Talk Straight / Mikrotik / Unifi / Student SSID

[Alastairb25]

Hi,

 

We currently use Talk Straight as our ISP

They supply a Mikrotik router board as a CPE with Multiple customer side ports

 

We use a Cisco network infrastructure

We use Unifi for Wifi with a Dream machine Pro

 

We wish to move Student traffic to the following type of setup

 

Student Device

|

Student SSID

IP range given as a result via an IP helper pointing to existing DHCP, which will have a scope in the range using option 132 for VLAN

|

This then transits from the AP (on a trunk port of Cisco edge switch

|

Trunk port on Edge sends to Core

|

Core sends to (UDMP) Unifi Dream Machine Pro LAN side

|

UDMP Internet side connects to Mikrotik and routes out

 

 

We are having some issues with communication and we think it may be the Mikrotik side

 

Does anyone have a similar setup ?

 

 

Thanks,

Alastair

[Davit2005]

Could be a few things in play here.

Do devices on the student SSID get a IP address on the correct range? Troubleshoot with Unifi below

Check the student SSID vlan is tagged on ports that the Unifi APs are plugged into.

Set a switch port to untagged on the vlan used by the SSID and see if device i.e. laptop plugged into the port gets IP address etc.

 

Are there routes to the subnet used for the student SSID from the firewall (guessing on MikroTik here)?

From a device that passes the above getting IP tests see if it can ping it's default gateway?

Is the vlan/subnet used for the student SSID routed on the firewall or the UDM?

[FN-GM]

Hi,

 

We currently use Talk Straight as our ISP

They supply a Mikrotik router board as a CPE with Multiple customer side ports

 

We use a Cisco network infrastructure

We use Unifi for Wifi with a Dream machine Pro

 

We wish to move Student traffic to the following type of setup

 

Student Device

|

Student SSID

IP range given as a result via an IP helper pointing to existing DHCP, which will have a scope in the range using option 132 for VLAN

|

This then transits from the AP (on a trunk port of Cisco edge switch

|

Trunk port on Edge sends to Core

|

Core sends to (UDMP) Unifi Dream Machine Pro LAN side

|

UDMP Internet side connects to Mikrotik and routes out

 

 

We are having some issues with communication and we think it may be the Mikrotik side

 

Does anyone have a similar setup ?

 

 

Thanks,

Alastair

 

Is that UDMP a router? If not, the traffic from the access points wouldn’t transition through the controller UDMP. It would go from your core to the Mikrotik.

Edited July 26, 2023 by FN-GM

[Alastairb25]

It is a Router yes

Routing traffic through it gives visibility over what Public Wifi users are doing, along with other things like Client Isolation which are desirable

[Alastairb25]

Mikrotik has multiple ports

Eth1 - Existing LAN - VLAN1

Eth2 - x.x.x.x/xx a "Public SSID Wifi range" but on private IP addressing - VLAN10 for arguments sake

Eth3 - x.x.x.x/xx a "Private SSID Wifi range" but on private IP addressing - VLAN20 for arguments sake

 

Can go so far as having a laptop plugged in pickup a DHCP address within the Eth2 range via the specific scope for it and 132 option set

 

Seems more like a Mikrotik talking back issue

 

But also how the UDMP should fit in this setup, ie

 

Internet

|

Mikrotik ISP side

Mikrotik Customer side

|

UDMP WAN side

UDMP LAN side

|

School Score Public Wifi side

School Core LAN side - Trunk existing DHCP and Core configured with ip-helper to its IP

|

School Edge LAN side - Trunk

Unifi AP

|

Public SSID

|

Student device

 

 

Thoughts would be :-

 

Student devices joins "Public" SSID

In doing so the config from the UDMP states they are either routed to a VLAN or use a DHCP RELAY

Either method Student device picks up 10.1.10.0/24 (example range with third octet being VLAN10)

It then goes to VLAN10 gateway on core, say 10.1.10.254

Core can then pass it on to LAN side of UDMP

WAN side exits and it talks to Mikrotik

 

Issue is perhaps that in order to route it through UDMP id need it on seperate ranges?

So a /31 between UDMP WAN and one of the Mikrotik EthX ?

 

 

Thanks

[Davit2005]

It depends where the gateway for the Student SSID is. If it is on the MikroTik then no routing should be needed as it should be treated as a local interface. Firewall/NAT rules might be needed either way.

 

 

If this is a vlan (student SSID)which is routed at core switch then it will prob need a route from the next router up i.e. routed on UDMP then MikroTik will need to know how to route traffic back to that network. You only need a n IP helper on the device which is the default gateway for that vlan/subnet.

 

If however the vlan has it's default gateway on the MikroTik, the MikroTik should already have a route as it is directly connected as far as the MikroTik knows.

 

Layer 2 traffic (vlan) can be passed between devices even core switches, layer 3 traffic (IP addresses) is routed.

 

TBH I have not much experience with the UDMP or any Unifi firewalls.

 

One thing to note that if you have BYOD devices you should probably have ACLs or firewall in between those devices and your main network. Once you setup routing on a core switch normally by default all vlans/subnets can talk to each other.

Edited July 26, 2023 by Davit2005

[FN-GM]

Does the Mikrotik have a route (static or other) back to the UDMP?