@Tintronic Im not certain why you continue to have issues If a remote site is adopted inside its site-to-site VPN, you dont need any port forwards and the controller can update firmware on all...

@Clive_A controller mode does support IP-group and IP-Port Group on gateway ACLs in both WAN IN and LAN>WAN directions, which i think is applicable here

@Jason4 All links between switches, regardless of brands, should have untagged management network, tagged everything else. If you start having multiple untagged, or a mix of untagged and tagged...

@Adamzsite Sometimes a firmware (whether user applied or form the factory) prevents the installation of any older versions as things like partitions, binaries, boot images might have changes and this...

Guess ill stick with the janky solution then! it works so, whatever i guess

@MrHC1983 you just forget the known client and the lock goes away