OC200 Purchased

OC200 Purchased

27 Reply
Re:OC200 Purchased
2024-02-23 21:24:23

  @bigal_12ms 

 

The controller will let you set up ACL at Gateway/Switch/AP.  You will be most successful implementing your ACLs at the Switch level.  Your Pfsense will ignore anything you try to do a as a Gateway ACL of course!

 

Also, your camera POE switch #4 is 'dumb switch' so it should be plugged into a smart port on switch #3 (and all policies/vlans/acls on that port will then apply to every port on Sw#4 at least wrt the rest of your network)

<< Paying it forward, one juicy problem at a time... >>
  0  
  0  
#22
Options
Re:OC200 Purchased
2024-02-25 18:22:55 - last edited 2024-02-25 18:47:46

  @d0ugmac1 

Ok everything adopted and works well .

 

 I changed OC200 to Ip 192.168.1.XXX.. Everything works on that subnet 1.xxx. Once I create Vlan Interfaces and wireless Interface, The OC200 Controller becomes very unstable and starts shutting down switches. I get heartbeat and disconnected issues. The Vlans have not been activated. If I activate a vlan on 100 and set the profile to the correct Tagged port and Untagged port. Even setting the port assigment Loses internet all together Things go haywire. The controller disconnects itself from the network and lose all connectivity. I have to manually reboot the controlller to bring it back up. I NOT DOING SOMETHING RIGHT. i HAVE EVERYTHING WORKING ON THE SUBNET 1.XXX its the only way to have interent.

 

Any suggestions.

 

Im not convinced that I need to use this controller. Before adopting all switches and APs never missed a beat. Been in place for over a month before using controller

  0  
  0  
#23
Options
Re:OC200 Purchased
2024-02-25 18:46:49

  @bigal_12ms 

 

Going to take this as progress :)

 

At this point probably need a little more detail about which device is connected to what.  The controller can build this Topology map for you graphically once devices are adopted, and you can turn on Labels, to get more detail like port numbers.  However, perhaps this following will be more immediately useful to you.

 

It looks like you have a number of interfaces defined on the Pfsense router.  Presumably these interfaces can be configured as Access or Trunk physical ports, the difference being that if a port is say an access port for VLAN 30, then it is a member of VLAN 30 and 30 is set as the PVID (meaning any untagged traffic is treated as belonging to VLAN30 and will get an IP from the VLAN 30 subnet via its DHCP server). 

 

However, Omada works more with trunk ports, which means a single port on the router connects to a single port on the first downstream switch.  The router port MUST be configured with all necessary VLANs, ie all VLANs used by any device below the router (so, 1, 50,100,200 and maybe 30) and the PVID will be set to VLAN 1 meaning that 192.168.1.X subnet is untagged, and traffic on the all the other subnets is tagged appropriately.  The connection at the downstream switch will be configured automatically by the OC200 so that it is also a member of VLANs 1,50,100,200 and it's PVID is set to 1 (so again VLAN1 traffic is untagged).  It is CRITICAL that all ports servicing Omada controlled device downstream are also a member of VLAN1 (but the controller should take care of this automatically once the switches are adopted).

 

Now let's look at the case of a downstream AP which is configured with two SSIDs, one for IOT and one for Management.  This AP now needs access to subnets 192.168.1.x, 192.168.100.x and 192.168.200.x via VLANS 1, 100 and 200 respectively.  So the port the AP connects to is configured as a member of those 3 VLANs (1,100,200) and its PVID is again set to VLAN 1.

 

One thing to consider in all of this is that the trunk port on the Pfsense router needs to be able to deal with all the VLANs arriving from the master switch immediately below it.

<< Paying it forward, one juicy problem at a time... >>
  0  
  0  
#24
Options
Re:OC200 Purchased
2024-02-25 19:26:12

  @d0ugmac1 

Ok would it not be better to allow the Controller to handle all vlans and let Pfsense handle just DHCP ?? as router only

 

 

At this point probably need a little more detail about which device is connected to what.  The controller can build this Topology map for you graphically once devices are adopted, and you can turn on Labels, to get more detail like port numbers.  However, perhaps this following will be more immediately useful to you.

 

It looks like you have a number of interfaces defined on the Pfsense router.  Presumably these interfaces can be configured as Access or Trunk physical ports, the difference being that if a port is say an access port for VLAN 30, then it is a member of VLAN 30 and 30 is set as the PVID This is How I had it setup on Switch prior to Controller

(meaning any untagged traffic is treated as belonging to VLAN30 and will get an IP from the VLAN 30 subnet via its DHCP server). 

 

However, Omada works more with trunk ports, which means a single port on the router connects to a single port on the first downstream switch.  The router port MUST be configured with all necessary VLANs, ie all VLANs used by any device below the router (so, 1, 50,100,200 and maybe 30) and the PVID will be set to VLAN 1 meaning that 192.168.1.X subnet is untagged, and traffic on the all the other subnets is tagged appropriately.  The connection at the downstream switch will be configured automatically by the OC200 so that it is also a member of VLANs 1,50,100,200 and it's PVID is set to 1 (so again VLAN1 traffic is untagged).  It is CRITICAL that all ports servicing Omada controlled device downstream are also a member of VLAN1 (but the controller should take care of this automatically once the switches are adopted).

 

Now let's look at the case of a downstream AP which is configured with two SSIDs, one for IOT and one for Management.  This AP now needs access to subnets 192.168.1.x, 192.168.100.x and 192.168.200.x via VLANS 1, 100 and 200 respectively.  So the port the AP connects to is configured as a member of those 3 VLANs (1,100,200) and its PVID is again set to VLAN 1.

 

One thing to consider in all of this is that the trunk port on the Pfsense router needs to be able to deal with all the VLANs arriving from the master switch immediately below it.

  0  
  0  
#25
Options
Re:OC200 Purchased
2024-02-25 21:21:59 - last edited 2024-02-25 21:22:25

  @d0ugmac1 

Ok I have reinstated the network without the Controller for now going to do some more research on Pfsense. I know it is a ME unstanding issue. But I'll will figure it out.

 

Thanks again Talk back soon  @d0ugmac1

  0  
  0  
#26
Options
Re:OC200 Purchased
2024-02-25 23:08:46

  @bigal_12ms you have to manage the vlans on both devices and they have to match exactly.  This is the downside of splitting the omada/3rd Party between router and the rest of the devices.

<< Paying it forward, one juicy problem at a time... >>
  0  
  0  
#27
Options
Re:OC200 Purchased
2024-02-26 00:18:55

  @d0ugmac1 

You are RIGHT!! I got so Frustrated (ALL ME) I hate when I miss something. I need to take a couple of days off from this and come back to it. Im gonna make it work with the controller. Hang in there with me so I can LEARN Brother. 

 

Be back on Wednesday to try again

 

Thaniks Again  @d0ugmac1

 

 

Big_12ms

  1  
  1  
#28
Options
Related Articles