you need to define the ip address for the VLANs you created
port you connect to pfsense switch
I need to trunk
The port you connect to the switch on the access point
I need to trunk

The pfSense appliance is our router/firewall.


OK, I want to make sure I am understanding you correctly:

  1. The port connecting the pfSense router/firewall to the Cisco 3650 switch (port 22 on Cisco) needs to be set as Trunk.
  2. The port connecting the Cisco 3650 switch to the Allied Telesis 48 port switch needs to be set as Trunk.
  3. All ports on Allied Telesis switches that connect to the APs need to be set as Trunk.

If this is correct can you please assist with the specific commands we need to input in the Cisco 3650 to Trunk ports 22 and 24? I just want to be perfectly sure we are doing this properly.


Thanks in advance!

Have you used a physical port on the pfsense side?
You need to physically enter the switche separately

for example
vlan X Guest defined on a separate interface on pfsense
you can enter it in a separate port on the switch
Do switchport access vlan X

Sorry emre, but your comments have been incredibly difficult to understand and all-around unhelpful

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card