VLAN Trunking with Ubiquiti APs?

[robertramsey]

Hello,

I’m having an issue where wireless clients can’t access the wireless guest VLAN (25), SSID “Olivine”.  Clients are able to connect to the wireless guest network but are unable to pull an IP from the DHCP server on that network.  I have Ubiquiti U6-LR APs connected to Cisco 2960G switches.  I'm using an ASA 5506 for interVLAN routing.  I’m using the Cisco SPAN feature to monitor VLAN 25 with Wireshark.  I’m also using Wireshark on a client, attempting to connect to the guest wireless.  On the wireless client, I can see DHCP requests but no replies.  On the SPAN, I don’t see any traffic at all on VLAN 25.

Ubiquiti equipment requires that trunks be configured with a native VLAN that has access to the Unifi controller in order to provide status and receive updates.

Note that wireless clients can connect to the inside VLAN (100/native), SSID "Ramsey", pull an IP, and utilize the network normally.

Below, I've attempted to provide all the relevant information:

Unifi Controller Version

Ubiquiti AP Firmware Status

Unifi VLAN Configuration

Unifi WiFi Configuration

Inside Cisco 2960G Switch Interface Configuration

Inside Cisco 2960G Switch Interface Status

Outside Cisco 2960G Switch Interface

Outside Cisco 2960G Switch Interface Status

Cisco ASA 5506 Interface Configuration (ASDM)

Cisco ASA 5506 Interface Configuration (CLI)

Cisco ASA 5506 DHCP Server Configuration

Network Diagram

Unifi Hyper-V VM Configuration

[elom.kutsienyo]

Hello Robert,

I suggest you add VLAN 999 to the allowed VLAN list on the two switches. 

The second thing is that because the unifi software is running as a VM and yet is suppose to do VLAN tagging, there are a few things you need to do at the hypervisor level. The first step is to Enable Virtual LAN Identification (the VLAN you input will be tagged on the physical cable).

Kindly check this article and ensure your hypervisor is properly configured to allow the nested VM to tag.

https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/deploy/configure-virtual-local-area-networks-for-hyper-v

[robertramsey · Accepted solution]

After a lot of trouble-shooting, I found my issue.  I recently replaced the 2960G and copied in the old config.  Copying in the config doesn't create the VLANs in the vlan.dat though.  I had to manually create the vlan.dat entries

conf t
vlan 25
name Guest
vlan 50
name DMZ
vlan 100
name Inside
end

[elom.kutsienyo]

Awesome. It is great you were able to fix it.