Unifi USG Routing

[caffrey]

I have two wan IPs

 

The main network dhcp server dishes out addresses with a gateway that points to Smoothwall, smoothwall does its thing and the devices go to the internet - simple and it works

 

Now I'm experimenting with a USG Pro 4 for routing which routes to the other WAN IP. I've set up a vlan on Unifi that picks up an address via DHCP relay from the main network DHCP server and the clients are getting correct addresses without a problem, however they get no internet and I cannot figure out why.

 

It may be to do with what I'm trying to achieve or limitations with Unifi

 

I've tried everything I can think of, and there's only so many options to try, I'm genuinely perplexed - has anyone done this ? I've set up a similar scenario at home albeit with only one WAN address and it just works

 

VLAN 150 (192.168.50.0/24) points to 192.168.5.1 DHCP Server - address given is 192.168.50.10 mask 255.255.255.0 gateway is 192.168.50.1 (vlan gateway) Tried different DNS combinations

 

It just seems like routing isn't working at all, I can't seem to ping subnets, traceroute goes nowhere except the local machine

 

I'm just not sure if this is UNIFI or just me being rubbish, I'm only doing it this way to stop being so self reliant on Smoothwalls DHCP server and routing

 

Weird thing is, for the first 2 seconds of a device connecting to the VLAN a traceroute works fine, if I try a couple of seconds later I get a destination unreachable

 

Very simple network diagram

 

Edited May 3, 2018 by caffrey

[Blue_Cookeh]

I think we need to see a bigger picture of your network - if you could amend your diagram to add any other switches and a client PC as an example that would be helpful.

 

We have two WANs like you but we terminate both ISPs into a Sophos UTM (via separate VLANs) so the clients never have to change their routes - our UTM manages it automatically when it detects a WAN link is down. The way you'd introduce redundancy into that is to get a second UTM/router and enable the proprietary HA or use virtual IPs/HSRP.

 

The only way I can see your method of working at the moment is if all your clients pointed to a L3 switch or another router which could then make the decision on whether to send traffic via the Smoothwall or USG. Don't forget that both Smoothwall and the USG are going to need to know how to get back to your internal subnet if you actually do have a L3 switch in there, so you need routes on the L3 switch *and* the routers.

Edited May 3, 2018 by Blue_Cookeh

[caffrey]

I'm starting to think it's a limitation of the USG and there isn't a lot of options in the Unifi interface. We don't have a L3 switch anywhere on the network and have relied on Smoothwall for routing - I'm just trying to move away from that, there's too many factors that could be causing it so I'm probably just going to have to give in and route through Smoothwall. I'm also limited to the amount of testing I can do on a live network that and I think I'm getting out of my depth

 

I do have a Unifi setup at home and it routes traffic to the WAN from different vlans without any issue, mirrored that on the school network and nothing

Edited May 4, 2018 by caffrey

[JackCPickup]

Not the most useful input but you'd likely have more luck with an EdgeRouter Lite, USG is way more limited.

[caffrey]

I know, wouldn't care but I sold my personal one recently

[Primus]

To be honest a lot of the USG configuration is done by json file. Have you tried the Unifi support forums as they're quite good.

[caffrey]

Tried over there and on Reddit, problem is I don't know how to word what it is exactly I need to do or draw.

 

Basically LAN goes to one gateway, vlan goes to another. I know the LAN works as if I change my gateway address on my PC it works like it should and routes through the USG instead of Smoothwall, just doesn't work on VLANS

[caffrey]

Actually this has got even weirder

 

I fell back to Smoothwall, set up a vlan on the internal nic, DHCP scope - access etc.

 

Device gets an IP but it's exhibiting the exact same behaviour - wonder what will happen if I pull the plug on the USG

[JackCPickup]

What's your end goal? One router load balancing to 2 WANs? Failover between the lines? Specific traffic going out different WANs depending on VLAN?

[caffrey]

What's your end goal? One router load balancing to 2 WANs? Failover between the lines? Specific traffic going out different WANs depending on VLAN?

 

Specific traffic (subnets) going out different WANs depending on VLAN

 

End goal is to remove as much from Smoothwall so I'm not reliant on it as a UTM

 

Just unplugged the lan from the USG and no difference - I'm really scratching my head here!

Edited May 4, 2018 by caffrey

[Davit2005]

Specific traffic (subnets) going out different WANs depending on VLAN

 

End goal is to remove as much from Smoothwall so I'm not reliant on it as a UTM

 

Just unplugged the lan from the USG and no difference - I'm really scratching my head here!

 

Not knowing Smoothwall that well. But could you do this by NAT policies on the smoothwall?

[caffrey]

Not sure you can, and the firewall isn't particularly brilliant on Smoothwall

[ITGuyWestMidlands]

Yes you can. Setup two external interfaces and configure your Nat on the smoothwall to route your traffic accordingly.

[caffrey]

Hrrm after all that, I think it was the NICs on the two laptops I tried - both Realtek. I set the vlan ID in the adapter settings on both (I thought it was a bit iffy when I set the tags)

 

But showerthought this morning was "lets spin up a VM with an intel nic and set the vlan on that" - worked straightaway

 

So yeah it looks like the realtek stuff sucks, and it must've been sheer coincidence (different make laptops, different OS) I'm still struggling to admit that was the fault though...