Wow.. That title 🙂
So.. My home environment consists of an ESX server running several VM’s including a Sophos UTM firewall.  I also have several ancient but quite usable Netgear switches a GS716T and a GS724T. I also had 3 quite old 802.11n wireless access points providing 2 separate networks within our relatively small home. The other thing was that even though though 2 of the access points are on the same network to provide coverage, I used separate SSIDs which we manually had to switch between because automatic handoff was problematic and simply bad.
This quick guide does not explain:
- Basic networking
- ESX and Building VM’s
- Sophos UTM Firewall
- Setup of your firewall, routing, nat and rule set
- Setup of DHCP per vlan
2 of these access points (DLink DIR-645) were to give coverage at each end of the house and worked OK but had to be manually switched between on each device. Annoying.
1 was to provide coverage for the kids tablets
After having some issues and needing to power cycle the kids AP several times a day and general connectivity issues I decided it was time to upgrade my wifi around the place.
The criteria I had was:
- I wanted to provide multiple networks on each access point
- I wanted to provide better coverage in the house
- I wanted to provide coverage in our backyard area
- I wanted seamless roaming between each access point on all networks
So, I purchased a Ubiquiti UniFi AP-AC-LR unit for in the house and a UniFi AP-AC-Mesh unit to mount outside on my shed facing into the back yard area.
Given the coverage issues with 2 802.11n DIR-645’s I wondered how I would go with just 1 AP in the house, but thought I could give it a go and always buy a 2nd later if i needed it. Turns out I didn’t.
I installed the Unifi Management software on a VM and then I installed the UniFi App https://play.google.com/store/apps/details?id=com.ubnt.easyunifi&hl=en on my phone.  The App on my phone is excellent and shows great information. You can configure nearly everything from the app once you have it installed and talking to your management controller.
I then installed the AP with the included POE unit and then powered it up. As I plugged them into my ‘home’ vlan with my PC and existing gear it was detected immediately and I was able to update the firmware to the latest, set a static IP for the LAN connection and start playing with it.
Issues!
As I mentioned at the top I wanted to support multiple VLANs for my environment. A breakdown of these are:
- vlan 5 – Home Lan (Also default, where my home PC’s live)
- vlan 10 – Home Wifi Network (where all our wireless devices will live)
- vlan 11 – Visitor Wifi Network (Visitors who come over)
- vlan 66 – Kids Wifi Network (Lots of limits on bandwidth, time, sites)
Initially i rushed in, didn’t do much RTFM.  I am a techhead after all and this is just easy networking. Sure, well, the simple things caught me out rushing and late and night and from googling I found many other people were having similar problems. Like all good google sessions I ended up going to bed thinking I might need to buy some new switches as many people reported issues with Netgear switches and Ubiquiti just like me and they wouldn’t work together.  Well, a testament to resting on a problem because I fixed the issue in literally 5 minutes the next day when I thought clearly and with 0 problems. There was NO problems using my very old netgear switches with modern Ubiquiti devices at all.
PVID is important! Heres the gotchya.
The LAN connection for the Access points MUST be on a untagged port. It also MUST be on the same PVID as the controller as per your switch config. If you have this right, your Controller will be able to connect and configure your AP. If you don’t have this correct it simply won’t work.
Here’s the config on my GS724T
The Basic VLAN definitions:
The PVID Settings, this is where you MUST put your controller and all Access points on the SAME PVID. This is the part that confuses people and causes connectivity issues.
In my example, my controller VM is on vlan5 which is also set to PVID 5 and plugged into g12, with the Access Point physically plugged into port g19. You will note that they are both set to PVID 5. This could be any PVID setting, and maybe your default lan is PVID 1, this is very normal, just make sure they are both the same.
Here’s the port settings for each VLAN on the Switch:
The ones relevant here are Vlan 5, which is Untagged on ports with my desktop equipment. Please note note in particular g12 and g19, along with the same PVID, both are untagged ports for Vlan 5. This will ensure the controller can talk to the Access point.
Vlan 10 – Wifi Home – TAGGED on Port 19:
Vlan11 – Wifi Visitors – TAGGED on Port 19:
Vlan 66 – Wifi Kids – TAGGED on Port 19:
Now, what this does is provide g19 wihch is physically connected to the AP with a POE adapter with the following settings:
PVID 5, Vlan 5 Untagged, Vlan 10, 11, 66 Tagged (802.1q trunked)
This is exactly what you need for controller connectivity on Vlan 5 and the 802.1q trunked vlans on g19.
Configuring the AP
So now we have the switch configured we need to configure the AP Wired and Wireless Networks to suit.
First of all each WIRED network has to be defined as in my example, you will note the LAN network is default and cannot be configured with a VLAN, all you can do is set the ip subnet which in my case for vlan 5 is 192.168.1.1/24. This is why it must be on the same pvid and access port vlan as your controller. (I note this is a complained about issue with Ubiquiti so this limitation might be removed in a future update)
You then have to define all the other subnets with their relevant vlan assignment as per my example here for the Kids network as an example:
You can then add the Wireless Networks to suit and also set the same vlan assignment as shown again for the Kids Network below:
Once you have this defined your Access Point will be broadcasting all 3 SSID’s as separate wireless networks as shown by my phone
I repeated the same configuration on the Netgear GS716T switch in the Shed and plugged in the UniFi AP-AC-Mesh unit. Bingo, all 3 SSID’s and networks a broadcasting as well.
With my phone I was able to connect to each wireless network and roaming inside streaming a video to way out in the backyard the phone roamed from access point to access point without skipping a beat with a great signal anywhere I went.
I also used another app on my phone called Wifi Analyzer ( https://play.google.com/store/apps/details?id=com.farproc.wifi.analyzer&hl=en) to see what was happening as per below.
This is a general scan of the 2.4Ghz channels. As we live quite away from others, we’re lucky to have a pretty much free 2.4Ghz range available so standing in my kitchen I can see both Access Points available on Channel 1 and Channel 6.  You will note both are showing the 3 SSID’s and networks available.
This screenshot shows the 3 networks again and also that there’s multiple frequencies available for each SSID
In this screenshot I expanded the Wifi Network SSID and it now shows me all the channels that this network is available on. You can see that Channel 1 (2.4Ghz) and Channel 149 (5Ghz) are the strongest as I’m standing in the Kitchen closest to the AP in the house. The other two on Channel 6 and Channel 36 are from the access point outside on my shed. 
I know I said this wasn’t about setting up the Firewall etc, but here’s a look at how the vlans look on the status page of my SophosUTM. All nicely seperated and doing their own thing with firewall rules separating them all and the internet 🙂
The coverage of the 1 UniFi AP-AC-LR in the house is enough to cover completely inside the house and even outside, the mesh unit giving that extra boost outside. These units are brilliant and absolutely run rings around the older AP’s I had. Highly recommended.
Total success, very happy. Note the Cat5 cable is showing as I’m yet to mount it on the ceiling 🙂
